From 8cd1076f8753ba250dc244b6746de65007064186 Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Fri, 29 Sep 2023 11:57:39 -0700 Subject: [PATCH 01/37] Update 50 detections --- ...suspicious_email_attachment_extensions.yml | 18 +++++++- ...servers_executing_suspicious_processes.yml | 18 +++++++- ...azon_eks_kubernetes_pod_scan_detection.yml | 21 ++++++++- ...ged_role_assigned_to_service_principal.yml | 32 ++++++------- .../cloud/circle_ci_disable_security_job.yml | 14 +++++- .../cloud/circle_ci_disable_security_step.yml | 19 +++++++- ...alls_from_previously_unseen_user_roles.yml | 20 ++++++++- ...e_created_with_previously_unseen_image.yml | 16 ++++++- ...d_with_previously_unseen_instance_type.yml | 17 ++++++- .../correlation_by_repository_and_risk.yml | 16 ++++++- .../cloud/correlation_by_user_and_risk.yml | 13 +++++- detections/cloud/github_dependabot_alert.yml | 19 +++++++- .../github_pull_request_from_unknown_user.yml | 20 ++++++++- .../cloud/o365_new_federated_domain_added.yml | 26 ++++++++--- .../o365_suspicious_user_email_forwarding.yml | 27 ++++++++++- .../access_lsass_memory_for_dump_creation.yml | 11 ++++- .../endpoint/attacker_tools_on_endpoint.yml | 26 ++++++----- ..._to_add_certificate_to_untrusted_store.yml | 23 +++++----- .../attempt_to_stop_security_service.yml | 19 +++++++- .../endpoint/common_ransomware_extensions.yml | 12 ++++- ...ate_local_admin_accounts_using_net_exe.yml | 19 +++++++- ...or_delete_windows_shares_using_net_exe.yml | 22 ++++++++- .../create_remote_thread_into_lsass.yml | 15 ++++++- ...f_shadow_copy_with_wmic_and_powershell.yml | 15 ++++++- ...ping_via_copy_command_from_shadow_copy.yml | 20 ++++++++- ...ial_dumping_via_symlink_to_shadow_copy.yml | 17 ++++++- .../detect_baron_samedit_cve_2021_3156.yml | 16 ++++++- ...t_baron_samedit_cve_2021_3156_segfault.yml | 9 +++- ...aron_samedit_cve_2021_3156_via_osquery.yml | 19 +++++++- ...redential_dumping_through_lsass_access.yml | 18 ++++++-- .../detect_new_local_admin_account.yml | 22 ++++++++- .../endpoint/dump_lsass_via_comsvcs_dll.yml | 45 +++++++++---------- .../endpoint/file_with_samsam_extension.yml | 20 ++++++++- .../endpoint/linux_decode_base64_to_shell.yml | 12 ++++- .../remcos_client_registry_install_entry.yml | 22 ++++++++- .../endpoint/script_execution_via_wmi.yml | 22 +++++---- .../endpoint/short_lived_windows_accounts.yml | 20 ++++++++- .../single_letter_process_on_endpoint.yml | 10 ++++- ...spicious_writes_to_windows_recycle_bin.yml | 15 ++++++- .../endpoint/unusually_long_command_line.yml | 17 ++++++- ...omain_controller_audit_policy_disabled.yml | 34 +++++++++++--- ..._service_creation_using_registry_entry.yml | 29 +++++++----- .../wmi_permanent_event_subscription.yml | 19 +++++++- .../wmi_temporary_event_subscription.yml | 24 +++++++++- ...t_windows_dns_sigred_via_splunk_stream.yml | 16 ++++++- .../detect_windows_dns_sigred_via_zeek.yml | 15 ++++++- .../network/detect_zerologon_via_zeek.yml | 19 +++++++- detections/network/smb_traffic_spike.yml | 17 ++++++- .../web/sql_injection_with_long_urls.yml | 23 +++++++++- detections/web/supernova_webshell.yml | 16 ++++++- 50 files changed, 811 insertions(+), 163 deletions(-) diff --git a/detections/application/suspicious_email_attachment_extensions.yml b/detections/application/suspicious_email_attachment_extensions.yml index fc76b080cb..de999530d4 100644 --- a/detections/application/suspicious_email_attachment_extensions.yml +++ b/detections/application/suspicious_email_attachment_extensions.yml @@ -5,8 +5,22 @@ date: '2023-04-14' author: David Dorsey, Splunk status: experimental type: Anomaly -description: This search looks for emails that have attachments with suspicious file - extensions. +description: This analytic detects emails that contain attachments with suspicious + file extensions. Detecting and responding to emails with suspicious attachments + can mitigate the risks associated with phishing and malware attacks, thereby protecting + the organization's data and systems from potential harm. The detection is made by + using a Splunk query that searches for emails in the datamodel=Email where the filename + of the attachment is not empty. The analytic uses the tstats command to summarize + the count, first time, and last time of the emails that meet the criteria. It groups + the results by the source user, file name, and message ID of the email. The detection + is important because it indicates potential phishing or malware delivery attempts + in which an attacker attempts to deliver malicious content through email attachments, + which can lead to data breaches, malware infections, or unauthorized access to sensitive + information. Next steps include reviewing the identified emails and attachments + and analyzing the source user, file name, and message ID to determine if they are + legitimate or malicious. Additionally, you must inspect any relevant on-disk artifacts + associated with the attachments and investigate any concurrent processes to identify + the source of the attack. data_source: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Email where All_Email.file_name="*" by All_Email.src_user, diff --git a/detections/application/web_servers_executing_suspicious_processes.yml b/detections/application/web_servers_executing_suspicious_processes.yml index fe35ccdfb6..b45ac4894e 100644 --- a/detections/application/web_servers_executing_suspicious_processes.yml +++ b/detections/application/web_servers_executing_suspicious_processes.yml @@ -5,8 +5,22 @@ date: '2019-04-01' author: David Dorsey, Splunk status: experimental type: TTP -description: This search looks for suspicious processes on all systems labeled as - web servers. +description: This analytic detects suspicious processes on systems labeled as web + servers. This detection is made by a Splunk query that searches for specific process + names that might indicate malicious activity. These suspicious processes include + "whoami", "ping", "iptables", "wget", "service", and "curl". Uses the Splunk data + model "Endpoint.Processes" and filters the results to only include systems categorized + as web servers. This detection is important because it indicates unauthorized or + malicious activity on web servers since these processes are commonly used by attackers + to perform reconnaissance, establish persistence, or exfiltrate data from compromised + systems. The impact of such an attack can be significant, ranging from data theft + to the deployment of additional malicious payloads, potentially leading to ransomware + or other damaging outcomes. False positives might occur since the legitimate use + of these processes on web servers can trigger the analytic. Next steps include triaging + and investigating to determine the legitimacy of the activity. Also, review the + source and command of the suspicious process. You must also examine any relevant + on-disk artifacts and look for concurrent processes to identify the source of the + attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml index ab43700559..7a4ca51829 100644 --- a/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml +++ b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml @@ -5,8 +5,25 @@ date: '2020-04-15' author: Rod Soto, Splunk status: experimental type: Hunting -description: This search provides detection information on unauthenticated requests - against Kubernetes' Pods API +description: As a prerequisite, ensure that you are ingesting logs from your Kubernetes + environment, specifically the AWS CloudWatch logs for EKS. This analytic detects + unauthenticated requests made against the Kubernetes' Pods API through proactive + monitoring to protect the Kubernetes environment from unauthorized access and potential + security breaches. The detection is made by using the Splunk query `aws_cloudwatchlogs_eks` + with specific filters to identify these requests. Identifies events where the `user.username` + is set to "system:anonymous", the `verb` is set to "list", and the `objectRef.resource` + is set to "pods". Additionally, the search checks if the `requestURI` is equal to + "/api/v1/pods". Analyzing these events helps you to identify any unauthorized access + attempts to the Kubernetes' Pods API. Unauthenticated requests can indicate potential + security breaches or unauthorized access to sensitive resources within the Kubernetes + environment. The detection is important because unauthorized access to Kubernetes' + Pods API can lead to the compromise of sensitive data, unauthorized execution of + commands, or even the potential for lateral movement within the Kubernetes cluster. + False positives might occur since there might be legitimate use cases for unauthenticated + requests in certain scenarios. Therefore, you must review and validate any detected + events before taking any action. Next steps include investigating the incident + to mitigate any ongoing threats, and strengthening the security measures to prevent + future unauthorized access attempts. data_source: [] search: '`aws_cloudwatchlogs_eks` "user.username"="system:anonymous" verb=list objectRef.resource=pods requestURI="/api/v1/pods" | rename source as cluster_name sourceIPs{} as src_ip diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml index 4714c4b7b6..308e54d719 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml @@ -5,20 +5,22 @@ date: '2023-04-28' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic is geared towards detecting potential privilege escalation threats in Azure Active Directory (AD). It identifies instances where privileged roles, which hold elevated permissions, are assigned to Service Principals. These non-human entities that can access Azure resources could be exploited in an attack scenario, leading to unauthorized access or malicious activities. The analytic runs a specific search within the ingested Azure AD events, specifically leveraging the AuditLogs log category. Keep in mind, however, that there could be false positives, as administrators may legitimately assign privileged roles to Service Principals. +description: "This analytic detects potential privilege escalation threats in Azure\ + \ Active Directory (AD). The detection is made by running a specific search within\ + \ the ingested Azure Active Directory events to leverage the AuditLogs log category.\ + \ \nThis detection is important because it identifies instances where privileged\ + \ roles that hold elevated permissions are assigned to service principals. This\ + \ prevents unauthorized access or malicious activities, which occur when these non-human\ + \ entities access Azure resources to exploit them. False positives might occur since\ + \ administrators can legitimately assign privileged roles to service principals." data_source: [] -search: ' `azuread` operationName="Add member to role" - | rename properties.* as * - | search "targetResources{}.type"=ServicePrincipal - | rename initiatedBy.user.userPrincipalName as initiatedBy - | rename targetResources{}.modifiedProperties{}.newValue as roles - | eval role=mvindex(roles,1) - | rename targetResources{}.displayName as apps - | eval displayName=mvindex(apps,0) - | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description - | search isprvilegedadrole = True - | stats values(displayName) by _time, initiatedBy, result, operationName, role - | `azure_ad_privileged_role_assigned_to_service_principal_filter`' +search: ' `azuread` operationName="Add member to role" | rename properties.* as * + | search "targetResources{}.type"=ServicePrincipal | rename initiatedBy.user.userPrincipalName + as initiatedBy | rename targetResources{}.modifiedProperties{}.newValue as roles + | eval role=mvindex(roles,1) | rename targetResources{}.displayName as apps | eval + displayName=mvindex(apps,0) | lookup privileged_azure_ad_roles azureadrole AS role + OUTPUT isprvilegedadrole description | search isprvilegedadrole = True | stats values(displayName) + by _time, initiatedBy, result, operationName, role | `azure_ad_privileged_role_assigned_to_service_principal_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. @@ -33,8 +35,8 @@ tags: asset_type: Azure Active Directory confidence: 50 impact: 70 - message: A privileged Azure AD role was assigned to the Service Principal $displayName$ initiated - by $initiatedBy$ + message: A privileged Azure AD role was assigned to the Service Principal $displayName$ + initiated by $initiatedBy$ mitre_attack_id: - T1098 - T1098.003 diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/cloud/circle_ci_disable_security_job.yml index 66685c1387..0135a2bca9 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/cloud/circle_ci_disable_security_job.yml @@ -5,7 +5,19 @@ date: '2021-09-02' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: This search looks for disable security job in CircleCI pipeline. +description: This analytic searches for a specific behavior in CircleCI pipelines + such as the disabling of security jobs. The detection is made by using a Splunk + query that renames certain fields and retrieves values for specified job names, + workflow IDs and names, user information, commit messages, URLs, and branches. Then, + the query identifies mandatory jobs for each workflow and searches for instances + where they were run. The search also identifies the phase of the pipeline as "build" + and extracts the repository name from the URL using regular expressions. The detection + is important because it detects attempts to bypass security measures in CircleCI + pipelines, which can potentially lead to malicious code being introduced into the + pipeline, data breaches, system downtime, and reputational damage. False positives + might occur since legitimate use cases can require the disabling of security jobs. + However, you can proactively monitor and identify any suspicious activity in the + pipeline using this analytic and mitigate potential threats through early detection. data_source: [] search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_message vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/cloud/circle_ci_disable_security_step.yml index ec714db204..90c331acc1 100644 --- a/detections/cloud/circle_ci_disable_security_step.yml +++ b/detections/cloud/circle_ci_disable_security_step.yml @@ -5,7 +5,24 @@ date: '2021-09-01' author: Patrick Bareiss, Splunk status: experimental type: Anomaly -description: This search looks for disable security step in CircleCI pipeline. +description: This analytic detects the disablement of security steps in a CircleCI + pipeline. Addressing instances of security step disablement in CircleCI pipelines + can mitigate the risks associated with potential security vulnerabilities and unauthorized + changes. A proactive approach helps protect the organization's infrastructure, data, + and overall security posture. The detection is made by a Splunk query that searches + for specific criteria within CircleCI logs through a combination of field renaming, + joining, and statistical analysis to identify instances where security steps are + disabled. It retrieves information such as job IDs, job names, commit details, and + user information from the CircleCI logs. The detection is important because it + indicates potential security vulnerabilities or unauthorized changes to the pipeline + caused by someone within the organization intentionally or unintentionally disabling + security steps in the CircleCI pipeline.Disabling security steps can leave the pipeline + and the associated infrastructure exposed to potential attacks, data breaches, or + the introduction of malicious code into the pipeline. Investigate by reviewing the + job name, commit details, and user information associated with the disablement of + security steps. You must also examine any relevant on-disk artifacts and identify + concurrent processes that might indicate the source of the attack or unauthorized + change. data_source: [] search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search `circleci` | stats values(name) as step_names count by job_id job_name ] | stats count by step_names diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index 576f8b9363..a4219fdca8 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -5,7 +5,25 @@ date: '2020-09-04' author: David Dorsey, Splunk status: experimental type: Anomaly -description: This search looks for new commands from each user role. +description: This analytic detects when a new command is run by a user, who typically + does not run those commands. The detection is made by a Splunk query to search for + these commands in the Change data model. Identifies commands run by users with the + user_type of AssumedRole and a status of success. The query retrieves the earliest + and latest timestamps of each command run and groups the results by the user and + command. Then, it drops the unnecessary data model object name and creates a lookup + to verify if the command was seen before. The lookup table contains information + about previously seen cloud API calls for each user role, including the first time + the command was seen and whether enough data is available for analysis. If the firstTimeSeenUserApiCall + field is null or greater than the relative time of 24 hours ago, it indicates that + the command is new and was not seen before. The final result table includes the + firstTime, user, object, and command fields of the new commands. It also applies + the security_content_ctime function to format the timestamps and applies a filter + to remove any cloud API calls from previously unseen user roles. The detection is + important because it helps to identify new commands run by different user roles. + New commands can indicate potential malicious activity or unauthorized actions within + the environment. Detecting and investigating these new commands can help identify + and mitigate potential security threats earlier, preventing data breaches, unauthorized + access, or other damaging outcomes. data_source: [] search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 7b75e8c8b6..488e6a5ca1 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -5,8 +5,20 @@ date: '2018-10-12' author: David Dorsey, Splunk status: experimental type: Anomaly -description: This search looks for cloud compute instances being created with previously - unseen image IDs. +description: As a prerequisite, ensure that you are ingesting relevant logs that capture + information about instance creation and image IDs in your cloud computing environment. + This analytic detects potential instances that are created in a cloud computing + environment using new or unknown image IDs that have not been seen before. This + detection is important because it helps to investigate and take appropriate action + to prevent further damage or unauthorized access to the Cloud environment, which + can include data breaches, unauthorized access to sensitive information, or the + deployment of malicious payloads within the cloud environment. False positives might + occur since legitimate instances can also have previously unseen image IDs. Next + steps include conducting an extensive triage and investigation to determine the + nature of the activity. During triage, review the details of the created instances, + including the user responsible for the creation, the image ID used, and any associated + metadata. Additionally, consider inspecting any relevant on-disk artifacts and analyzing + concurrent processes to identify the source of the attack. data_source: [] search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id, diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 7727d52934..b7b79b97df 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -5,7 +5,22 @@ date: '2020-09-12' author: David Dorsey, Splunk status: experimental type: Anomaly -description: Find EC2 instances being created with previously unseen instance types. +description: As a prerequisite, ensure that you ingest logs that contain EC2 instance + creation information into your Splunk environment. This analytic detects the creation + of EC2 instances with previously unseen instance types. The detection is made by + using a Splunk query to identify the EC2 instances. First, the query searches for + changes in the EC2 instance creation action and filters for instances with instance + types that are not recognized or previously seen. Next, the query uses the Splunk + tstats command to gather the necessary information from the Change data model. Then, + it filters the instances with unknown instance types and reviews previously seen + instance types to determine if they are new or not. The detection is important because + it identifies attackers attempting to create instances with unknown or potentially + compromised instance types, which can be an attempt to gain unauthorized access + to sensitive data, compromise of systems, exfiltrate data, potential disruption + of services, or launch other malicious activities within the environment. False + positives might occur since there might be legitimate reasons for creating instances + with previously unseen instance types. Therefore, you must carefully review and + triage all alerts. data_source: [] search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, diff --git a/detections/cloud/correlation_by_repository_and_risk.yml b/detections/cloud/correlation_by_repository_and_risk.yml index 62dd526437..a1fe534504 100644 --- a/detections/cloud/correlation_by_repository_and_risk.yml +++ b/detections/cloud/correlation_by_repository_and_risk.yml @@ -5,7 +5,21 @@ date: '2021-09-06' author: Patrick Bareiss, Splunk status: production type: Correlation -description: This search correlations detections by repository and risk_score +description: This analytic detects by correlating repository and risk score to identify + patterns and trends in the data based on the level of risk associated. The analytic + adds any null values and calculates the sum of the risk scores for each detection. + Then, the analytic captures the source and user information for each detection and + sorts the results in ascending order based on the risk score. Finally, the analytic + filters the detections with a risk score below 80 and focuses only on high-risk + detections.This detection is important because it provides valuable insights into + the distribution of high-risk activities across different repositories. It also + identifies the most vulnerable repositories that are frequently targeted by potential + threats. Additionally, it proactively detects and responds to potential threats, + thereby minimizing the impact of attacks and safeguarding critical assets. Finally, + it provides a comprehensive view of the risk landscape and helps to make informed + decisions to protect the organization's data and infrastructure. False positives + might occur so it is important to identify the impact of the attack and prioritize + response and mitigation efforts. data_source: [] search: '`risk_index` | fillnull | stats sum(risk_score) as risk_score values(source) as signals values(user) as user by repository | sort - risk_score | where risk_score diff --git a/detections/cloud/correlation_by_user_and_risk.yml b/detections/cloud/correlation_by_user_and_risk.yml index eb03a397a9..9975542c8f 100644 --- a/detections/cloud/correlation_by_user_and_risk.yml +++ b/detections/cloud/correlation_by_user_and_risk.yml @@ -5,7 +5,18 @@ date: '2021-09-06' author: Patrick Bareiss, Splunk status: production type: Correlation -description: This search correlations detections by user and risk_score +description: This analytic detects the correlation between the user and risk score + and identifies users with a high risk score that pose a significant security risk + such as unauthorized access attempts, suspicious behavior, or potential insider + threats. Next, the analytic calculates the sum of the risk scores and groups the + results by user, the corresponding signals, and the repository. The results are + sorted in descending order based on the risk score and filtered to include records + with a risk score greater than 80. Finally, the results are passed through a correlation + filter specific to the user and risk. This detection is important because it identifies + users who have a high risk score and helps to prioritize investigations and allocate + resources. False positives might occur but the impact of such an attack can vary + depending on the specific scenario such as data exfiltration, system compromise, + or the disruption of critical services. Please investigate this notable event. data_source: [] search: '`risk_index` | fillnull | stats sum(risk_score) as risk_score values(source) as signals values(repository) as repository by user | sort - risk_score | where diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index 4db1064dcf..3d3e7977fb 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -5,7 +5,24 @@ date: '2021-09-01' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: This search looks for Dependabot Alerts in Github logs. +description: 'As a prerequisite, ensure that you ingest Github logs that contain information + about Dependabot Alerts. This analytic detects Dependabot Alerts in Github logs. + + The detection is made by first searching for logs that contain the action ""create"" + and renames certain fields for easier analysis. Then, this analytic uses the ""stats"" + command to calculate the first and last occurrence of the alert based on the timestamp. + The fields included in the output are the action, affected package name, affected + range, created date, external identifier, external reference, fixed version, severity, + repository, repository URL, and user. The ""phase"" field is set to ""code"" to + indicate that the alert pertains to code-related issues. The detection is important + because dependabot Alerts can indicate vulnerabilities in the codebase that can + be exploited by attackers. Detecting and investigating these alerts can help a SOC + to proactively address security risks and prevent potential breaches or unauthorized + access to sensitive information. False positives might occur since there are legitimate + actions that trigger the ""create"" action or if other factors exist that can generate + similar log entries. Next steps include reviewing the details of the alert, such + as the affected package, severity, and fixed version to determine the appropriate + response and mitigation steps.' data_source: [] search: '`github` alert.id=* action=create | rename repository.full_name as repository, repository.html_url as repository_url sender.login as user | stats min(_time) as diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml index 16db0a169d..137f56bde9 100644 --- a/detections/cloud/github_pull_request_from_unknown_user.yml +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -5,7 +5,25 @@ date: '2021-09-01' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: This search looks for Pull Request from unknown user. +description: "As a prerequisite, ensure that you ingest GitHub logs into Splunk.\ + \ \nand have access to the following fields: (i)`check_suite.pull_requests` (ii)\ + \ `check_suite.head_commit.author.name`(iii) `repository.full_name` (iv) `check_suite.pull_requests.head.ref`(v)`check_suite.head_commit.message`\ + \ This analytic detects pull requests from unknown users on GitHub. The detection\ + \ is made by using a Splunk query to search for pull requests in the `check_suite.pull_requests`\ + \ field where the `id` is not specified. Next, the analytic retrieves information\ + \ such as the author's name, the repository's full name, the head reference of the\ + \ pull request, and the commit message from the `check_suite.head_commit` field.\ + \ The analytic also includes a step to exclude known users by using the `github_known_users`\ + \ lookup table, which helps to filter out pull requests from known users and focus\ + \ on the pull requests from unknown users.\nThe detection is important because it\ + \ locates potential malicious activity or unauthorized access since unknown users\ + \ can introduce malicious code or gain unauthorized access to repositories leading\ + \ to unauthorized code changes, data breaches, or other security incidents. Next\ + \ steps include reviewing the author's name, the repository involved, the head reference\ + \ of the pull request, and the commit message upon triage of a potential pull request\ + \ from an unknown user. You must also analyze any relevant on-disk artifacts and\ + \ investigate any concurrent processes to determine the source and intent of the\ + \ pull request." data_source: [] search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name repository.full_name check_suite.pull_requests{}.head.ref check_suite.head_commit.message diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 8c1580bfc6..f54d10b808 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -5,13 +5,29 @@ date: '2023-08-02' author: Rod Soto, Splunk status: production type: TTP -description: The following search detects the addition of a new Federated domain in O365 environments. If an attacker adds an unverified domain to Office 365, they may gain unauthorized access to the organization's email and other services, potentially leading to data breaches and information theft. It can be misused to set up adversary infrastruture for phishing, spoofing emails and malware distribution. +description: This analytic detects the addition of a new federated domain in an organization's + Office 365 environment. Identifies instances where a new federated domain is added + to the organization's Office 365 configuration and helps to take immediate action + to mitigate the risks, prevent further unauthorized access, and protect the organization's + data and systems. The detection is made by the Splunk query `o365_management_activity` + with the parameters `Workload=Exchange` and `Operation="Add-FederatedDomain"`, which + analyzes the management activity logs in Office 365 and filters for the specific + operation to add a federated domain. The detection is important because identifying + the addition of a new federated domain can indicate potential unauthorized access + or compromise of the organization's Office 365 environment. A new Federated domain + can be added by an attacker to gain unauthorized access, exfiltrate data, or carry + out other malicious activity, which can lead to data breaches, unauthorized access + to sensitive information, or compromise of the organization's systems and infrastructure. + Next steps include viewing the details of the added federated domain, including + the organization name, originating server, user ID, and user key. You must also + capture and analyze any relevant on-disk artifacts. Additionally, you must identify + the source of the attack by looking for concurrent processes or other indicators + of compromise. data_source: [] search: '`o365_management_activity` Operation IN ("*add*", "*new*") AND Operation="*domain*" - | stats count values(ModifiedProperties{}.NewValue) as new_value by user user_agent authentication_service action Workload Operation - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_new_federated_domain_added_filter`' + | stats count values(ModifiedProperties{}.NewValue) as new_value by user user_agent + authentication_service action Workload Operation | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity. known_false_positives: The creation of a new Federated domain is not necessarily malicious, diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 7fc381ba04..11f7f2d164 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -5,8 +5,31 @@ date: '2020-12-16' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: This search detects when multiple user configured a forwarding rule to - the same destination. +description: This analytic detects when multiple users have configured a forwarding + rule to the same destination to proactively identify and investigate potential security + risks related to email forwarding and take appropriate actions to protect the organization's + data and prevent unauthorized access or data breaches. This detection is made by + a Splunk query to O365 management activity logs with the operation `Set-Mailbox` + to gather information about mailbox configurations. Then, the query uses the `spath` + function to extract the parameters and rename the "Identity" field as "src_user" + and searches for entries where the "ForwardingSmtpAddress" field is not empty, which + indicates the presence of a forwarding rule. Next, the analytic uses the `stats` + command to group the results by the forwarding email address and count the number + of unique source users (`src_user`). Finally, it filters the results and only retains + entries where the count of source users (`count_src_user`) is greater than 1, which + indicates that multiple users have set up forwarding rules to the same destination. + This detection is important because it suggests that multiple users are forwarding + emails to the same destination without proper authorization, which can lead to the + exposure of sensitive information, loss of data control, or unauthorized access + to confidential emails. Investigating and addressing this issue promptly can help + prevent data breaches and mitigate potential damage.indicates a potential security + risk since multiple users forwarding emails to the same destination can be a sign + of unauthorized access, data exfiltration, or a compromised account. Additionally, + it also helps to determine if the forwarding rules are legitimate or if they indicate + a security incident. False positives can occur if there are legitimate reasons for + multiple users to forward emails to the same destination, such as a shared mailbox + or a team collaboration scenario. Next steps include further investigation and context + analysis to determine the legitimacy of the forwarding rules. data_source: [] search: '`o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc(src_user) diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index e78f2ab86d..54c6d0c03f 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -5,7 +5,16 @@ date: '2019-12-06' author: Patrick Bareiss, Splunk status: production type: TTP -description: The following analytic is designed to detect potentially malicious activities involving the Local Security Authority Subsystem Service (LSASS) process. Specifically, it identifies when the LSASS process memory is being dumped, an action often associated with credential dumping attacks. This analytic leverages Sysmon logs, particularly those with EventCode 10 related to lsass.exe. It searches for indicators of LSASS memory dumping, such as specific call traces to dbgcore.dll and dbghelp.dll. While memory dumps can be legitimate administrative tasks, LSASS memory dumps are typically unusual and warrant investigation. To implement this analytic, ensure your Sysmon setup includes EventCode 10 logging for lsass.exe and customize the provided macros (sysmon and post-filter macro) to match your specific Splunk environment configuration. +description: As a prerequisite, ensure that your Sysmon setup includes EventCode 10 + logging for lsass.exe. This analytic detects the dumping of the LSASS process memory, + which occurs during credential dumping attacks.The detection is made by using Sysmon + logs, specifically EventCode 10, which is related to lsass.exe. This helps to search + for indicators of LSASS memory dumping such as specific call traces to dbgcore.dll + and dbghelp.dll. This detection is important because it prevents credential dumping + attacks and the theft of sensitive information such as login credentials, which + can be used to gain unauthorized access to systems and data. False positives might + occur due to legitimate administrative tasks. Next steps include reviewing and investigating + each case, given the high risk associated with potential credential dumping attacks. data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 385b25c0ea..9ac65df932 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -5,17 +5,21 @@ date: '2021-11-04' author: Bhavin Patel, Splunk status: production type: TTP -description: The following analytic aims to identify the use of tools commonly exploited - by cybercriminals. The use of these tools often signals nefarious activities like - unauthorized access, network scanning, or data exfiltration, representing a significant - threat to an organization's security infrastructure. By examining process activity - on the host, particularly those processes corresponding to known attacker tool names, - this analytic serves as an early warning system for potential security incidents. - However, its precision must be balanced with the understanding that some administrative - activities might also trigger alerts, resulting in false positives. This underlines - the importance of cyber analysts having a clear understanding of typical endpoint - activities and behaviors within their organization, enabling them to accurately - interpret and respond to these alerts. +description: This analytic detects the use of tools that are commonly exploited by + cybercriminals since these tools are usually associated with malicious activities + such as unauthorized access, network scanning, or data exfiltration and pose a significant + threat to an organization's security infrastructure. It also provides enhanced visibility + into potential security threats and helps to proactively detect and respond to mitigate + the risks associated with cybercriminal activities. This detection is made by examining + the process activity on the host, specifically focusing on processes that are known + to be associated with attacker tool names. This detection is important because it + acts as an early warning system for potential security incidents that allows you + to respond to security incidents promptly. False positives might occur due to legitimate + administrative activities that can resemble malicious actions. You must develop + a comprehensive understanding of typical endpoint activities and behaviors within + the organization to accurately interpret and respond to the alerts generated by + this analytic. This ensures a proper balance between precision and minimizing false + positives. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index b79950c531..9e82309793 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -5,17 +5,18 @@ date: '2021-09-16' author: Patrick Bareiss, Rico Valdez, Splunk status: production type: TTP -description: The following analytic is designed to detect potential security threats - involving the misuse of system trust. It works by detecting events where a process - attempts to add a certificate to the untrusted certificate store, an action often - associated with disabling security tools. The analytic uses Sysmon Event ID 1 data - source, particularly focusing on process activities and command-line arguments related - to 'certutil -addstore'. It's essential to ingest data that records process activity - and logs containing process names and command lines for its effective operation. - Be aware, sometimes administrators might legitimately perform this action. The analytic's - value lies in detecting isolated or unexpected instances, indicative of potential - malicious activities. Cybersecurity analysts should understand the importance of - trust mechanisms and their subversion in system security. +description: As a prerequisite, ensure that you ingest data that records process activity + and logs containing process names and command lines. This analytic detects whether + a process is attempting to add a certificate to the untrusted certificate store, + which might result in security tools being disabled. The detection is made by focusing + on process activities and command-line arguments that are related to the 'certutil + -addstore' command. This detection is important because it helps to identify attackers + who might add a certificate to the untrusted certificate store to disable security + tools and gain unauthorized access to a system. False positives might occur since + legitimate reasons might exist for a process to add a certificate to the untrusted + certificate store, such as system administration tasks. Next steps include conducting + an extensive triage and investigation prior to taking any action. Additionally, + you must understand the importance of trust and its subversion in system security. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index 570306820b..cd53a71245 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -5,8 +5,23 @@ date: '2023-06-13' author: Rico Valdez, Splunk status: production type: TTP -description: This search looks for attempts to stop security-related services on the - endpoint. +description: This analytic detects attempts to stop security-related services on the + endpoint and helps to mitigate potential threats earlier, thereby minimizing the + impact on the organization's security. The detection is made by using a Splunk query + that searches for processes that involve the "sc.exe" command and include the phrase + "stop" in their command. The query collects information such as the process name, + process ID, parent process, user, destination, and timestamps. The detection is + important because attempts to stop security-related services can indicate malicious + activity or an attacker's attempt to disable security measures. This can impact + the organization's security posture and can lead to the compromise of the endpoint + and potentially the entire network. Disabling security services can allow attackers + to gain unauthorized access, exfiltrate sensitive data, or launch further attacks, + such as malware installation or privilege escalation. False positives might occur + since there might be legitimate reasons for stopping these services in certain situations. + Therefore, you must exercise caution and consider the context of the activity before + taking any action. Next steps include reviewing the identified process and its associated + details. You must also investigate any on-disk artifacts related to the process + and review concurrent processes to determine the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` values(Processes.process) as process diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index e1fe9eb881..dcd741a159 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -5,8 +5,16 @@ date: '2022-11-10' author: David Dorsey, Michael Haag, Splunk, Steven Dick status: production type: Hunting -description: The search looks for file modifications with extensions commonly used - by Ransomware +description: "This analytic detects Searches for file modifications that commonly\ + \ occur with Ransomware to detect modifications to files with extensions that are\ + \ commonly used by Ransomware. The detection is made by searches for changes in\ + \ the datamodel=Endpoint.Filesystem, specifically modifications to file extensions\ + \ that match those commonly used by Ransomware.\nThe detection is important because\ + \ it suggests that an attacker is attempting to encrypt or otherwise modify files\ + \ in the environment using malware, potentially leading to data loss that can cause\ + \ significant damage to an organization's data and systems. \nFalse positives might\ + \ occur so the SOC must investigate the affected system to determine the source\ + \ of the modification and take appropriate action to contain and remediate the attack." data_source: - Sysmon Event ID 11 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 68f8abd683..d52ab30c1e 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -5,8 +5,23 @@ date: '2021-09-08' author: Bhavin Patel, Splunk status: production type: TTP -description: This search looks for the creation of local administrator accounts using - net.exe . +description: This analytic detects the creation of local administrator accounts using + the net.exe command to mitigate the risks associated with unauthorized access and + prevent further damage to the environment by responding to potential threats earlier + and taking appropriate actions to protect the organization's systems and data. This + detection is made by a Splunk query to search for processes with the name net.exe + or net1.exe that include the "/add" parameter and have specific keywords related + to administrator accounts in their process name. This detection is important because + the creation of unauthorized local administrator accounts might indicate that an + attacker has successfully created a new administrator account and is trying to gain + persistent access to a system or escalate their privileges for data theft, or other + malicious activities. False positives might occur since there might be legitimate + uses of the net.exe command and the creation of administrator accounts in certain + circumstances. You must consider the context of the activity and other indicators + of compromise before taking any action. For next steps, review the details of the + identified process, including the user, parent process, and parent process name. + Examine any relevant on-disk artifacts and look for concurrent processes to determine + the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count values(Processes.user) as diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 5e26355b95..bfb4a8bc66 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -5,8 +5,26 @@ date: '2020-09-16' author: Bhavin Patel, Splunk status: production type: TTP -description: This search looks for the creation or deletion of hidden shares using - net.exe. +description: As a prerequisite, ensure that you are collecting and ingesting endpoint + process logs that include information about the net.exe command. This analytic detects + the creation or deletion of hidden shares using the net.exe command for prompt response + and mitigation to enhance the overall security posture of the organization and protect + against potential data breaches, malware infections, and other damaging outcomes. + This detection is made by searching for processes that involve the use of net.exe + and filters for actions related to creation or deletion of shares. This detection + is important because it suggests that an attacker is attempting to manipulate or + exploit the network by creating or deleting hidden shares. The creation or deletion + of hidden shares can indicate malicious activity since attackers might use hidden + shares to exfiltrate data, distribute malware, or establish persistence within a + network. The impact of such an attack can vary, but it often involves unauthorized + access to sensitive information, disruption of services, or the introduction of + malware. False positives might occur since legitimate actions can also involve the + use of net.exe. An extensive triage and investigation is necessary to determine + the intent and nature of the detected activity. Next steps include reviewing the + details of the process involving the net.exe command, including the user, parent + process, and timestamps during the triage. Additionally, capture and inspect any + relevant on-disk artifacts and review concurrent processes to identify the source + of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count values(Processes.user) as diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index 2e74c5ef1d..d695532950 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -5,7 +5,20 @@ date: '2019-12-06' author: Patrick Bareiss, Splunk status: production type: TTP -description: The following analytic developed to detect potential credential dumping attacks where a remote thread is created in the Local Security Authority Subsystem Service (LSASS). Credential dumping, a common tactic used by adversaries to steal user authentication credentials, is a significant threat to network security. The analytic leverages Sysmon Event ID 8 logs and looks for processes creating remote threads in lsass.exe, an unusual activity generally linked to credential theft. The confidence level in this alert is high, but it's worth noting that there might be cases where legitimate tools can access LSASS, generating similar logs. As an analyst, it is critical to understand the broader context of such events and differentiate between legitimate activities and possible threats. +description: 'This analytic detects the creation of a remote thread in the Local Security + Authority Subsystem Service (LSASS), which is a common tactic used by adversaries + to steal user authentication credentials, known as credential dumping. The detection + is made by leveraging Sysmon Event ID 8 logs and searches for processes that create + remote threads in lsass.exe. This is an unusual activity that is generally linked + to credential theft or credential dumping, which is a significant threat to network + security. + + The detection is important because it helps to detect potential credential dumping + attacks, which can result in significant damage to an organization''s security. + False positives might occur though the confidence level of this alert is high. There + might be cases where legitimate tools can access LSASS and generate similar logs. + Therefore, you must understand the broader context of such events and differentiate + between legitimate activities and possible threats.' data_source: - Sysmon Event ID 8 search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index df6cee46b1..bfa0b86795 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -5,8 +5,19 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk status: production type: TTP -description: This search detects the use of wmic and Powershell to create a shadow - copy. +description: This analytic detects the use of two specific tools, wmic and Powershell, + to create a shadow copy to identify potential threats earlier and take appropriate + actions to mitigate the risks. This detection is made by a Splunk query that searches + for processes in the Endpoint.Processes data model where either the process name + contains "wmic" or "Powershell" and the process command contains "shadowcopy" and + "create". This detection is important because it suggests that an attacker is attempting + to manipulate or access data in an unauthorized manner, which can lead to data theft, + data manipulation, or other malicious activities. Attackers might use shadow copies + to backup and exfiltrate sensitive data or to hide their tracks by restoring files + to a previous state after an attack. Next steps include reviewing the user associated + with the process, the process name, the original file name, the process command, + and the destination of the process. Additionally, examine any relevant on-disk artifacts + and review other concurrent processes to determine the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index 47d4de5303..85a5e53e99 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -5,8 +5,24 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk status: production type: TTP -description: This search detects credential dumping using copy command from a shadow - copy. +description: "As a prerequisite, ensure that you are ingesting endpoint process logs\ + \ into your Splunk instance. \nThis analytic detects the use of the copy command\ + \ to dump credentials from a shadow copy so that you can detect potential threats\ + \ earlier and mitigate the risks associated with credential dumping. The detection\ + \ is made by using a Splunk query to search for specific processes that indicate\ + \ credential dumping activity. The query looks for processes with command lines\ + \ that include references to certain files, such as \"sam\", \"security\", \"system\"\ + , and \"ntds.dit\", located in system directories like \"system32\" or \"windows\"\ + . The detection is important because it suggests that an attacker is attempting\ + \ to extract credentials from a shadow copy. Credential dumping is a common technique\ + \ used by attackers to obtain sensitive login information and gain unauthorized\ + \ access to systems to escalate privileges, move laterally within the network, or\ + \ gain unauthorized access to sensitive data. False positives might occur since\ + \ legitimate processes might also reference these files. During triage, it is crucial\ + \ to review the process details, including the source and the command that is run.\ + \ Additionally, you must capture and analyze any relevant on-disk artifacts and\ + \ investigate concurrent processes to determine the source of the attack. Additional\ + \ steps include...." data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 166cc109fc..324027f344 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -5,7 +5,22 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk status: production type: TTP -description: This search detects the creation of a symlink to a shadow copy. +description: This analytic detects the creation of a symlink to a shadow copy to identify + potential threats earlier and mitigate the risks associated with symlink creation + to shadow copies. The detection is made by using a Splunk query that searches for + processes with commands containing "mklink" and "HarddiskVolumeShadowCopy". This + analytic retrieves information such as the destination, user, process name, process + ID, parent process, original file name, and parent process ID from the Endpoint.Processes + data model. The detection is important because it indicates potential malicious + activity since attackers might use this technique to manipulate or delete shadow + copies, which are used for system backup and recovery. This detection helps to determine + if an attacker is attempting to cover their tracks or prevent data recovery in the + event of an incident. The impact of such an attack can be significant since it can + hinder incident response efforts, prevent data restoration, and potentially lead + to data loss or compromise. Next steps include reviewing the details of the process, + such as the destination and the user responsible for creating the symlink. Additionally, + you must examine the parent process, any relevant on-disk artifacts, and concurrent + processes to identify the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml index 0f1db83218..f940073ab2 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml @@ -5,7 +5,21 @@ date: '2021-01-27' author: Shannon Davis, Splunk status: experimental type: TTP -description: This search detects the heap-based buffer overflow of sudoedit +description: This analytic detects a specific type of vulnerability known as a heap-based + buffer overflow in the sudoedit command, commonly referred to as Baron Samedit CVE-2021-3156. + The detection is made by a Splunk query that searches for instances of the sudoedit + command with the "-s" flag followed by a double quote. This combination of parameters + is indicative of the vulnerability being exploited. The detection is important because + it suggests that an attacker is attempting to exploit the Baron Samedit vulnerability. + The Baron Samedit vulnerability allows an attacker to gain elevated privileges on + a Linux system and run arbitrary code with root privileges, potentially leading + to complete control over the affected system. The impact of a successful attack + can be severe since it allows the attacker to bypass security measures and gain + unauthorized access to sensitive data or systems. This can result in data breaches, + unauthorized modifications, or even complete system compromise. Next steps include + being aware of this vulnerability and actively monitoring any attempts to exploit + it. By detecting and responding to such attacks in a timely manner, you can prevent + or minimize the potential damage caused by the heap-based buffer overflow of sudoedit. data_source: [] search: '`linux_hosts` "sudoedit -s \\" | `detect_baron_samedit_cve_2021_3156_filter`' how_to_implement: Splunk Universal Forwarder running on Linux systems, capturing logs diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml index 70f59666a5..9df94b51df 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml @@ -5,7 +5,14 @@ date: '2021-01-29' author: Shannon Davis, Splunk status: experimental type: TTP -description: This search detects the heap-based buffer overflow of sudoedit +description: This analytic detects the occurrence of a heap-based buffer overflow + in sudoedit.The detection is made by using a Splunk query to identify Linux hosts + where the terms "sudoedit" and "segfault" appear in the logs. The detection is important + because the heap-based buffer overflow vulnerability in sudoedit can be exploited + by attackers to gain elevated root privileges on a vulnerable system, which might + lead to the compromise of sensitive data, unauthorized access, and other malicious + activities. False positives might occur. Therefore, you must review the logs and + investigate further before taking any action. data_source: [] search: '`linux_hosts` TERM(sudoedit) TERM(segfault) | stats count min(_time) as firstTime max(_time) as lastTime by host | where count > 5 | `detect_baron_samedit_cve_2021_3156_segfault_filter`' diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml index d686da0937..c96526a92b 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml @@ -5,7 +5,24 @@ date: '2021-01-28' author: Shannon Davis, Splunk status: experimental type: TTP -description: This search detects the heap-based buffer overflow of sudoedit +description: "This analytic detects the heap-based buffer overflow for the sudoedit\ + \ command and identifies instances where the command \"sudoedit -s *\" is run using\ + \ the osquery_process data source. \nThis indicates that the sudoedit command is\ + \ used with the \"-s\" flag, which is associated with the heap-based buffer overflow\ + \ vulnerability. The detection is important because it indicates a potential security\ + \ vulnerability, specifically Baron Samedit CVE-2021-3156, which helps to identify\ + \ and respond to potential heap-based buffer overflow attacks to enhance the security\ + \ posture of the organization. This vulnerability allows an attacker to escalate\ + \ privileges and potentially gain unauthorized access to the system. If the attack\ + \ is successful, the attacker can gain full control of the system, run arbitrary\ + \ code, or access sensitive data. Such attacks can lead to data breaches, unauthorized\ + \ access, and potential disruption of critical systems. False positives might occur\ + \ since the legitimate use of the sudoedit command with the \"-s\" flag can also\ + \ trigger this detection. You must carefully review and validate the findings before\ + \ taking any action. Next steps include investigating all true positive detections\ + \ promptly, reviewing the associated processes, gather relevant artifacts, identifying\ + \ the source of the attack to contain the threat, mitigate the risks, and prevent\ + \ further damage to the environment." data_source: [] search: '`osquery_process` | search "columns.cmdline"="sudoedit -s \\*" | `detect_baron_samedit_cve_2021_3156_via_osquery_filter`' how_to_implement: OSQuery installed and configured to pick up process events (info diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index ffcf2e0b12..d71eba5bfc 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -5,8 +5,19 @@ date: '2019-12-03' author: Patrick Bareiss, Splunk status: production type: TTP -description: This search looks for reading lsass memory consistent with credential - dumping. +description: As a prerequisite, ensure that sysmon events are being ingested and monitored. + This analytic detects the reading of lsass memory, which is consistent with credential + dumping. Reading lsass memory is a common technique used by attackers to steal credentials + from the Windows operating system. The detection is made by monitoring the sysmon + events and filtering for specific access permissions (0x1010 and 0x1410) on the + lsass.exe process helps identify potential instances of credential dumping.The detection + is important because it suggests that an attacker is attempting to extract credentials + from the lsass memory, which can lead to unauthorized access, data breaches, and + compromise of sensitive information. Credential dumping is often a precursor to + further attacks, such as lateral movement, privilege escalation, or data exfiltration. + False positives can occur due to legitimate actions that involve accessing lsass + memory. Therefore, extensive triage and investigation are necessary to differentiate + between malicious and benign activities. data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) @@ -33,8 +44,7 @@ tags: confidence: 100 impact: 80 message: The $source_image$ has attempted access to read $TargetImage$ was identified - on endpoint $dest$, this is indicative of credential dumping and should be - investigated. + on endpoint $dest$, this is indicative of credential dumping and should be investigated. mitre_attack_id: - T1003.001 - T1003 diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 809f182451..59350df034 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -5,8 +5,26 @@ date: '2020-07-08' author: David Dorsey, Splunk status: production type: TTP -description: This search looks for newly created accounts that have been elevated - to local administrators. +description: This analytic detects the creation of new accounts that have been elevated + to local administrators so that you can take immediate action to mitigate the risks + and prevent further unauthorized access or malicious activities. This detection + is made by using the Splunk query `wineventlog_security` EventCode=4720 OR (EventCode=4732 + Group_Name=Administrators) to search for relevant security events in the Windows + event log. When a new account is created or an existing account is added to the + Administrators group, this analytic identifies this behavior by looking for EventCode + 4720 (A user account was created) or EventCode 4732 (A member was added to a security-enabled + global group). This analytic specifically focuses on events where the Group_Name + is set to Administrators. This detection is important because it suggests that an + attacker has gained elevated privileges and can perform malicious actions with administrative + access. This can lead to significant impact, such as unauthorized access to sensitive + data, unauthorized modifications to systems or configurations, and potential disruption + of critical services. identifying this behavior is crucial for a Security Operations + Center (SOC). Next steps include reviewing the details of the security event, including + the user account that was created or added to the Administrators group. Also, examine + the time span between the first and last occurrence of the event to determine if + the behavior is ongoing. Additionally, consider any contextual information, such + as the destination where the account was created or added to understand the scope + and potential impact of the attack. data_source: - Windows Security 4732 - Windows Security 4720 diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 0489120adc..e0cb5e6796 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -5,35 +5,30 @@ date: '2023-04-14' author: Patrick Bareiss, Splunk status: production type: TTP -description: The following analytic detects the behavior of dumping credentials from - memory, a tactic commonly used by adversaries. Specifically, it targets the exploitation - of the Local Security Authority Subsystem Service (LSASS) in Windows, which manages - system-level authentication. Threat actors can use the comsvcs.dll to exploit this - process and obtain valuable credentials. The analytic identifies instances where - the rundll32 process is used in conjunction with the comsvcs.dll and MiniDump, indicating - potential LSASS dumping attempts. This tactic is often part of more extensive attack - campaigns and is associated with numerous threat groups. Identifying this behavior - is crucial for security operations center (SOC) analysts, as credential theft can - lead to broader system compromise, persistence, lateral movement, and escalated - privileges. It is important to note that no legitimate use of this technique has - been identified so far. The impact of the attack, if a true positive is found, can - be severe. Attackers can use the stolen credentials to access sensitive information - or systems, leading to data theft, ransomware attacks, or other damaging outcomes. - To implement this analytic, ensure that logs with process information are ingested - from your endpoints. However, be aware of potential false positives, as legitimate - uses of the LSASS process may cause benign activities to be flagged. Upon triage, - review the processes involved in the LSASS dumping attempt, capture and inspect - any relevant on-disk artifacts, and look for concurrent processes to identify the - attack source. By identifying and mitigating LSASS exploitation attempts early on, - SOC analysts can better protect their organization's assets and prevent potential - breaches. +description: 1. As a prerequisite, ensure that logs with process information are ingested + from your endpoints. This analytic detects the behavior of dumping credentials + from memory, a tactic commonly used by adversaries to exploit the Local Security + Authority Subsystem Service (LSASS) in Windows, which manages system-level authentication. + The detection is made by monitoring logs with process information from endpoints + and identifying instances where the rundll32 process is used in conjunction with + the comsvcs.dll and MiniDump. This indicates potential LSASS dumping attempts used + by threat actors to obtain valuable credentials. The detection is important because + credential theft can lead to broader system compromise, persistence, lateral movement, + and escalated privileges. No legitimate use of this technique has been identified + yet. This behavior is often part of more extensive attack campaigns and is associated + with numerous threat groups that use the stolen credentials to access sensitive + information or systems, leading to data theft, ransomware attacks, or other damaging + outcomes. False positives can occur since legitimate uses of the LSASS process can + cause benign activities to be flagged. Next steps include reviewing the processes + involved in the LSASS dumping attempt after triage and inspecting any relevant on-disk + artifacts and concurrent processes to identify the attack source. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*comsvcs.dll* - Processes.process=*MiniDump* by Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter`' + Processes.process=*MiniDump* by Processes.user Processes.parent_process_name Processes.process_name + Processes.original_file_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index c5baa35b8d..fb3d09c6b9 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -5,8 +5,24 @@ date: '2018-12-14' author: Rico Valdez, Splunk status: production type: TTP -description: The search looks for file writes with extensions consistent with a SamSam - ransomware attack. +description: This analytic detects file writes with extensions that are consistent + with a SamSam ransomware attack to proactively detect and respond to potential SamSam + ransomware attacks, minimizing the impact and reducing the likelihood of successful + ransomware infections. This detection is made by a Splunk query to search for specific + file extensions that are commonly associated with SamSam ransomware, such as .stubbin, + .berkshire, .satoshi, .sophos, and .keyxml. This identifies file extensions in the + file names of the written files. If any file write events with these extensions + are found, it suggests a potential SamSam ransomware attack. This detection is important + because SamSam ransomware is a highly destructive and financially motivated attack + and suggests that the organization is at risk of having its files encrypted and + held for ransom, which can lead to significant financial losses, operational disruptions, + and reputational damage. False positives might occur since legitimate files with + these extensions can exist in the environment. Therefore, next steps include conducting + a careful analysis and triage to confirm the presence of a SamSam ransomware attack. + Next steps include taking immediate action to contain the attack, mitigate the impact, + and prevent further spread of the ransomware. This might involve isolating affected + systems, restoring encrypted files from backups, and conducting a thorough investigation + to identify the attack source and prevent future incidents. data_source: - Sysmon Event ID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml index c5c0913a9c..4f95c107ee 100644 --- a/detections/endpoint/linux_decode_base64_to_shell.yml +++ b/detections/endpoint/linux_decode_base64_to_shell.yml @@ -5,8 +5,16 @@ date: '2022-07-27' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic identifies base64 being decoded and passed to - a Linux shell. +description: This analytic detects the behavior of decoding base64-encoded data and + passing it to a Linux shell. Additionally, it mitigates the potential damage and + protects the organization's systems and data.The detection is made by searching + for specific commands in the Splunk query, namely "base64 -d" and "base64 --decode", + within the Endpoint.Processes data model. The analytic also includes a filter for + Linux shells. The detection is important because it indicates the presence of malicious + activity since Base64 encoding is commonly used to obfuscate malicious commands + or payloads, and decoding it can be a step in running those commands. It suggests + that an attacker is attempting to run malicious commands on a Linux system to gain + unauthorized access, for data exfiltration, or perform other malicious actions. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 5d3877de36..6f3805de01 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -5,8 +5,26 @@ date: '2022-11-14' author: Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk status: production type: TTP -description: This search detects registry key license at host where Remcos RAT agent - is installed. +description: 'This analytic detects the presence of a registry key related to the + Remcos RAT agent on a host. This detection is made by a Splunk query to search for + instances where the registry key "license" is found in the "Software\Remcos" path. + This analytic combines information from two data models: Endpoint.Processes and + Endpoint.Registry and retrieves process information such as user, process ID, process + name, process path, destination, parent process name, parent process, and process + GUID. This analytic also retrieves registry information such as registry path, registry + key name, registry value name, registry value data, and process GUID. By joining + the process GUID from the Endpoint.Processes data model with the process GUID from + the Endpoint.Registry data model, the analytic identifies instances where the "license" + registry key is found in the "Software\Remcos" path. This detection is important + because it suggests that the host has been compromised by the Remcos RAT agent. + Remcos is a well-known remote access Trojan that can be used by attackers to gain + unauthorized access to systems and exfiltrate sensitive data. Identifying this behavior + allows the SOC to take immediate action to remove the RAT agent and prevent further + compromise. The impact of this attack can be severe, as the attacker can gain unauthorized + access to the system, steal sensitive information, or use the compromised system + as a launching point for further attacks. Next steps include using this analytic + in conjunction with other security measures and threat intelligence to ensure accurate + detection and response.' data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index b5c3cc0f85..142785d0fe 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -5,18 +5,16 @@ date: '2020-03-16' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP -description: The following analytic is designed to detect the potential misuse of - Windows Management Instrumentation (WMI) for malicious purposes. WMI can be utilized - by adversaries to execute scripts, a method often employed for maintaining stealth - while carrying out malicious activities. The process 'scrcons.exe', integral to - executing WMI scripts, is primarily monitored by this analytic. The underlying threat - lies in the fact that successful execution of a malicious script can lead to numerous - negative outcomes, including system compromise, data exfiltration, or the establishment - of persistence. It's essential for cybersecurity analysts to remain vigilant towards - unexpected or isolated script executions via WMI, as such instances often signal - suspicious activities or potential security breaches. Although uncommon, administrators - may occasionally use WMI to launch scripts for legitimate purposes. Therefore, discerning - malicious activities from benign ones is crucial in this context. +description: This analytic detects any potential misuse of Windows Management Instrumentation + (WMI) for malicious purposes since adversaries often use WMI to run scripts which + allows them to carry out malicious activities without raising suspicion. The detection + is made by monitoring the process 'scrcons.exe', which is essential to run WMI scripts. + The detection is important because it proactively identifies and responds to potential + threats that leverage WMI for malicious purposes that can lead to system compromise, + data exfiltration, or the establishment of persistence within the environment. False + positives might occur since administrators might occasionally use WMI to launch + scripts for legitimate purposes. Therefore, you must distinguish between malicious + and benign activities. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index ee4db4012f..902e251cdc 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -5,8 +5,24 @@ date: '2020-07-06' author: David Dorsey, Splunk status: production type: TTP -description: This search detects accounts that were created and deleted in a short - time period. +description: This analytic detects the creation and deletion of accounts in a short + time period to identify potential threats earlier and take appropriate actions to + mitigate the risks. Helps prevent or minimize the potential damage caused by unauthorized + access or malicious activities within the environment. This detection is made by + a Splunk query that searches for events with the result IDs 4720 and 4726 in the + "Change" data model. The query then groups the results by time, user, and destination. + The result is filtered to only include events with the specified result IDs. The + "transaction" command is used to group events that occur within a specified time + span and have the same user but are not connected. Finally, the relevant information + such as the first and last time of the event, the count, user, destination, and + result ID are displayed in a table. This detection is important because it suggests + that an attacker is attempting to create and delete accounts rapidly, potentially + to cover their tracks or gain unauthorized access. The impact of such an attack + can include unauthorized access to sensitive data, privilege escalation, or the + ability to carry out further malicious activities within the environment. Next steps + include investigating the events flagged by the analytic, review the account creation + and deletion activities, and analyze any associated logs or artifacts to determine + the intent and impact of the attack. data_source: [] search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 909a5671d6..1c4e93d06a 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -5,7 +5,15 @@ date: '2020-12-08' author: David Dorsey, Splunk status: production type: TTP -description: This search looks for process names that consist only of a single letter. +description: As a prerequisite, ensure that endpoint logs are being ingested and processed + by Splunk. This analytic detects a behavior where a process name consists only of + a single letter that helps to detect potential threats earlier and mitigate the + risks. This detection is important because it indicates the presence of malware + or an attacker attempting to evade detection by using a process name that is difficult + to identify or track so that he can carry out malicious activities such as data + theft or ransomware attacks. False positives might occur since there might be legitimate + uses of single-letter process names in your environment. Next steps include reviewing + the process details and investigating any suspicious activity upon triage. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index 9d30b28662..7f13730316 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -5,8 +5,19 @@ date: '2020-07-22' author: Rico Valdez, Splunk status: production type: TTP -description: This search detects writes to the recycle bin by a process other than - explorer.exe. +description: As a prerequisite, ensure that you are ingesting logs with the endpoint + file system and process information. This analytic detects when a process other + than explorer.exe writes to the Windows Recycle Bin to detect potential threats + earlier and mitigate the risks. This detection is made by a Splunk query that utilizes + the Endpoint.Filesystem data model and the Endpoint.Processes data model. The query + looks for any process writing to the "*$Recycle.Bin*" file path, excluding explorer.exe. + This detection is important because it suggests that an attacker is attempting to + hide their activities by using the Recycle Bin, which can lead to data theft, ransomware, + or other damaging outcomes. Detecting writes to the Recycle Bin by a process other + than explorer.exe can help to investigate and determine if the activity is malicious + or benign. False positives might occur since there might be legitimate uses of the + Recycle Bin by processes other than explorer.exe. Next steps include reviewing the + process writing to the Recycle Bin and any relevant on-disk artifacts upon triage. data_source: - Sysmon Event ID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml index 97e3f4b0b1..d9b82d26e4 100644 --- a/detections/endpoint/unusually_long_command_line.yml +++ b/detections/endpoint/unusually_long_command_line.yml @@ -5,8 +5,21 @@ date: '2020-12-08' author: David Dorsey, Splunk status: experimental type: Anomaly -description: Command lines that are extremely long may be indicative of malicious - activity on your hosts. +description: As a prerequisite, ensure that you ingest logs with process information + from your endpoints into Splunk. This analytic detects command lines that are extremely + long, which might be indicative of malicious activity on your hosts because attackers + often use obfuscated or complex command lines to hide their actions and evade detection. + This helps to mitigate the risks associated with long command lines to enhance your + overall security posture and reduce the impact of attacks. This detection is important + because it suggests that an attacker might be attempting to execute a malicious + command or payload on the host, which can lead to various damaging outcomes such + as data theft, ransomware, or further compromise of the system. False positives + might occur since legitimate processes or commands can sometimes result in long + command lines. Next steps include conducting extensive triage and investigation + to differentiate between legitimate and malicious activities. Review the source + of the command line and the command itself during the triage. Additionally, capture + and inspect any relevant on-disk artifacts and review concurrent processes to identify + the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index 78c5c9e165..983bf790fd 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -7,12 +7,31 @@ type: TTP status: production data_source: - Windows Security 4719 -description: This analytic looks for audit policies being disabled on a domain controller. -search: '`wineventlog_security` EventCode=4719 (AuditPolicyChanges IN ("%%8448","%%8450","%%8448, %%8450") OR Changes IN ("Failure removed","Success removed","Success removed, Failure - removed")) dest_category="domain_controller"| replace "%%8448" with "Success removed", "%%8450" with "Failure removed", "%%8448, %%8450" with "Success removed, Failure removed" in AuditPolicyChanges | eval AuditPolicyChanges=coalesce(AuditPolicyChanges,Changes), SubcategoryGuid=coalesce(SubcategoryGuid,Subcategory_GUID) | stats min(_time) as _time values(host) as dest by AuditPolicyChanges SubcategoryGuid | lookup advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory | `windows_ad_domain_controller_audit_policy_disabled_filter`' -how_to_implement: Ensure you are ingesting EventCode `4719` from your domain controllers, the category domain_controller exists - in assets and identities, and that assets and identities is enabled. If A&I is not configured, you will need to manually filter the results - within the base search. +description: "As a prerequisite, ensure that logs containing information about audit\ + \ policy changes are being ingested from the domain controller. This analytic detects\ + \ the disabling of audit policies on a domain controller. \nThe detection is made\ + \ by identifying changes made to audit policies and checks for the removal of success\ + \ or failure auditing, which are common indicators of policy tampering. The detection\ + \ is important because it indicates that an attacker has gained access to the domain\ + \ controller and is attempting to evade detection and cover up malicious activity.\ + \ The impact of such an attack can be severe, including data theft, privilege escalation,\ + \ and compromise of the entire network. \nFalse positives might occur since legitimate\ + \ changes to audit policies might also trigger the analytic. Upon triage, review\ + \ the audit policy change event and investigate the source of the change. Additionally,\ + \ you must capture and inspect any relevant on-disk artifacts and review concurrent\ + \ processes to identify the attack source." +search: '`wineventlog_security` EventCode=4719 (AuditPolicyChanges IN ("%%8448","%%8450","%%8448, + %%8450") OR Changes IN ("Failure removed","Success removed","Success removed, Failure + removed")) dest_category="domain_controller"| replace "%%8448" with "Success removed", + "%%8450" with "Failure removed", "%%8448, %%8450" with "Success removed, Failure + removed" in AuditPolicyChanges | eval AuditPolicyChanges=coalesce(AuditPolicyChanges,Changes), + SubcategoryGuid=coalesce(SubcategoryGuid,Subcategory_GUID) | stats min(_time) as + _time values(host) as dest by AuditPolicyChanges SubcategoryGuid | lookup advanced_audit_policy_guids + GUID as SubcategoryGuid OUTPUT Category SubCategory | `windows_ad_domain_controller_audit_policy_disabled_filter`' +how_to_implement: Ensure you are ingesting EventCode `4719` from your domain controllers, + the category domain_controller exists in assets and identities, and that assets + and identities is enabled. If A&I is not configured, you will need to manually filter + the results within the base search. known_false_positives: Unknown references: - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4719 @@ -41,7 +60,8 @@ tags: - SubcategoryGuid risk_score: 60 security_domain: endpoint - manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested + manual_test: This search uses a lookup provided by Enterprise Security and needs + to be manually tested tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 3b2f77c5f3..c67aa77126 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -5,19 +5,27 @@ date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP -description: This analytic is to look for suspicious modification or creation of registry - to have service entry. This technique is abused by adversaries or threat actor to - persist, gain privileges in the machine or even lateral movement. This technique - can be executed using reg.exe application or using windows API like for example - the CrashOveride malware. This detection is a good indicator that a process is trying - to create a service entry using registry ImagePath. +description: As a prerequisite, ensure that you are ingesting logs with process information + from your endpoints. This analytic detects when reg.exe modify registry keys that + define Windows services and their configurations in Windows to detect potential + threats earlier and mitigate the risks. This detection is made by a Splunk query + that searches for specific keywords in the process name, parent process name, user, + and process ID. This detection is important because it suggests that an attacker + has modified the registry keys that define Windows services and their configurations, + which can allow them to maintain access to the system and potentially move laterally + within the network. It is a common technique used by attackers to gain persistence + on a compromised system and its impact can lead to data theft, ransomware, or other + damaging outcomes. False positives can occur since legitimate uses of reg.exe to + modify registry keys for Windows services can also trigger this alert. Next steps + include reviewing the process and user context of the reg.exe activity and identify + any other concurrent processes that might be associated with the attack upon triage. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name - = ImagePath) BY _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) + = ImagePath) BY _time span=1h Registry.dest Registry.user Registry.registry_path + Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_using_registry_entry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -37,7 +45,8 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A Windows Service was created on a endpoint from $dest$ using a registry entry + message: A Windows Service was created on a endpoint from $dest$ using a registry + entry mitre_attack_id: - T1574.011 observable: diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 0a58c1323b..16a72d4238 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -5,7 +5,24 @@ date: '2018-10-23' author: Rico Valdez, Splunk status: experimental type: TTP -description: The following analytic seeks to detect the creation of Windows Management Instrumentation (WMI) permanent event subscriptions, a technique often used by adversaries for persistence. Such a subscription allows for the execution of specified scripts or binaries in response to defined system events, potentially enabling malicious activities to persist unnoticed. The analytic uses Sysmon Event ID 5 data, specifically focusing on instances where consumers of these events are not the expected "NTEventLogEventConsumer." Although WMI event subscriptions can be used legitimately by administrators, unusual or unexpected subscription creation should be treated as suspicious. Analysts need to be cognizant of the potential for false positives in legitimate administrative activities and should understand WMI activity within the context of the monitored environment. +description: As a prerequisite, ensure that you are collecting and analyzing Sysmon + Event ID 5 data from your endpoints. This analytic detects the creation of permanent + event subscriptions using Windows Management Instrumentation (WMI), which is used + by attackers to achieve persistence in a compromised system. By creating a permanent + event subscription, an attacker can run malicious scripts or binaries in response + to specific system events that enables them to maintain access to the system undetected. + The detection is made by using Sysmon Event ID 5 data to detect instances where + the consumers of these events are not the expected "NTEventLogEventConsumer." The + detection is important because it identifies unusual or unexpected subscription + creation, which suggests that an attacker is attempting to achieve persistence within + the environment and might be executing malicious scripts or binaries in response + to specific system events. The impact of such an attack can be severe, potentially + leading to data theft, ransomware, or other damaging outcomes. False positives might + occur since False positives might occur since WMI event subscriptions can be used + for legitimate purposes by system administrators. You must have a thorough understanding + of WMI activity within the context of the monitored environment to effectively differentiate + between legitimate and malicious activity.Next steps include investigating the associated + scripts or binaries and identifying the source of the attack. data_source: - Sysmon Event ID 5 search: '`wmi` EventCode=5861 Binding | rex field=Message "Consumer =\s+(?[^;|^$]+)" diff --git a/detections/endpoint/wmi_temporary_event_subscription.yml b/detections/endpoint/wmi_temporary_event_subscription.yml index 3f6cf1d4ee..a4a2686938 100644 --- a/detections/endpoint/wmi_temporary_event_subscription.yml +++ b/detections/endpoint/wmi_temporary_event_subscription.yml @@ -5,7 +5,29 @@ date: '2018-10-23' author: Rico Valdez, Splunk status: experimental type: TTP -description: This search looks for the creation of WMI temporary event subscriptions. +description: 'This analytic detects the creation of WMI temporary event subscriptions. + WMI (Windows Management Instrumentation) is a management technology that allows + administrators to perform various tasks on Windows-based systems. Temporary event + subscriptions are created to monitor specific events or changes on a system that + help to detect potential threats early and take proactive measures to protect the + organization''s systems and data. + + The detection is made by using the Splunk query `wmi` EventCode=5860 Temporary to + search for events with EventCode 5860, which indicates the creation of a temporary + WMI event subscription. To further refine the search results, the query uses regular + expressions (rex) to extract the query used in the event subscription. Then, it + filters known benign queries related to system processes such as ''wsmprovhost.exe'' + and ''AntiVirusProduct'', ''FirewallProduct'', ''AntiSpywareProduct'', which helps + to focus on potentially malicious or suspicious queries. The detection is important + because it indicates malicious activity since attackers use WMI to run commands, + gather information, or maintain persistence within a compromised system. False positives + might occur since legitimate uses of WMI event subscriptions in the environment + might trigger benign activities to be flagged. Therefore, an extensive triage is + necessary to review the specific query and assess its intent. Additionally, capturing + and inspecting relevant on-disk artifacts and analyzing concurrent processes can + help to identify the source of the attack. Detecting the creation of these event + subscriptions to identify potential threats early and take appropriate actions to + mitigate the risks.' data_source: - Sysmon Event ID 5 search: '`wmi` EventCode=5860 Temporary | rex field=Message "NotificationQuery =\s+(?[^;|^$]+)" diff --git a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml index 196d75eaf9..036b897c1c 100644 --- a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml +++ b/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml @@ -5,7 +5,21 @@ date: '2020-07-28' author: Shannon Davis, Splunk status: experimental type: TTP -description: The following analytic is an experimental search designed to identify SIGRed exploitation attempts. SIGRed is a severe, wormable, remote code execution vulnerability in Windows DNS servers, identified as CVE-2020-1350. This analytic specifically looks for DNS SIG and KEY records, and TCP payloads larger than 65KB - potential indicators of the SIGRed exploit. It requires ingestion of both Splunk Stream DNS and TCP data. The search does rely on macro definitions for 'stream:dns' and 'stream:tcp', which should be replaced with appropriate configurations tailored to your Splunk environment. +description: "Ensure that the following prerequisites are met: (i) Both Splunk Stream\ + \ DNS and TCP data are ingested. (ii) The macros 'stream:dns' and 'stream:tcp' are\ + \ replaced with the appropriate configurations that are specific to your Splunk\ + \ environment.This analytic detects SIGRed exploitation attempts. SIGRed is a critical\ + \ wormable vulnerability found in Windows DNS servers, known as CVE-2020-1350, which\ + \ allows remote code execution.The detection is made by using an experimental search\ + \ that focuses on identifying specific indicators that might suggest the presence\ + \ of the SIGRed exploit such as DNS SIG records, KEY records, and TCP payloads greater\ + \ than 65KB. This detection is important because it \ndetects and responds to potential\ + \ SIGRed exploitation attempts and minimizes the risk of a successful attack and\ + \ its impact on the organization's infrastructure and data. False positives might\ + \ occur due to the experimental nature of this analytic. Next steps include reviewing\ + \ and investigating each case thoroughly given the potential for unauthorized Windows\ + \ DNS server access, data breaches, and service disruptions. Additionally, you must\ + \ stay updated with Microsoft's guidance on the SIGRed vulnerability." data_source: [] search: '`stream_dns` | spath "query_type{}" | search "query_type{}" IN (SIG,KEY) | spath protocol_stack | search protocol_stack="ip:tcp:dns" | append [search `stream_tcp` diff --git a/detections/network/detect_windows_dns_sigred_via_zeek.yml b/detections/network/detect_windows_dns_sigred_via_zeek.yml index 9162f4d910..7131a73254 100644 --- a/detections/network/detect_windows_dns_sigred_via_zeek.yml +++ b/detections/network/detect_windows_dns_sigred_via_zeek.yml @@ -5,7 +5,20 @@ date: '2020-07-28' author: Shannon Davis, Splunk status: experimental type: TTP -description: This search detects SIGRed via Zeek DNS and Zeek Conn data. +description: This analytic detects the presence of SIGRed, a critical DNS vulnerability, + using Zeek DNS and Zeek Conn data. SIGRed vulnerability allows attackers to run + remote code on Windows DNS servers. By detecting SIGRed early, you can prevent further + damage and protect the organization's network infrastructure. The detection is made + by identifying specific DNS query types (SIG and KEY) in the Zeek DNS data and checks + for high data transfer in the Zeek Conn data. If multiple instances of these indicators + are found within a flow, it suggests the presence of SIGRed. The detection is important + because it indicates a potential compromise of Windows DNS servers that suggests + that an attacker might have gained unauthorized access to the DNS server and can + run arbitrary code. The impact of this attack can be severe, leading to data exfiltration, + unauthorized access, or disruption of critical services. Next steps include investigating + the affected flow and taking immediate action to mitigate the vulnerability. This + can involve patching the affected DNS server, isolating the server from the network, + or conducting a forensic analysis to determine the extent of the compromise. data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where DNS.query_type IN (SIG,KEY) by DNS.flow_id | rename DNS.flow_id as flow_id diff --git a/detections/network/detect_zerologon_via_zeek.yml b/detections/network/detect_zerologon_via_zeek.yml index 3300d93b58..4d7b46231b 100644 --- a/detections/network/detect_zerologon_via_zeek.yml +++ b/detections/network/detect_zerologon_via_zeek.yml @@ -5,8 +5,23 @@ date: '2020-09-15' author: Shannon Davis, Splunk status: experimental type: TTP -description: This search detects attempts to run exploits for the Zerologon CVE-2020-1472 - vulnerability via Zeek RPC +description: As a prerequisite, ensure that you are ingesting Zeek logs that contain + RPC activity. This analytic detects attempts to exploit the Zerologon CVE-2020-1472 + vulnerability through Zeek RPC. By detecting attempts to exploit the Zerologon vulnerability + through Zeek RPC, SOC analysts can identify potential threats earlier and take appropriate + action to mitigate the risks. This detection is made by a Splunk query that looks + for specific Zeek RPC operations, including NetrServerPasswordSet2, NetrServerReqChallenge, + and NetrServerAuthenticate3, which are aggregated by source and destination IP address + and time. This detection is important because it suggests that an attacker is attempting + to exploit the Zerologon vulnerability to gain unauthorized access to the domain + controller. Zerologon vulnerability is a critical vulnerability that allows attackers + to take over domain controllers without authentication, leading to a complete takeover + of an organization's IT infrastructure. The impact of such an attack can be severe, + potentially leading to data theft, ransomware, or other devastating outcomes. False + positives might occur since legitimate Zeek RPC activity can trigger the analytic. + Next steps include reviewing the identified source and destination IP addresses + and the specific RPC operations used. Capture and inspect any relevant on-disk artifacts, + and review concurrent processes to identify the attack source upon triage . data_source: [] search: '`zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) | bin span=5m _time | stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) diff --git a/detections/network/smb_traffic_spike.yml b/detections/network/smb_traffic_spike.yml index acde3c9c3e..38fa91dcd7 100644 --- a/detections/network/smb_traffic_spike.yml +++ b/detections/network/smb_traffic_spike.yml @@ -5,8 +5,21 @@ date: '2020-07-22' author: David Dorsey, Splunk status: experimental type: Anomaly -description: This search looks for spikes in the number of Server Message Block (SMB) - traffic connections. +description: This analytic detects spikes in the number of Server Message Block (SMB) + traffic connections. SMB is a network protocol used for sharing files, printers, + and other resources between computers. This detection is made by a Splunk query + that looks for SMB traffic connections on ports 139 and 445, as well as connections + using the SMB application. The query calculates the average and standard deviation + of the number of SMB connections over the past 70 minutes, and identifies any sources + that exceed two standard deviations from the average. This helps to filter out false + positives caused by normal fluctuations in SMB traffic. This detection is important + because it identifies potential SMB-based attacks, such as ransomware or data theft, + which often involve a large number of SMB connections. This suggests that an attacker + is attempting to exfiltrate data or spread malware within the network. Next steps + include investigating the source of the traffic and determining if it is malicious. + This can involve reviewing network logs, capturing and analyzing any relevant network + packets, and correlating with other security events to identify the attack source + and mitigate the risk. data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb diff --git a/detections/web/sql_injection_with_long_urls.yml b/detections/web/sql_injection_with_long_urls.yml index e7bcdaddb1..63d2da3334 100644 --- a/detections/web/sql_injection_with_long_urls.yml +++ b/detections/web/sql_injection_with_long_urls.yml @@ -5,8 +5,27 @@ date: '2022-03-28' author: Bhavin Patel, Splunk status: experimental type: TTP -description: This search looks for long URLs that have several SQL commands visible - within them. +description: 'This analytic detects long URLs that contain multiple SQL commands. + A proactive approach helps to detect and respond to potential threats earlier, mitigating + the risks associated with SQL injection attacks. This detection is made by a Splunk + query that searches for web traffic data where the destination category is a web + server and the URL length is greater than 1024 characters or the HTTP user agent + length is greater than 200 characters. This detection is important because it suggests + that an attacker is attempting to exploit a web application through SQL injection. + SQL injection is a common technique used by attackers to exploit vulnerabilities + in web applications and gain unauthorized access to databases. Attackers can insert + malicious SQL commands into a URL to manipulate the application''s database and + retrieve sensitive information or modify data. The impact of a successful SQL injection + attack can be severe, potentially leading to data breaches, unauthorized access, + and even complete compromise of the affected system. False positives might occur + since the legitimate use of web applications or specific URLs in your environment + can trigger the detection. Therefore, you must review and validate any alerts generated + by this analytic before taking any action. + + Next steps include reviewing the source and destination of the web traffic, as well + as the specific URL and HTTP user agent. Additionally, capture and analyze any relevant + on-disk artifacts and review concurrent processes to determine the source of the + attack.' data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Web where Web.dest_category=web_server AND (Web.url_length > 1024 OR Web.http_user_agent_length diff --git a/detections/web/supernova_webshell.yml b/detections/web/supernova_webshell.yml index cf7af755e1..0e877752d2 100644 --- a/detections/web/supernova_webshell.yml +++ b/detections/web/supernova_webshell.yml @@ -5,8 +5,20 @@ date: '2021-01-06' author: John Stoner, Splunk status: experimental type: TTP -description: This search aims to detect the Supernova webshell used in the SUNBURST - attack. +description: This analytic detects the presence of the Supernova webshell, which was + used in the SUNBURST attack. This webshell can be used by attackers to gain unauthorized + access to a compromised system and run arbitrary code. This detection is made by + a Splunk query that searches for specific patterns in web URLs, including "*logoimagehandler.ashx*codes*", + "*logoimagehandler.ashx*clazz*", "*logoimagehandler.ashx*method*", and "*logoimagehandler.ashx*args*". + These patterns are commonly used by the Supernova webshell to communicate with its + command and control server. This detection is important because it indicates a potential + compromise and unauthorized access to the system to run arbitrary code, which can + lead to data theft, ransomware, or other damaging outcomes. False positives might + occur since the patterns used by the webshell can also be present in legitimate + web traffic. In such cases, tune the search to the specific environment and monitor + it closely for any suspicious activity. Next steps include reviewing the web URLs + and inspecting any relevant on-disk artifacts. Additionally, review concurrent processes + and network connections to identify the source of the attack. data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Web.Web where web.url=*logoimagehandler.ashx*codes* OR Web.url=*logoimagehandler.ashx*clazz* OR From 64096b6e44eaf4e1c1abf2d324c276a663147423 Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Fri, 29 Sep 2023 12:11:01 -0700 Subject: [PATCH 02/37] Edit parsing --- ...suspicious_email_attachment_extensions.yml | 18 ++----------- ...servers_executing_suspicious_processes.yml | 18 ++----------- ...azon_eks_kubernetes_pod_scan_detection.yml | 21 ++------------- .../cloud/circle_ci_disable_security_job.yml | 15 ++--------- .../cloud/circle_ci_disable_security_step.yml | 20 ++------------ ...alls_from_previously_unseen_user_roles.yml | 21 ++------------- ...e_created_with_previously_unseen_image.yml | 16 ++--------- ...d_with_previously_unseen_instance_type.yml | 18 ++----------- .../correlation_by_repository_and_risk.yml | 17 ++---------- .../cloud/correlation_by_user_and_risk.yml | 14 ++-------- detections/cloud/github_dependabot_alert.yml | 21 +++------------ .../cloud/o365_new_federated_domain_added.yml | 20 ++------------ .../o365_suspicious_user_email_forwarding.yml | 27 ++----------------- .../access_lsass_memory_for_dump_creation.yml | 12 ++------- .../endpoint/attacker_tools_on_endpoint.yml | 17 ++---------- ..._to_add_certificate_to_untrusted_store.yml | 14 ++-------- .../attempt_to_stop_security_service.yml | 19 ++----------- ...ate_local_admin_accounts_using_net_exe.yml | 19 ++----------- ...or_delete_windows_shares_using_net_exe.yml | 22 ++------------- .../create_remote_thread_into_lsass.yml | 17 +++--------- ...f_shadow_copy_with_wmic_and_powershell.yml | 15 ++--------- ...ial_dumping_via_symlink_to_shadow_copy.yml | 18 ++----------- .../detect_baron_samedit_cve_2021_3156.yml | 17 ++---------- ...t_baron_samedit_cve_2021_3156_segfault.yml | 10 ++----- ...redential_dumping_through_lsass_access.yml | 15 ++--------- .../detect_new_local_admin_account.yml | 22 ++------------- .../endpoint/dump_lsass_via_comsvcs_dll.yml | 19 ++----------- .../endpoint/file_with_samsam_extension.yml | 20 ++------------ .../endpoint/linux_decode_base64_to_shell.yml | 12 ++------- .../remcos_client_registry_install_entry.yml | 22 ++------------- .../endpoint/script_execution_via_wmi.yml | 12 ++------- .../endpoint/short_lived_windows_accounts.yml | 20 ++------------ .../single_letter_process_on_endpoint.yml | 11 ++------ ...spicious_writes_to_windows_recycle_bin.yml | 15 ++--------- .../endpoint/unusually_long_command_line.yml | 17 ++---------- ..._service_creation_using_registry_entry.yml | 16 ++--------- .../wmi_permanent_event_subscription.yml | 20 ++------------ .../wmi_temporary_event_subscription.yml | 26 +++--------------- .../detect_windows_dns_sigred_via_zeek.yml | 16 ++--------- .../network/detect_zerologon_via_zeek.yml | 19 ++----------- detections/network/smb_traffic_spike.yml | 17 ++---------- .../web/sql_injection_with_long_urls.yml | 24 +++-------------- detections/web/supernova_webshell.yml | 16 ++--------- 43 files changed, 90 insertions(+), 675 deletions(-) diff --git a/detections/application/suspicious_email_attachment_extensions.yml b/detections/application/suspicious_email_attachment_extensions.yml index de999530d4..bc9ad58e99 100644 --- a/detections/application/suspicious_email_attachment_extensions.yml +++ b/detections/application/suspicious_email_attachment_extensions.yml @@ -5,22 +5,8 @@ date: '2023-04-14' author: David Dorsey, Splunk status: experimental type: Anomaly -description: This analytic detects emails that contain attachments with suspicious - file extensions. Detecting and responding to emails with suspicious attachments - can mitigate the risks associated with phishing and malware attacks, thereby protecting - the organization's data and systems from potential harm. The detection is made by - using a Splunk query that searches for emails in the datamodel=Email where the filename - of the attachment is not empty. The analytic uses the tstats command to summarize - the count, first time, and last time of the emails that meet the criteria. It groups - the results by the source user, file name, and message ID of the email. The detection - is important because it indicates potential phishing or malware delivery attempts - in which an attacker attempts to deliver malicious content through email attachments, - which can lead to data breaches, malware infections, or unauthorized access to sensitive - information. Next steps include reviewing the identified emails and attachments - and analyzing the source user, file name, and message ID to determine if they are - legitimate or malicious. Additionally, you must inspect any relevant on-disk artifacts - associated with the attachments and investigate any concurrent processes to identify - the source of the attack. +description: |- + This analytic detects emails that contain attachments with suspicious file extensions. Detecting and responding to emails with suspicious attachments can mitigate the risks associated with phishing and malware attacks, thereby protecting the organization's data and systems from potential harm. The detection is made by using a Splunk query that searches for emails in the datamodel=Email where the filename of the attachment is not empty. The analytic uses the tstats command to summarize the count, first time, and last time of the emails that meet the criteria. It groups the results by the source user, file name, and message ID of the email. The detection is important because it indicates potential phishing or malware delivery attempts in which an attacker attempts to deliver malicious content through email attachments, which can lead to data breaches, malware infections, or unauthorized access to sensitive information. Next steps include reviewing the identified emails and attachments and analyzing the source user, file name, and message ID to determine if they are legitimate or malicious. Additionally, you must inspect any relevant on-disk artifacts associated with the attachments and investigate any concurrent processes to identify the source of the attack. data_source: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Email where All_Email.file_name="*" by All_Email.src_user, diff --git a/detections/application/web_servers_executing_suspicious_processes.yml b/detections/application/web_servers_executing_suspicious_processes.yml index b45ac4894e..c72751bf48 100644 --- a/detections/application/web_servers_executing_suspicious_processes.yml +++ b/detections/application/web_servers_executing_suspicious_processes.yml @@ -5,22 +5,8 @@ date: '2019-04-01' author: David Dorsey, Splunk status: experimental type: TTP -description: This analytic detects suspicious processes on systems labeled as web - servers. This detection is made by a Splunk query that searches for specific process - names that might indicate malicious activity. These suspicious processes include - "whoami", "ping", "iptables", "wget", "service", and "curl". Uses the Splunk data - model "Endpoint.Processes" and filters the results to only include systems categorized - as web servers. This detection is important because it indicates unauthorized or - malicious activity on web servers since these processes are commonly used by attackers - to perform reconnaissance, establish persistence, or exfiltrate data from compromised - systems. The impact of such an attack can be significant, ranging from data theft - to the deployment of additional malicious payloads, potentially leading to ransomware - or other damaging outcomes. False positives might occur since the legitimate use - of these processes on web servers can trigger the analytic. Next steps include triaging - and investigating to determine the legitimacy of the activity. Also, review the - source and command of the suspicious process. You must also examine any relevant - on-disk artifacts and look for concurrent processes to identify the source of the - attack. +description: |- + This analytic detects suspicious processes on systems labeled as web servers. This detection is made by a Splunk query that searches for specific process names that might indicate malicious activity. These suspicious processes include "whoami", "ping", "iptables", "wget", "service", and "curl". Uses the Splunk data model "Endpoint.Processes" and filters the results to only include systems categorized as web servers. This detection is important because it indicates unauthorized or malicious activity on web servers since these processes are commonly used by attackers to perform reconnaissance, establish persistence, or exfiltrate data from compromised systems. The impact of such an attack can be significant, ranging from data theft to the deployment of additional malicious payloads, potentially leading to ransomware or other damaging outcomes. False positives might occur since the legitimate use of these processes on web servers can trigger the analytic. Next steps include triaging and investigating to determine the legitimacy of the activity. Also, review the source and command of the suspicious process. You must also examine any relevant on-disk artifacts and look for concurrent processes to identify the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml index 7a4ca51829..9826922319 100644 --- a/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml +++ b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml @@ -5,25 +5,8 @@ date: '2020-04-15' author: Rod Soto, Splunk status: experimental type: Hunting -description: As a prerequisite, ensure that you are ingesting logs from your Kubernetes - environment, specifically the AWS CloudWatch logs for EKS. This analytic detects - unauthenticated requests made against the Kubernetes' Pods API through proactive - monitoring to protect the Kubernetes environment from unauthorized access and potential - security breaches. The detection is made by using the Splunk query `aws_cloudwatchlogs_eks` - with specific filters to identify these requests. Identifies events where the `user.username` - is set to "system:anonymous", the `verb` is set to "list", and the `objectRef.resource` - is set to "pods". Additionally, the search checks if the `requestURI` is equal to - "/api/v1/pods". Analyzing these events helps you to identify any unauthorized access - attempts to the Kubernetes' Pods API. Unauthenticated requests can indicate potential - security breaches or unauthorized access to sensitive resources within the Kubernetes - environment. The detection is important because unauthorized access to Kubernetes' - Pods API can lead to the compromise of sensitive data, unauthorized execution of - commands, or even the potential for lateral movement within the Kubernetes cluster. - False positives might occur since there might be legitimate use cases for unauthenticated - requests in certain scenarios. Therefore, you must review and validate any detected - events before taking any action. Next steps include investigating the incident - to mitigate any ongoing threats, and strengthening the security measures to prevent - future unauthorized access attempts. +description: |- + As a prerequisite, ensure that you are ingesting logs from your Kubernetes environment, specifically the AWS CloudWatch logs for EKS. This analytic detects unauthenticated requests made against the Kubernetes' Pods API through proactive monitoring to protect the Kubernetes environment from unauthorized access and potential security breaches. The detection is made by using the Splunk query `aws_cloudwatchlogs_eks` with specific filters to identify these requests. Identifies events where the `user.username` is set to "system:anonymous", the `verb` is set to "list", and the `objectRef.resource` is set to "pods". Additionally, the search checks if the `requestURI` is equal to "/api/v1/pods". Analyzing these events helps you to identify any unauthorized access attempts to the Kubernetes' Pods API. Unauthenticated requests can indicate potential security breaches or unauthorized access to sensitive resources within the Kubernetes environment. The detection is important because unauthorized access to Kubernetes' Pods API can lead to the compromise of sensitive data, unauthorized execution of commands, or even the potential for lateral movement within the Kubernetes cluster. False positives might occur since there might be legitimate use cases for unauthenticated requests in certain scenarios. Therefore, you must review and validate any detected events before taking any action. Next steps include investigating the incident to mitigate any ongoing threats, and strengthening the security measures to prevent future unauthorized access attempts. data_source: [] search: '`aws_cloudwatchlogs_eks` "user.username"="system:anonymous" verb=list objectRef.resource=pods requestURI="/api/v1/pods" | rename source as cluster_name sourceIPs{} as src_ip diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/cloud/circle_ci_disable_security_job.yml index 0135a2bca9..f15a0d09dc 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/cloud/circle_ci_disable_security_job.yml @@ -5,19 +5,8 @@ date: '2021-09-02' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: This analytic searches for a specific behavior in CircleCI pipelines - such as the disabling of security jobs. The detection is made by using a Splunk - query that renames certain fields and retrieves values for specified job names, - workflow IDs and names, user information, commit messages, URLs, and branches. Then, - the query identifies mandatory jobs for each workflow and searches for instances - where they were run. The search also identifies the phase of the pipeline as "build" - and extracts the repository name from the URL using regular expressions. The detection - is important because it detects attempts to bypass security measures in CircleCI - pipelines, which can potentially lead to malicious code being introduced into the - pipeline, data breaches, system downtime, and reputational damage. False positives - might occur since legitimate use cases can require the disabling of security jobs. - However, you can proactively monitor and identify any suspicious activity in the - pipeline using this analytic and mitigate potential threats through early detection. +description: |- + This analytic searches for a specific behavior in CircleCI pipelines such as the disabling of security jobs. The detection is made by using a Splunk query that renames certain fields and retrieves values for specified job names, workflow IDs and names, user information, commit messages, URLs, and branches. Then, the query identifies mandatory jobs for each workflow and searches for instances where they were run. The search also identifies the phase of the pipeline as "build" and extracts the repository name from the URL using regular expressions. The detection is important because it detects attempts to bypass security measures in CircleCI pipelines, which can potentially lead to malicious code being introduced into the pipeline, data breaches, system downtime, and reputational damage. False positives might occur since legitimate use cases can require the disabling of security jobs. However, you can proactively monitor and identify any suspicious activity in the pipeline using this analytic and mitigate potential threats through early detection. data_source: [] search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_message vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/cloud/circle_ci_disable_security_step.yml index 90c331acc1..f4643e3681 100644 --- a/detections/cloud/circle_ci_disable_security_step.yml +++ b/detections/cloud/circle_ci_disable_security_step.yml @@ -5,24 +5,8 @@ date: '2021-09-01' author: Patrick Bareiss, Splunk status: experimental type: Anomaly -description: This analytic detects the disablement of security steps in a CircleCI - pipeline. Addressing instances of security step disablement in CircleCI pipelines - can mitigate the risks associated with potential security vulnerabilities and unauthorized - changes. A proactive approach helps protect the organization's infrastructure, data, - and overall security posture. The detection is made by a Splunk query that searches - for specific criteria within CircleCI logs through a combination of field renaming, - joining, and statistical analysis to identify instances where security steps are - disabled. It retrieves information such as job IDs, job names, commit details, and - user information from the CircleCI logs. The detection is important because it - indicates potential security vulnerabilities or unauthorized changes to the pipeline - caused by someone within the organization intentionally or unintentionally disabling - security steps in the CircleCI pipeline.Disabling security steps can leave the pipeline - and the associated infrastructure exposed to potential attacks, data breaches, or - the introduction of malicious code into the pipeline. Investigate by reviewing the - job name, commit details, and user information associated with the disablement of - security steps. You must also examine any relevant on-disk artifacts and identify - concurrent processes that might indicate the source of the attack or unauthorized - change. +description: |- + This analytic detects the disablement of security steps in a CircleCI pipeline. Addressing instances of security step disablement in CircleCI pipelines can mitigate the risks associated with potential security vulnerabilities and unauthorized changes. A proactive approach helps protect the organization's infrastructure, data, and overall security posture. The detection is made by a Splunk query that searches for specific criteria within CircleCI logs through a combination of field renaming, joining, and statistical analysis to identify instances where security steps are disabled. It retrieves information such as job IDs, job names, commit details, and user information from the CircleCI logs. The detection is important because it indicates potential security vulnerabilities or unauthorized changes to the pipeline caused by someone within the organization intentionally or unintentionally disabling security steps in the CircleCI pipeline.Disabling security steps can leave the pipeline and the associated infrastructure exposed to potential attacks, data breaches, or the introduction of malicious code into the pipeline. Investigate by reviewing the job name, commit details, and user information associated with the disablement of security steps. You must also examine any relevant on-disk artifacts and identify concurrent processes that might indicate the source of the attack or unauthorized change. data_source: [] search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search `circleci` | stats values(name) as step_names count by job_id job_name ] | stats count by step_names diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index a4219fdca8..5f53f0b674 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -5,25 +5,8 @@ date: '2020-09-04' author: David Dorsey, Splunk status: experimental type: Anomaly -description: This analytic detects when a new command is run by a user, who typically - does not run those commands. The detection is made by a Splunk query to search for - these commands in the Change data model. Identifies commands run by users with the - user_type of AssumedRole and a status of success. The query retrieves the earliest - and latest timestamps of each command run and groups the results by the user and - command. Then, it drops the unnecessary data model object name and creates a lookup - to verify if the command was seen before. The lookup table contains information - about previously seen cloud API calls for each user role, including the first time - the command was seen and whether enough data is available for analysis. If the firstTimeSeenUserApiCall - field is null or greater than the relative time of 24 hours ago, it indicates that - the command is new and was not seen before. The final result table includes the - firstTime, user, object, and command fields of the new commands. It also applies - the security_content_ctime function to format the timestamps and applies a filter - to remove any cloud API calls from previously unseen user roles. The detection is - important because it helps to identify new commands run by different user roles. - New commands can indicate potential malicious activity or unauthorized actions within - the environment. Detecting and investigating these new commands can help identify - and mitigate potential security threats earlier, preventing data breaches, unauthorized - access, or other damaging outcomes. +description: |- + This analytic detects when a new command is run by a user, who typically does not run those commands. The detection is made by a Splunk query to search for these commands in the Change data model. Identifies commands run by users with the user_type of AssumedRole and a status of success. The query retrieves the earliest and latest timestamps of each command run and groups the results by the user and command. Then, it drops the unnecessary data model object name and creates a lookup to verify if the command was seen before. The lookup table contains information about previously seen cloud API calls for each user role, including the first time the command was seen and whether enough data is available for analysis. If the firstTimeSeenUserApiCall field is null or greater than the relative time of 24 hours ago, it indicates that the command is new and was not seen before. The final result table includes the firstTime, user, object, and command fields of the new commands. It also applies the security_content_ctime function to format the timestamps and applies a filter to remove any cloud API calls from previously unseen user roles. The detection is important because it helps to identify new commands run by different user roles. New commands can indicate potential malicious activity or unauthorized actions within the environment. Detecting and investigating these new commands can help identify and mitigate potential security threats earlier, preventing data breaches, unauthorized access, or other damaging outcomes. data_source: [] search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 488e6a5ca1..068ef2ecd2 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -5,20 +5,8 @@ date: '2018-10-12' author: David Dorsey, Splunk status: experimental type: Anomaly -description: As a prerequisite, ensure that you are ingesting relevant logs that capture - information about instance creation and image IDs in your cloud computing environment. - This analytic detects potential instances that are created in a cloud computing - environment using new or unknown image IDs that have not been seen before. This - detection is important because it helps to investigate and take appropriate action - to prevent further damage or unauthorized access to the Cloud environment, which - can include data breaches, unauthorized access to sensitive information, or the - deployment of malicious payloads within the cloud environment. False positives might - occur since legitimate instances can also have previously unseen image IDs. Next - steps include conducting an extensive triage and investigation to determine the - nature of the activity. During triage, review the details of the created instances, - including the user responsible for the creation, the image ID used, and any associated - metadata. Additionally, consider inspecting any relevant on-disk artifacts and analyzing - concurrent processes to identify the source of the attack. +description: |- + As a prerequisite, ensure that you are ingesting relevant logs that capture information about instance creation and image IDs in your cloud computing environment. This analytic detects potential instances that are created in a cloud computing environment using new or unknown image IDs that have not been seen before. This detection is important because it helps to investigate and take appropriate action to prevent further damage or unauthorized access to the Cloud environment, which can include data breaches, unauthorized access to sensitive information, or the deployment of malicious payloads within the cloud environment. False positives might occur since legitimate instances can also have previously unseen image IDs. Next steps include conducting an extensive triage and investigation to determine the nature of the activity. During triage, review the details of the created instances, including the user responsible for the creation, the image ID used, and any associated metadata. Additionally, consider inspecting any relevant on-disk artifacts and analyzing concurrent processes to identify the source of the attack. data_source: [] search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id, diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index b7b79b97df..cc6c4b71b4 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -5,22 +5,8 @@ date: '2020-09-12' author: David Dorsey, Splunk status: experimental type: Anomaly -description: As a prerequisite, ensure that you ingest logs that contain EC2 instance - creation information into your Splunk environment. This analytic detects the creation - of EC2 instances with previously unseen instance types. The detection is made by - using a Splunk query to identify the EC2 instances. First, the query searches for - changes in the EC2 instance creation action and filters for instances with instance - types that are not recognized or previously seen. Next, the query uses the Splunk - tstats command to gather the necessary information from the Change data model. Then, - it filters the instances with unknown instance types and reviews previously seen - instance types to determine if they are new or not. The detection is important because - it identifies attackers attempting to create instances with unknown or potentially - compromised instance types, which can be an attempt to gain unauthorized access - to sensitive data, compromise of systems, exfiltrate data, potential disruption - of services, or launch other malicious activities within the environment. False - positives might occur since there might be legitimate reasons for creating instances - with previously unseen instance types. Therefore, you must carefully review and - triage all alerts. +description: |- + As a prerequisite, ensure that you ingest logs that contain EC2 instance creation information into your Splunk environment. This analytic detects the creation of EC2 instances with previously unseen instance types. The detection is made by using a Splunk query to identify the EC2 instances. First, the query searches for changes in the EC2 instance creation action and filters for instances with instance types that are not recognized or previously seen. Next, the query uses the Splunk tstats command to gather the necessary information from the Change data model. Then, it filters the instances with unknown instance types and reviews previously seen instance types to determine if they are new or not. The detection is important because it identifies attackers attempting to create instances with unknown or potentially compromised instance types, which can be an attempt to gain unauthorized access to sensitive data, compromise of systems, exfiltrate data, potential disruption of services, or launch other malicious activities within the environment. False positives might occur since there might be legitimate reasons for creating instances with previously unseen instance types. Therefore, you must carefully review and triage all alerts. data_source: [] search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, diff --git a/detections/cloud/correlation_by_repository_and_risk.yml b/detections/cloud/correlation_by_repository_and_risk.yml index a1fe534504..1558e53297 100644 --- a/detections/cloud/correlation_by_repository_and_risk.yml +++ b/detections/cloud/correlation_by_repository_and_risk.yml @@ -5,21 +5,8 @@ date: '2021-09-06' author: Patrick Bareiss, Splunk status: production type: Correlation -description: This analytic detects by correlating repository and risk score to identify - patterns and trends in the data based on the level of risk associated. The analytic - adds any null values and calculates the sum of the risk scores for each detection. - Then, the analytic captures the source and user information for each detection and - sorts the results in ascending order based on the risk score. Finally, the analytic - filters the detections with a risk score below 80 and focuses only on high-risk - detections.This detection is important because it provides valuable insights into - the distribution of high-risk activities across different repositories. It also - identifies the most vulnerable repositories that are frequently targeted by potential - threats. Additionally, it proactively detects and responds to potential threats, - thereby minimizing the impact of attacks and safeguarding critical assets. Finally, - it provides a comprehensive view of the risk landscape and helps to make informed - decisions to protect the organization's data and infrastructure. False positives - might occur so it is important to identify the impact of the attack and prioritize - response and mitigation efforts. +description: |- + This analytic detects by correlating repository and risk score to identify patterns and trends in the data based on the level of risk associated. The analytic adds any null values and calculates the sum of the risk scores for each detection. Then, the analytic captures the source and user information for each detection and sorts the results in ascending order based on the risk score. Finally, the analytic filters the detections with a risk score below 80 and focuses only on high-risk detections.This detection is important because it provides valuable insights into the distribution of high-risk activities across different repositories. It also identifies the most vulnerable repositories that are frequently targeted by potential threats. Additionally, it proactively detects and responds to potential threats, thereby minimizing the impact of attacks and safeguarding critical assets. Finally, it provides a comprehensive view of the risk landscape and helps to make informed decisions to protect the organization's data and infrastructure. False positives might occur so it is important to identify the impact of the attack and prioritize response and mitigation efforts. data_source: [] search: '`risk_index` | fillnull | stats sum(risk_score) as risk_score values(source) as signals values(user) as user by repository | sort - risk_score | where risk_score diff --git a/detections/cloud/correlation_by_user_and_risk.yml b/detections/cloud/correlation_by_user_and_risk.yml index 9975542c8f..2350f7cfe8 100644 --- a/detections/cloud/correlation_by_user_and_risk.yml +++ b/detections/cloud/correlation_by_user_and_risk.yml @@ -5,18 +5,8 @@ date: '2021-09-06' author: Patrick Bareiss, Splunk status: production type: Correlation -description: This analytic detects the correlation between the user and risk score - and identifies users with a high risk score that pose a significant security risk - such as unauthorized access attempts, suspicious behavior, or potential insider - threats. Next, the analytic calculates the sum of the risk scores and groups the - results by user, the corresponding signals, and the repository. The results are - sorted in descending order based on the risk score and filtered to include records - with a risk score greater than 80. Finally, the results are passed through a correlation - filter specific to the user and risk. This detection is important because it identifies - users who have a high risk score and helps to prioritize investigations and allocate - resources. False positives might occur but the impact of such an attack can vary - depending on the specific scenario such as data exfiltration, system compromise, - or the disruption of critical services. Please investigate this notable event. +description: |- + This analytic detects the correlation between the user and risk score and identifies users with a high risk score that pose a significant security risk such as unauthorized access attempts, suspicious behavior, or potential insider threats. Next, the analytic calculates the sum of the risk scores and groups the results by user, the corresponding signals, and the repository. The results are sorted in descending order based on the risk score and filtered to include records with a risk score greater than 80. Finally, the results are passed through a correlation filter specific to the user and risk. This detection is important because it identifies users who have a high risk score and helps to prioritize investigations and allocate resources. False positives might occur but the impact of such an attack can vary depending on the specific scenario such as data exfiltration, system compromise, or the disruption of critical services. Please investigate this notable event. data_source: [] search: '`risk_index` | fillnull | stats sum(risk_score) as risk_score values(source) as signals values(repository) as repository by user | sort - risk_score | where diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index 3d3e7977fb..54305304f6 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -5,24 +5,9 @@ date: '2021-09-01' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: 'As a prerequisite, ensure that you ingest Github logs that contain information - about Dependabot Alerts. This analytic detects Dependabot Alerts in Github logs. - - The detection is made by first searching for logs that contain the action ""create"" - and renames certain fields for easier analysis. Then, this analytic uses the ""stats"" - command to calculate the first and last occurrence of the alert based on the timestamp. - The fields included in the output are the action, affected package name, affected - range, created date, external identifier, external reference, fixed version, severity, - repository, repository URL, and user. The ""phase"" field is set to ""code"" to - indicate that the alert pertains to code-related issues. The detection is important - because dependabot Alerts can indicate vulnerabilities in the codebase that can - be exploited by attackers. Detecting and investigating these alerts can help a SOC - to proactively address security risks and prevent potential breaches or unauthorized - access to sensitive information. False positives might occur since there are legitimate - actions that trigger the ""create"" action or if other factors exist that can generate - similar log entries. Next steps include reviewing the details of the alert, such - as the affected package, severity, and fixed version to determine the appropriate - response and mitigation steps.' +description: |- + As a prerequisite, ensure that you ingest Github logs that contain information about Dependabot Alerts. This analytic detects Dependabot Alerts in Github logs. + The detection is made by first searching for logs that contain the action ""create"" and renames certain fields for easier analysis. Then, this analytic uses the ""stats"" command to calculate the first and last occurrence of the alert based on the timestamp. The fields included in the output are the action, affected package name, affected range, created date, external identifier, external reference, fixed version, severity, repository, repository URL, and user. The ""phase"" field is set to ""code"" to indicate that the alert pertains to code-related issues. The detection is important because dependabot Alerts can indicate vulnerabilities in the codebase that can be exploited by attackers. Detecting and investigating these alerts can help a SOC to proactively address security risks and prevent potential breaches or unauthorized access to sensitive information. False positives might occur since there are legitimate actions that trigger the ""create"" action or if other factors exist that can generate similar log entries. Next steps include reviewing the details of the alert, such as the affected package, severity, and fixed version to determine the appropriate response and mitigation steps. data_source: [] search: '`github` alert.id=* action=create | rename repository.full_name as repository, repository.html_url as repository_url sender.login as user | stats min(_time) as diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index f54d10b808..a8f1083b00 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -5,24 +5,8 @@ date: '2023-08-02' author: Rod Soto, Splunk status: production type: TTP -description: This analytic detects the addition of a new federated domain in an organization's - Office 365 environment. Identifies instances where a new federated domain is added - to the organization's Office 365 configuration and helps to take immediate action - to mitigate the risks, prevent further unauthorized access, and protect the organization's - data and systems. The detection is made by the Splunk query `o365_management_activity` - with the parameters `Workload=Exchange` and `Operation="Add-FederatedDomain"`, which - analyzes the management activity logs in Office 365 and filters for the specific - operation to add a federated domain. The detection is important because identifying - the addition of a new federated domain can indicate potential unauthorized access - or compromise of the organization's Office 365 environment. A new Federated domain - can be added by an attacker to gain unauthorized access, exfiltrate data, or carry - out other malicious activity, which can lead to data breaches, unauthorized access - to sensitive information, or compromise of the organization's systems and infrastructure. - Next steps include viewing the details of the added federated domain, including - the organization name, originating server, user ID, and user key. You must also - capture and analyze any relevant on-disk artifacts. Additionally, you must identify - the source of the attack by looking for concurrent processes or other indicators - of compromise. +description: |- + This analytic detects the addition of a new federated domain in an organization's Office 365 environment. Identifies instances where a new federated domain is added to the organization's Office 365 configuration and helps to take immediate action to mitigate the risks, prevent further unauthorized access, and protect the organization's data and systems. The detection is made by the Splunk query `o365_management_activity` with the parameters `Workload=Exchange` and `Operation="Add-FederatedDomain"`, which analyzes the management activity logs in Office 365 and filters for the specific operation to add a federated domain. The detection is important because identifying the addition of a new federated domain can indicate potential unauthorized access or compromise of the organization's Office 365 environment. A new Federated domain can be added by an attacker to gain unauthorized access, exfiltrate data, or carry out other malicious activity, which can lead to data breaches, unauthorized access to sensitive information, or compromise of the organization's systems and infrastructure. Next steps include viewing the details of the added federated domain, including the organization name, originating server, user ID, and user key. You must also capture and analyze any relevant on-disk artifacts. Additionally, you must identify the source of the attack by looking for concurrent processes or other indicators of compromise. data_source: [] search: '`o365_management_activity` Operation IN ("*add*", "*new*") AND Operation="*domain*" | stats count values(ModifiedProperties{}.NewValue) as new_value by user user_agent diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 11f7f2d164..757964619e 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -5,31 +5,8 @@ date: '2020-12-16' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: This analytic detects when multiple users have configured a forwarding - rule to the same destination to proactively identify and investigate potential security - risks related to email forwarding and take appropriate actions to protect the organization's - data and prevent unauthorized access or data breaches. This detection is made by - a Splunk query to O365 management activity logs with the operation `Set-Mailbox` - to gather information about mailbox configurations. Then, the query uses the `spath` - function to extract the parameters and rename the "Identity" field as "src_user" - and searches for entries where the "ForwardingSmtpAddress" field is not empty, which - indicates the presence of a forwarding rule. Next, the analytic uses the `stats` - command to group the results by the forwarding email address and count the number - of unique source users (`src_user`). Finally, it filters the results and only retains - entries where the count of source users (`count_src_user`) is greater than 1, which - indicates that multiple users have set up forwarding rules to the same destination. - This detection is important because it suggests that multiple users are forwarding - emails to the same destination without proper authorization, which can lead to the - exposure of sensitive information, loss of data control, or unauthorized access - to confidential emails. Investigating and addressing this issue promptly can help - prevent data breaches and mitigate potential damage.indicates a potential security - risk since multiple users forwarding emails to the same destination can be a sign - of unauthorized access, data exfiltration, or a compromised account. Additionally, - it also helps to determine if the forwarding rules are legitimate or if they indicate - a security incident. False positives can occur if there are legitimate reasons for - multiple users to forward emails to the same destination, such as a shared mailbox - or a team collaboration scenario. Next steps include further investigation and context - analysis to determine the legitimacy of the forwarding rules. +description: |- + This analytic detects when multiple users have configured a forwarding rule to the same destination to proactively identify and investigate potential security risks related to email forwarding and take appropriate actions to protect the organization's data and prevent unauthorized access or data breaches. This detection is made by a Splunk query to O365 management activity logs with the operation `Set-Mailbox` to gather information about mailbox configurations. Then, the query uses the `spath` function to extract the parameters and rename the "Identity" field as "src_user" and searches for entries where the "ForwardingSmtpAddress" field is not empty, which indicates the presence of a forwarding rule. Next, the analytic uses the `stats` command to group the results by the forwarding email address and count the number of unique source users (`src_user`). Finally, it filters the results and only retains entries where the count of source users (`count_src_user`) is greater than 1, which indicates that multiple users have set up forwarding rules to the same destination. This detection is important because it suggests that multiple users are forwarding emails to the same destination without proper authorization, which can lead to the exposure of sensitive information, loss of data control, or unauthorized access to confidential emails. Investigating and addressing this issue promptly can help prevent data breaches and mitigate potential damage.indicates a potential security risk since multiple users forwarding emails to the same destination can be a sign of unauthorized access, data exfiltration, or a compromised account. Additionally, it also helps to determine if the forwarding rules are legitimate or if they indicate a security incident. False positives can occur if there are legitimate reasons for multiple users to forward emails to the same destination, such as a shared mailbox or a team collaboration scenario. Next steps include further investigation and context analysis to determine the legitimacy of the forwarding rules. data_source: [] search: '`o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc(src_user) diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index 54c6d0c03f..f1b1adeb67 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -5,16 +5,8 @@ date: '2019-12-06' author: Patrick Bareiss, Splunk status: production type: TTP -description: As a prerequisite, ensure that your Sysmon setup includes EventCode 10 - logging for lsass.exe. This analytic detects the dumping of the LSASS process memory, - which occurs during credential dumping attacks.The detection is made by using Sysmon - logs, specifically EventCode 10, which is related to lsass.exe. This helps to search - for indicators of LSASS memory dumping such as specific call traces to dbgcore.dll - and dbghelp.dll. This detection is important because it prevents credential dumping - attacks and the theft of sensitive information such as login credentials, which - can be used to gain unauthorized access to systems and data. False positives might - occur due to legitimate administrative tasks. Next steps include reviewing and investigating - each case, given the high risk associated with potential credential dumping attacks. +description: |- + As a prerequisite, ensure that your Sysmon setup includes EventCode 10 logging for lsass.exe. This analytic detects the dumping of the LSASS process memory, which occurs during credential dumping attacks.The detection is made by using Sysmon logs, specifically EventCode 10, which is related to lsass.exe. This helps to search for indicators of LSASS memory dumping such as specific call traces to dbgcore.dll and dbghelp.dll. This detection is important because it prevents credential dumping attacks and the theft of sensitive information such as login credentials, which can be used to gain unauthorized access to systems and data. False positives might occur due to legitimate administrative tasks. Next steps include reviewing and investigating each case, given the high risk associated with potential credential dumping attacks. data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 9ac65df932..0b4f1a21ca 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -5,21 +5,8 @@ date: '2021-11-04' author: Bhavin Patel, Splunk status: production type: TTP -description: This analytic detects the use of tools that are commonly exploited by - cybercriminals since these tools are usually associated with malicious activities - such as unauthorized access, network scanning, or data exfiltration and pose a significant - threat to an organization's security infrastructure. It also provides enhanced visibility - into potential security threats and helps to proactively detect and respond to mitigate - the risks associated with cybercriminal activities. This detection is made by examining - the process activity on the host, specifically focusing on processes that are known - to be associated with attacker tool names. This detection is important because it - acts as an early warning system for potential security incidents that allows you - to respond to security incidents promptly. False positives might occur due to legitimate - administrative activities that can resemble malicious actions. You must develop - a comprehensive understanding of typical endpoint activities and behaviors within - the organization to accurately interpret and respond to the alerts generated by - this analytic. This ensures a proper balance between precision and minimizing false - positives. +description: |- + This analytic detects the use of tools that are commonly exploited by cybercriminals since these tools are usually associated with malicious activities such as unauthorized access, network scanning, or data exfiltration and pose a significant threat to an organization's security infrastructure. It also provides enhanced visibility into potential security threats and helps to proactively detect and respond to mitigate the risks associated with cybercriminal activities. This detection is made by examining the process activity on the host, specifically focusing on processes that are known to be associated with attacker tool names. This detection is important because it acts as an early warning system for potential security incidents that allows you to respond to security incidents promptly. False positives might occur due to legitimate administrative activities that can resemble malicious actions. You must develop a comprehensive understanding of typical endpoint activities and behaviors within the organization to accurately interpret and respond to the alerts generated by this analytic. This ensures a proper balance between precision and minimizing false positives. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index 9e82309793..fce54c6a94 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -5,18 +5,8 @@ date: '2021-09-16' author: Patrick Bareiss, Rico Valdez, Splunk status: production type: TTP -description: As a prerequisite, ensure that you ingest data that records process activity - and logs containing process names and command lines. This analytic detects whether - a process is attempting to add a certificate to the untrusted certificate store, - which might result in security tools being disabled. The detection is made by focusing - on process activities and command-line arguments that are related to the 'certutil - -addstore' command. This detection is important because it helps to identify attackers - who might add a certificate to the untrusted certificate store to disable security - tools and gain unauthorized access to a system. False positives might occur since - legitimate reasons might exist for a process to add a certificate to the untrusted - certificate store, such as system administration tasks. Next steps include conducting - an extensive triage and investigation prior to taking any action. Additionally, - you must understand the importance of trust and its subversion in system security. +description: |- + As a prerequisite, ensure that you ingest data that records process activity and logs containing process names and command lines. This analytic detects whether a process is attempting to add a certificate to the untrusted certificate store, which might result in security tools being disabled. The detection is made by focusing on process activities and command-line arguments that are related to the 'certutil -addstore' command. This detection is important because it helps to identify attackers who might add a certificate to the untrusted certificate store to disable security tools and gain unauthorized access to a system. False positives might occur since legitimate reasons might exist for a process to add a certificate to the untrusted certificate store, such as system administration tasks. Next steps include conducting an extensive triage and investigation prior to taking any action. Additionally, you must understand the importance of trust and its subversion in system security. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index cd53a71245..9a33bfa912 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -5,23 +5,8 @@ date: '2023-06-13' author: Rico Valdez, Splunk status: production type: TTP -description: This analytic detects attempts to stop security-related services on the - endpoint and helps to mitigate potential threats earlier, thereby minimizing the - impact on the organization's security. The detection is made by using a Splunk query - that searches for processes that involve the "sc.exe" command and include the phrase - "stop" in their command. The query collects information such as the process name, - process ID, parent process, user, destination, and timestamps. The detection is - important because attempts to stop security-related services can indicate malicious - activity or an attacker's attempt to disable security measures. This can impact - the organization's security posture and can lead to the compromise of the endpoint - and potentially the entire network. Disabling security services can allow attackers - to gain unauthorized access, exfiltrate sensitive data, or launch further attacks, - such as malware installation or privilege escalation. False positives might occur - since there might be legitimate reasons for stopping these services in certain situations. - Therefore, you must exercise caution and consider the context of the activity before - taking any action. Next steps include reviewing the identified process and its associated - details. You must also investigate any on-disk artifacts related to the process - and review concurrent processes to determine the source of the attack. +description: |- + This analytic detects attempts to stop security-related services on the endpoint and helps to mitigate potential threats earlier, thereby minimizing the impact on the organization's security. The detection is made by using a Splunk query that searches for processes that involve the "sc.exe" command and include the phrase "stop" in their command. The query collects information such as the process name, process ID, parent process, user, destination, and timestamps. The detection is important because attempts to stop security-related services can indicate malicious activity or an attacker's attempt to disable security measures. This can impact the organization's security posture and can lead to the compromise of the endpoint and potentially the entire network. Disabling security services can allow attackers to gain unauthorized access, exfiltrate sensitive data, or launch further attacks, such as malware installation or privilege escalation. False positives might occur since there might be legitimate reasons for stopping these services in certain situations. Therefore, you must exercise caution and consider the context of the activity before taking any action. Next steps include reviewing the identified process and its associated details. You must also investigate any on-disk artifacts related to the process and review concurrent processes to determine the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` values(Processes.process) as process diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index d52ab30c1e..dfde909970 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -5,23 +5,8 @@ date: '2021-09-08' author: Bhavin Patel, Splunk status: production type: TTP -description: This analytic detects the creation of local administrator accounts using - the net.exe command to mitigate the risks associated with unauthorized access and - prevent further damage to the environment by responding to potential threats earlier - and taking appropriate actions to protect the organization's systems and data. This - detection is made by a Splunk query to search for processes with the name net.exe - or net1.exe that include the "/add" parameter and have specific keywords related - to administrator accounts in their process name. This detection is important because - the creation of unauthorized local administrator accounts might indicate that an - attacker has successfully created a new administrator account and is trying to gain - persistent access to a system or escalate their privileges for data theft, or other - malicious activities. False positives might occur since there might be legitimate - uses of the net.exe command and the creation of administrator accounts in certain - circumstances. You must consider the context of the activity and other indicators - of compromise before taking any action. For next steps, review the details of the - identified process, including the user, parent process, and parent process name. - Examine any relevant on-disk artifacts and look for concurrent processes to determine - the source of the attack. +description: |- + This analytic detects the creation of local administrator accounts using the net.exe command to mitigate the risks associated with unauthorized access and prevent further damage to the environment by responding to potential threats earlier and taking appropriate actions to protect the organization's systems and data. This detection is made by a Splunk query to search for processes with the name net.exe or net1.exe that include the "/add" parameter and have specific keywords related to administrator accounts in their process name. This detection is important because the creation of unauthorized local administrator accounts might indicate that an attacker has successfully created a new administrator account and is trying to gain persistent access to a system or escalate their privileges for data theft, or other malicious activities. False positives might occur since there might be legitimate uses of the net.exe command and the creation of administrator accounts in certain circumstances. You must consider the context of the activity and other indicators of compromise before taking any action. For next steps, review the details of the identified process, including the user, parent process, and parent process name. Examine any relevant on-disk artifacts and look for concurrent processes to determine the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count values(Processes.user) as diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index bfb4a8bc66..19375f997f 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -5,26 +5,8 @@ date: '2020-09-16' author: Bhavin Patel, Splunk status: production type: TTP -description: As a prerequisite, ensure that you are collecting and ingesting endpoint - process logs that include information about the net.exe command. This analytic detects - the creation or deletion of hidden shares using the net.exe command for prompt response - and mitigation to enhance the overall security posture of the organization and protect - against potential data breaches, malware infections, and other damaging outcomes. - This detection is made by searching for processes that involve the use of net.exe - and filters for actions related to creation or deletion of shares. This detection - is important because it suggests that an attacker is attempting to manipulate or - exploit the network by creating or deleting hidden shares. The creation or deletion - of hidden shares can indicate malicious activity since attackers might use hidden - shares to exfiltrate data, distribute malware, or establish persistence within a - network. The impact of such an attack can vary, but it often involves unauthorized - access to sensitive information, disruption of services, or the introduction of - malware. False positives might occur since legitimate actions can also involve the - use of net.exe. An extensive triage and investigation is necessary to determine - the intent and nature of the detected activity. Next steps include reviewing the - details of the process involving the net.exe command, including the user, parent - process, and timestamps during the triage. Additionally, capture and inspect any - relevant on-disk artifacts and review concurrent processes to identify the source - of the attack. +description: |- + As a prerequisite, ensure that you are collecting and ingesting endpoint process logs that include information about the net.exe command. This analytic detects the creation or deletion of hidden shares using the net.exe command for prompt response and mitigation to enhance the overall security posture of the organization and protect against potential data breaches, malware infections, and other damaging outcomes. This detection is made by searching for processes that involve the use of net.exe and filters for actions related to creation or deletion of shares. This detection is important because it suggests that an attacker is attempting to manipulate or exploit the network by creating or deleting hidden shares. The creation or deletion of hidden shares can indicate malicious activity since attackers might use hidden shares to exfiltrate data, distribute malware, or establish persistence within a network. The impact of such an attack can vary, but it often involves unauthorized access to sensitive information, disruption of services, or the introduction of malware. False positives might occur since legitimate actions can also involve the use of net.exe. An extensive triage and investigation is necessary to determine the intent and nature of the detected activity. Next steps include reviewing the details of the process involving the net.exe command, including the user, parent process, and timestamps during the triage. Additionally, capture and inspect any relevant on-disk artifacts and review concurrent processes to identify the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count values(Processes.user) as diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index d695532950..a6e6542b6c 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -5,20 +5,9 @@ date: '2019-12-06' author: Patrick Bareiss, Splunk status: production type: TTP -description: 'This analytic detects the creation of a remote thread in the Local Security - Authority Subsystem Service (LSASS), which is a common tactic used by adversaries - to steal user authentication credentials, known as credential dumping. The detection - is made by leveraging Sysmon Event ID 8 logs and searches for processes that create - remote threads in lsass.exe. This is an unusual activity that is generally linked - to credential theft or credential dumping, which is a significant threat to network - security. - - The detection is important because it helps to detect potential credential dumping - attacks, which can result in significant damage to an organization''s security. - False positives might occur though the confidence level of this alert is high. There - might be cases where legitimate tools can access LSASS and generate similar logs. - Therefore, you must understand the broader context of such events and differentiate - between legitimate activities and possible threats.' +description: |- + This analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS), which is a common tactic used by adversaries to steal user authentication credentials, known as credential dumping. The detection is made by leveraging Sysmon Event ID 8 logs and searches for processes that create remote threads in lsass.exe. This is an unusual activity that is generally linked to credential theft or credential dumping, which is a significant threat to network security. + The detection is important because it helps to detect potential credential dumping attacks, which can result in significant damage to an organization's security. False positives might occur though the confidence level of this alert is high. There might be cases where legitimate tools can access LSASS and generate similar logs. Therefore, you must understand the broader context of such events and differentiate between legitimate activities and possible threats. data_source: - Sysmon Event ID 8 search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index bfa0b86795..549358e4e1 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -5,19 +5,8 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk status: production type: TTP -description: This analytic detects the use of two specific tools, wmic and Powershell, - to create a shadow copy to identify potential threats earlier and take appropriate - actions to mitigate the risks. This detection is made by a Splunk query that searches - for processes in the Endpoint.Processes data model where either the process name - contains "wmic" or "Powershell" and the process command contains "shadowcopy" and - "create". This detection is important because it suggests that an attacker is attempting - to manipulate or access data in an unauthorized manner, which can lead to data theft, - data manipulation, or other malicious activities. Attackers might use shadow copies - to backup and exfiltrate sensitive data or to hide their tracks by restoring files - to a previous state after an attack. Next steps include reviewing the user associated - with the process, the process name, the original file name, the process command, - and the destination of the process. Additionally, examine any relevant on-disk artifacts - and review other concurrent processes to determine the source of the attack. +description: |- + This analytic detects the use of two specific tools, wmic and Powershell, to create a shadow copy to identify potential threats earlier and take appropriate actions to mitigate the risks. This detection is made by a Splunk query that searches for processes in the Endpoint.Processes data model where either the process name contains "wmic" or "Powershell" and the process command contains "shadowcopy" and "create". This detection is important because it suggests that an attacker is attempting to manipulate or access data in an unauthorized manner, which can lead to data theft, data manipulation, or other malicious activities. Attackers might use shadow copies to backup and exfiltrate sensitive data or to hide their tracks by restoring files to a previous state after an attack. Next steps include reviewing the user associated with the process, the process name, the original file name, the process command, and the destination of the process. Additionally, examine any relevant on-disk artifacts and review other concurrent processes to determine the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 324027f344..ff37fc8b8d 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -5,22 +5,8 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk status: production type: TTP -description: This analytic detects the creation of a symlink to a shadow copy to identify - potential threats earlier and mitigate the risks associated with symlink creation - to shadow copies. The detection is made by using a Splunk query that searches for - processes with commands containing "mklink" and "HarddiskVolumeShadowCopy". This - analytic retrieves information such as the destination, user, process name, process - ID, parent process, original file name, and parent process ID from the Endpoint.Processes - data model. The detection is important because it indicates potential malicious - activity since attackers might use this technique to manipulate or delete shadow - copies, which are used for system backup and recovery. This detection helps to determine - if an attacker is attempting to cover their tracks or prevent data recovery in the - event of an incident. The impact of such an attack can be significant since it can - hinder incident response efforts, prevent data restoration, and potentially lead - to data loss or compromise. Next steps include reviewing the details of the process, - such as the destination and the user responsible for creating the symlink. Additionally, - you must examine the parent process, any relevant on-disk artifacts, and concurrent - processes to identify the source of the attack. +description: |- + This analytic detects the creation of a symlink to a shadow copy to identify potential threats earlier and mitigate the risks associated with symlink creation to shadow copies. The detection is made by using a Splunk query that searches for processes with commands containing "mklink" and "HarddiskVolumeShadowCopy". This analytic retrieves information such as the destination, user, process name, process ID, parent process, original file name, and parent process ID from the Endpoint.Processes data model. The detection is important because it indicates potential malicious activity since attackers might use this technique to manipulate or delete shadow copies, which are used for system backup and recovery. This detection helps to determine if an attacker is attempting to cover their tracks or prevent data recovery in the event of an incident. The impact of such an attack can be significant since it can hinder incident response efforts, prevent data restoration, and potentially lead to data loss or compromise. Next steps include reviewing the details of the process, such as the destination and the user responsible for creating the symlink. Additionally, you must examine the parent process, any relevant on-disk artifacts, and concurrent processes to identify the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml index f940073ab2..e5074c4675 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml @@ -5,21 +5,8 @@ date: '2021-01-27' author: Shannon Davis, Splunk status: experimental type: TTP -description: This analytic detects a specific type of vulnerability known as a heap-based - buffer overflow in the sudoedit command, commonly referred to as Baron Samedit CVE-2021-3156. - The detection is made by a Splunk query that searches for instances of the sudoedit - command with the "-s" flag followed by a double quote. This combination of parameters - is indicative of the vulnerability being exploited. The detection is important because - it suggests that an attacker is attempting to exploit the Baron Samedit vulnerability. - The Baron Samedit vulnerability allows an attacker to gain elevated privileges on - a Linux system and run arbitrary code with root privileges, potentially leading - to complete control over the affected system. The impact of a successful attack - can be severe since it allows the attacker to bypass security measures and gain - unauthorized access to sensitive data or systems. This can result in data breaches, - unauthorized modifications, or even complete system compromise. Next steps include - being aware of this vulnerability and actively monitoring any attempts to exploit - it. By detecting and responding to such attacks in a timely manner, you can prevent - or minimize the potential damage caused by the heap-based buffer overflow of sudoedit. +description: |- + This analytic detects a specific type of vulnerability known as a heap-based buffer overflow in the sudoedit command, commonly referred to as Baron Samedit CVE-2021-3156. The detection is made by a Splunk query that searches for instances of the sudoedit command with the "-s" flag followed by a double quote. This combination of parameters is indicative of the vulnerability being exploited. The detection is important because it suggests that an attacker is attempting to exploit the Baron Samedit vulnerability. The Baron Samedit vulnerability allows an attacker to gain elevated privileges on a Linux system and run arbitrary code with root privileges, potentially leading to complete control over the affected system. The impact of a successful attack can be severe since it allows the attacker to bypass security measures and gain unauthorized access to sensitive data or systems. This can result in data breaches, unauthorized modifications, or even complete system compromise. Next steps include being aware of this vulnerability and actively monitoring any attempts to exploit it. By detecting and responding to such attacks in a timely manner, you can prevent or minimize the potential damage caused by the heap-based buffer overflow of sudoedit. data_source: [] search: '`linux_hosts` "sudoedit -s \\" | `detect_baron_samedit_cve_2021_3156_filter`' how_to_implement: Splunk Universal Forwarder running on Linux systems, capturing logs diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml index 9df94b51df..cd0f3e7fd8 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml @@ -5,14 +5,8 @@ date: '2021-01-29' author: Shannon Davis, Splunk status: experimental type: TTP -description: This analytic detects the occurrence of a heap-based buffer overflow - in sudoedit.The detection is made by using a Splunk query to identify Linux hosts - where the terms "sudoedit" and "segfault" appear in the logs. The detection is important - because the heap-based buffer overflow vulnerability in sudoedit can be exploited - by attackers to gain elevated root privileges on a vulnerable system, which might - lead to the compromise of sensitive data, unauthorized access, and other malicious - activities. False positives might occur. Therefore, you must review the logs and - investigate further before taking any action. +description: |- + This analytic detects the occurrence of a heap-based buffer overflow in sudoedit.The detection is made by using a Splunk query to identify Linux hosts where the terms "sudoedit" and "segfault" appear in the logs. The detection is important because the heap-based buffer overflow vulnerability in sudoedit can be exploited by attackers to gain elevated root privileges on a vulnerable system, which might lead to the compromise of sensitive data, unauthorized access, and other malicious activities. False positives might occur. Therefore, you must review the logs and investigate further before taking any action. data_source: [] search: '`linux_hosts` TERM(sudoedit) TERM(segfault) | stats count min(_time) as firstTime max(_time) as lastTime by host | where count > 5 | `detect_baron_samedit_cve_2021_3156_segfault_filter`' diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index d71eba5bfc..0d5c028ccb 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -5,19 +5,8 @@ date: '2019-12-03' author: Patrick Bareiss, Splunk status: production type: TTP -description: As a prerequisite, ensure that sysmon events are being ingested and monitored. - This analytic detects the reading of lsass memory, which is consistent with credential - dumping. Reading lsass memory is a common technique used by attackers to steal credentials - from the Windows operating system. The detection is made by monitoring the sysmon - events and filtering for specific access permissions (0x1010 and 0x1410) on the - lsass.exe process helps identify potential instances of credential dumping.The detection - is important because it suggests that an attacker is attempting to extract credentials - from the lsass memory, which can lead to unauthorized access, data breaches, and - compromise of sensitive information. Credential dumping is often a precursor to - further attacks, such as lateral movement, privilege escalation, or data exfiltration. - False positives can occur due to legitimate actions that involve accessing lsass - memory. Therefore, extensive triage and investigation are necessary to differentiate - between malicious and benign activities. +description: |- + As a prerequisite, ensure that sysmon events are being ingested and monitored. This analytic detects the reading of lsass memory, which is consistent with credential dumping. Reading lsass memory is a common technique used by attackers to steal credentials from the Windows operating system. The detection is made by monitoring the sysmon events and filtering for specific access permissions (0x1010 and 0x1410) on the lsass.exe process helps identify potential instances of credential dumping.The detection is important because it suggests that an attacker is attempting to extract credentials from the lsass memory, which can lead to unauthorized access, data breaches, and compromise of sensitive information. Credential dumping is often a precursor to further attacks, such as lateral movement, privilege escalation, or data exfiltration. False positives can occur due to legitimate actions that involve accessing lsass memory. Therefore, extensive triage and investigation are necessary to differentiate between malicious and benign activities. data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 59350df034..0e8721e0d1 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -5,26 +5,8 @@ date: '2020-07-08' author: David Dorsey, Splunk status: production type: TTP -description: This analytic detects the creation of new accounts that have been elevated - to local administrators so that you can take immediate action to mitigate the risks - and prevent further unauthorized access or malicious activities. This detection - is made by using the Splunk query `wineventlog_security` EventCode=4720 OR (EventCode=4732 - Group_Name=Administrators) to search for relevant security events in the Windows - event log. When a new account is created or an existing account is added to the - Administrators group, this analytic identifies this behavior by looking for EventCode - 4720 (A user account was created) or EventCode 4732 (A member was added to a security-enabled - global group). This analytic specifically focuses on events where the Group_Name - is set to Administrators. This detection is important because it suggests that an - attacker has gained elevated privileges and can perform malicious actions with administrative - access. This can lead to significant impact, such as unauthorized access to sensitive - data, unauthorized modifications to systems or configurations, and potential disruption - of critical services. identifying this behavior is crucial for a Security Operations - Center (SOC). Next steps include reviewing the details of the security event, including - the user account that was created or added to the Administrators group. Also, examine - the time span between the first and last occurrence of the event to determine if - the behavior is ongoing. Additionally, consider any contextual information, such - as the destination where the account was created or added to understand the scope - and potential impact of the attack. +description: |- + This analytic detects the creation of new accounts that have been elevated to local administrators so that you can take immediate action to mitigate the risks and prevent further unauthorized access or malicious activities. This detection is made by using the Splunk query `wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) to search for relevant security events in the Windows event log. When a new account is created or an existing account is added to the Administrators group, this analytic identifies this behavior by looking for EventCode 4720 (A user account was created) or EventCode 4732 (A member was added to a security-enabled global group). This analytic specifically focuses on events where the Group_Name is set to Administrators. This detection is important because it suggests that an attacker has gained elevated privileges and can perform malicious actions with administrative access. This can lead to significant impact, such as unauthorized access to sensitive data, unauthorized modifications to systems or configurations, and potential disruption of critical services. identifying this behavior is crucial for a Security Operations Center (SOC). Next steps include reviewing the details of the security event, including the user account that was created or added to the Administrators group. Also, examine the time span between the first and last occurrence of the event to determine if the behavior is ongoing. Additionally, consider any contextual information, such as the destination where the account was created or added to understand the scope and potential impact of the attack. data_source: - Windows Security 4732 - Windows Security 4720 diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index e0cb5e6796..b6ccf4ec21 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -5,23 +5,8 @@ date: '2023-04-14' author: Patrick Bareiss, Splunk status: production type: TTP -description: 1. As a prerequisite, ensure that logs with process information are ingested - from your endpoints. This analytic detects the behavior of dumping credentials - from memory, a tactic commonly used by adversaries to exploit the Local Security - Authority Subsystem Service (LSASS) in Windows, which manages system-level authentication. - The detection is made by monitoring logs with process information from endpoints - and identifying instances where the rundll32 process is used in conjunction with - the comsvcs.dll and MiniDump. This indicates potential LSASS dumping attempts used - by threat actors to obtain valuable credentials. The detection is important because - credential theft can lead to broader system compromise, persistence, lateral movement, - and escalated privileges. No legitimate use of this technique has been identified - yet. This behavior is often part of more extensive attack campaigns and is associated - with numerous threat groups that use the stolen credentials to access sensitive - information or systems, leading to data theft, ransomware attacks, or other damaging - outcomes. False positives can occur since legitimate uses of the LSASS process can - cause benign activities to be flagged. Next steps include reviewing the processes - involved in the LSASS dumping attempt after triage and inspecting any relevant on-disk - artifacts and concurrent processes to identify the attack source. +description: |- + 1. As a prerequisite, ensure that logs with process information are ingested from your endpoints. This analytic detects the behavior of dumping credentials from memory, a tactic commonly used by adversaries to exploit the Local Security Authority Subsystem Service (LSASS) in Windows, which manages system-level authentication. The detection is made by monitoring logs with process information from endpoints and identifying instances where the rundll32 process is used in conjunction with the comsvcs.dll and MiniDump. This indicates potential LSASS dumping attempts used by threat actors to obtain valuable credentials. The detection is important because credential theft can lead to broader system compromise, persistence, lateral movement, and escalated privileges. No legitimate use of this technique has been identified yet. This behavior is often part of more extensive attack campaigns and is associated with numerous threat groups that use the stolen credentials to access sensitive information or systems, leading to data theft, ransomware attacks, or other damaging outcomes. False positives can occur since legitimate uses of the LSASS process can cause benign activities to be flagged. Next steps include reviewing the processes involved in the LSASS dumping attempt after triage and inspecting any relevant on-disk artifacts and concurrent processes to identify the attack source. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index fb3d09c6b9..2a1597a754 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -5,24 +5,8 @@ date: '2018-12-14' author: Rico Valdez, Splunk status: production type: TTP -description: This analytic detects file writes with extensions that are consistent - with a SamSam ransomware attack to proactively detect and respond to potential SamSam - ransomware attacks, minimizing the impact and reducing the likelihood of successful - ransomware infections. This detection is made by a Splunk query to search for specific - file extensions that are commonly associated with SamSam ransomware, such as .stubbin, - .berkshire, .satoshi, .sophos, and .keyxml. This identifies file extensions in the - file names of the written files. If any file write events with these extensions - are found, it suggests a potential SamSam ransomware attack. This detection is important - because SamSam ransomware is a highly destructive and financially motivated attack - and suggests that the organization is at risk of having its files encrypted and - held for ransom, which can lead to significant financial losses, operational disruptions, - and reputational damage. False positives might occur since legitimate files with - these extensions can exist in the environment. Therefore, next steps include conducting - a careful analysis and triage to confirm the presence of a SamSam ransomware attack. - Next steps include taking immediate action to contain the attack, mitigate the impact, - and prevent further spread of the ransomware. This might involve isolating affected - systems, restoring encrypted files from backups, and conducting a thorough investigation - to identify the attack source and prevent future incidents. +description: |- + This analytic detects file writes with extensions that are consistent with a SamSam ransomware attack to proactively detect and respond to potential SamSam ransomware attacks, minimizing the impact and reducing the likelihood of successful ransomware infections. This detection is made by a Splunk query to search for specific file extensions that are commonly associated with SamSam ransomware, such as .stubbin, .berkshire, .satoshi, .sophos, and .keyxml. This identifies file extensions in the file names of the written files. If any file write events with these extensions are found, it suggests a potential SamSam ransomware attack. This detection is important because SamSam ransomware is a highly destructive and financially motivated attack and suggests that the organization is at risk of having its files encrypted and held for ransom, which can lead to significant financial losses, operational disruptions, and reputational damage. False positives might occur since legitimate files with these extensions can exist in the environment. Therefore, next steps include conducting a careful analysis and triage to confirm the presence of a SamSam ransomware attack. Next steps include taking immediate action to contain the attack, mitigate the impact, and prevent further spread of the ransomware. This might involve isolating affected systems, restoring encrypted files from backups, and conducting a thorough investigation to identify the attack source and prevent future incidents. data_source: - Sysmon Event ID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml index 4f95c107ee..2e32fe87d2 100644 --- a/detections/endpoint/linux_decode_base64_to_shell.yml +++ b/detections/endpoint/linux_decode_base64_to_shell.yml @@ -5,16 +5,8 @@ date: '2022-07-27' author: Michael Haag, Splunk status: production type: TTP -description: This analytic detects the behavior of decoding base64-encoded data and - passing it to a Linux shell. Additionally, it mitigates the potential damage and - protects the organization's systems and data.The detection is made by searching - for specific commands in the Splunk query, namely "base64 -d" and "base64 --decode", - within the Endpoint.Processes data model. The analytic also includes a filter for - Linux shells. The detection is important because it indicates the presence of malicious - activity since Base64 encoding is commonly used to obfuscate malicious commands - or payloads, and decoding it can be a step in running those commands. It suggests - that an attacker is attempting to run malicious commands on a Linux system to gain - unauthorized access, for data exfiltration, or perform other malicious actions. +description: |- + This analytic detects the behavior of decoding base64-encoded data and passing it to a Linux shell. Additionally, it mitigates the potential damage and protects the organization's systems and data.The detection is made by searching for specific commands in the Splunk query, namely "base64 -d" and "base64 --decode", within the Endpoint.Processes data model. The analytic also includes a filter for Linux shells. The detection is important because it indicates the presence of malicious activity since Base64 encoding is commonly used to obfuscate malicious commands or payloads, and decoding it can be a step in running those commands. It suggests that an attacker is attempting to run malicious commands on a Linux system to gain unauthorized access, for data exfiltration, or perform other malicious actions. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 6f3805de01..294ed432a3 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -5,26 +5,8 @@ date: '2022-11-14' author: Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk status: production type: TTP -description: 'This analytic detects the presence of a registry key related to the - Remcos RAT agent on a host. This detection is made by a Splunk query to search for - instances where the registry key "license" is found in the "Software\Remcos" path. - This analytic combines information from two data models: Endpoint.Processes and - Endpoint.Registry and retrieves process information such as user, process ID, process - name, process path, destination, parent process name, parent process, and process - GUID. This analytic also retrieves registry information such as registry path, registry - key name, registry value name, registry value data, and process GUID. By joining - the process GUID from the Endpoint.Processes data model with the process GUID from - the Endpoint.Registry data model, the analytic identifies instances where the "license" - registry key is found in the "Software\Remcos" path. This detection is important - because it suggests that the host has been compromised by the Remcos RAT agent. - Remcos is a well-known remote access Trojan that can be used by attackers to gain - unauthorized access to systems and exfiltrate sensitive data. Identifying this behavior - allows the SOC to take immediate action to remove the RAT agent and prevent further - compromise. The impact of this attack can be severe, as the attacker can gain unauthorized - access to the system, steal sensitive information, or use the compromised system - as a launching point for further attacks. Next steps include using this analytic - in conjunction with other security measures and threat intelligence to ensure accurate - detection and response.' +description: |- + This analytic detects the presence of a registry key related to the Remcos RAT agent on a host. This detection is made by a Splunk query to search for instances where the registry key "license" is found in the "Software\Remcos" path. This analytic combines information from two data models: Endpoint.Processes and Endpoint.Registry and retrieves process information such as user, process ID, process name, process path, destination, parent process name, parent process, and process GUID. This analytic also retrieves registry information such as registry path, registry key name, registry value name, registry value data, and process GUID. By joining the process GUID from the Endpoint.Processes data model with the process GUID from the Endpoint.Registry data model, the analytic identifies instances where the "license" registry key is found in the "Software\Remcos" path. This detection is important because it suggests that the host has been compromised by the Remcos RAT agent. Remcos is a well-known remote access Trojan that can be used by attackers to gain unauthorized access to systems and exfiltrate sensitive data. Identifying this behavior allows the SOC to take immediate action to remove the RAT agent and prevent further compromise. The impact of this attack can be severe, as the attacker can gain unauthorized access to the system, steal sensitive information, or use the compromised system as a launching point for further attacks. Next steps include using this analytic in conjunction with other security measures and threat intelligence to ensure accurate detection and response. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index 142785d0fe..edc529817b 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -5,16 +5,8 @@ date: '2020-03-16' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP -description: This analytic detects any potential misuse of Windows Management Instrumentation - (WMI) for malicious purposes since adversaries often use WMI to run scripts which - allows them to carry out malicious activities without raising suspicion. The detection - is made by monitoring the process 'scrcons.exe', which is essential to run WMI scripts. - The detection is important because it proactively identifies and responds to potential - threats that leverage WMI for malicious purposes that can lead to system compromise, - data exfiltration, or the establishment of persistence within the environment. False - positives might occur since administrators might occasionally use WMI to launch - scripts for legitimate purposes. Therefore, you must distinguish between malicious - and benign activities. +description: |- + This analytic detects any potential misuse of Windows Management Instrumentation (WMI) for malicious purposes since adversaries often use WMI to run scripts which allows them to carry out malicious activities without raising suspicion. The detection is made by monitoring the process 'scrcons.exe', which is essential to run WMI scripts. The detection is important because it proactively identifies and responds to potential threats that leverage WMI for malicious purposes that can lead to system compromise, data exfiltration, or the establishment of persistence within the environment. False positives might occur since administrators might occasionally use WMI to launch scripts for legitimate purposes. Therefore, you must distinguish between malicious and benign activities. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index 902e251cdc..0f29405dfc 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -5,24 +5,8 @@ date: '2020-07-06' author: David Dorsey, Splunk status: production type: TTP -description: This analytic detects the creation and deletion of accounts in a short - time period to identify potential threats earlier and take appropriate actions to - mitigate the risks. Helps prevent or minimize the potential damage caused by unauthorized - access or malicious activities within the environment. This detection is made by - a Splunk query that searches for events with the result IDs 4720 and 4726 in the - "Change" data model. The query then groups the results by time, user, and destination. - The result is filtered to only include events with the specified result IDs. The - "transaction" command is used to group events that occur within a specified time - span and have the same user but are not connected. Finally, the relevant information - such as the first and last time of the event, the count, user, destination, and - result ID are displayed in a table. This detection is important because it suggests - that an attacker is attempting to create and delete accounts rapidly, potentially - to cover their tracks or gain unauthorized access. The impact of such an attack - can include unauthorized access to sensitive data, privilege escalation, or the - ability to carry out further malicious activities within the environment. Next steps - include investigating the events flagged by the analytic, review the account creation - and deletion activities, and analyze any associated logs or artifacts to determine - the intent and impact of the attack. +description: |- + This analytic detects the creation and deletion of accounts in a short time period to identify potential threats earlier and take appropriate actions to mitigate the risks. Helps prevent or minimize the potential damage caused by unauthorized access or malicious activities within the environment. This detection is made by a Splunk query that searches for events with the result IDs 4720 and 4726 in the "Change" data model. The query then groups the results by time, user, and destination. The result is filtered to only include events with the specified result IDs. The "transaction" command is used to group events that occur within a specified time span and have the same user but are not connected. Finally, the relevant information such as the first and last time of the event, the count, user, destination, and result ID are displayed in a table. This detection is important because it suggests that an attacker is attempting to create and delete accounts rapidly, potentially to cover their tracks or gain unauthorized access. The impact of such an attack can include unauthorized access to sensitive data, privilege escalation, or the ability to carry out further malicious activities within the environment. Next steps include investigating the events flagged by the analytic, review the account creation and deletion activities, and analyze any associated logs or artifacts to determine the intent and impact of the attack. data_source: [] search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 1c4e93d06a..ca8470407a 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -5,15 +5,8 @@ date: '2020-12-08' author: David Dorsey, Splunk status: production type: TTP -description: As a prerequisite, ensure that endpoint logs are being ingested and processed - by Splunk. This analytic detects a behavior where a process name consists only of - a single letter that helps to detect potential threats earlier and mitigate the - risks. This detection is important because it indicates the presence of malware - or an attacker attempting to evade detection by using a process name that is difficult - to identify or track so that he can carry out malicious activities such as data - theft or ransomware attacks. False positives might occur since there might be legitimate - uses of single-letter process names in your environment. Next steps include reviewing - the process details and investigating any suspicious activity upon triage. +description: |- + As a prerequisite, ensure that endpoint logs are being ingested and processed by Splunk. This analytic detects a behavior where a process name consists only of a single letter that helps to detect potential threats earlier and mitigate the risks. This detection is important because it indicates the presence of malware or an attacker attempting to evade detection by using a process name that is difficult to identify or track so that he can carry out malicious activities such as data theft or ransomware attacks. False positives might occur since there might be legitimate uses of single-letter process names in your environment. Next steps include reviewing the process details and investigating any suspicious activity upon triage. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index 7f13730316..e9043353c5 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -5,19 +5,8 @@ date: '2020-07-22' author: Rico Valdez, Splunk status: production type: TTP -description: As a prerequisite, ensure that you are ingesting logs with the endpoint - file system and process information. This analytic detects when a process other - than explorer.exe writes to the Windows Recycle Bin to detect potential threats - earlier and mitigate the risks. This detection is made by a Splunk query that utilizes - the Endpoint.Filesystem data model and the Endpoint.Processes data model. The query - looks for any process writing to the "*$Recycle.Bin*" file path, excluding explorer.exe. - This detection is important because it suggests that an attacker is attempting to - hide their activities by using the Recycle Bin, which can lead to data theft, ransomware, - or other damaging outcomes. Detecting writes to the Recycle Bin by a process other - than explorer.exe can help to investigate and determine if the activity is malicious - or benign. False positives might occur since there might be legitimate uses of the - Recycle Bin by processes other than explorer.exe. Next steps include reviewing the - process writing to the Recycle Bin and any relevant on-disk artifacts upon triage. +description: |- + As a prerequisite, ensure that you are ingesting logs with the endpoint file system and process information. This analytic detects when a process other than explorer.exe writes to the Windows Recycle Bin to detect potential threats earlier and mitigate the risks. This detection is made by a Splunk query that utilizes the Endpoint.Filesystem data model and the Endpoint.Processes data model. The query looks for any process writing to the "*$Recycle.Bin*" file path, excluding explorer.exe. This detection is important because it suggests that an attacker is attempting to hide their activities by using the Recycle Bin, which can lead to data theft, ransomware, or other damaging outcomes. Detecting writes to the Recycle Bin by a process other than explorer.exe can help to investigate and determine if the activity is malicious or benign. False positives might occur since there might be legitimate uses of the Recycle Bin by processes other than explorer.exe. Next steps include reviewing the process writing to the Recycle Bin and any relevant on-disk artifacts upon triage. data_source: - Sysmon Event ID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml index d9b82d26e4..970416ca51 100644 --- a/detections/endpoint/unusually_long_command_line.yml +++ b/detections/endpoint/unusually_long_command_line.yml @@ -5,21 +5,8 @@ date: '2020-12-08' author: David Dorsey, Splunk status: experimental type: Anomaly -description: As a prerequisite, ensure that you ingest logs with process information - from your endpoints into Splunk. This analytic detects command lines that are extremely - long, which might be indicative of malicious activity on your hosts because attackers - often use obfuscated or complex command lines to hide their actions and evade detection. - This helps to mitigate the risks associated with long command lines to enhance your - overall security posture and reduce the impact of attacks. This detection is important - because it suggests that an attacker might be attempting to execute a malicious - command or payload on the host, which can lead to various damaging outcomes such - as data theft, ransomware, or further compromise of the system. False positives - might occur since legitimate processes or commands can sometimes result in long - command lines. Next steps include conducting extensive triage and investigation - to differentiate between legitimate and malicious activities. Review the source - of the command line and the command itself during the triage. Additionally, capture - and inspect any relevant on-disk artifacts and review concurrent processes to identify - the source of the attack. +description: |- + As a prerequisite, ensure that you ingest logs with process information from your endpoints into Splunk. This analytic detects command lines that are extremely long, which might be indicative of malicious activity on your hosts because attackers often use obfuscated or complex command lines to hide their actions and evade detection. This helps to mitigate the risks associated with long command lines to enhance your overall security posture and reduce the impact of attacks. This detection is important because it suggests that an attacker might be attempting to execute a malicious command or payload on the host, which can lead to various damaging outcomes such as data theft, ransomware, or further compromise of the system. False positives might occur since legitimate processes or commands can sometimes result in long command lines. Next steps include conducting extensive triage and investigation to differentiate between legitimate and malicious activities. Review the source of the command line and the command itself during the triage. Additionally, capture and inspect any relevant on-disk artifacts and review concurrent processes to identify the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index c67aa77126..5435050d48 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -5,20 +5,8 @@ date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP -description: As a prerequisite, ensure that you are ingesting logs with process information - from your endpoints. This analytic detects when reg.exe modify registry keys that - define Windows services and their configurations in Windows to detect potential - threats earlier and mitigate the risks. This detection is made by a Splunk query - that searches for specific keywords in the process name, parent process name, user, - and process ID. This detection is important because it suggests that an attacker - has modified the registry keys that define Windows services and their configurations, - which can allow them to maintain access to the system and potentially move laterally - within the network. It is a common technique used by attackers to gain persistence - on a compromised system and its impact can lead to data theft, ransomware, or other - damaging outcomes. False positives can occur since legitimate uses of reg.exe to - modify registry keys for Windows services can also trigger this alert. Next steps - include reviewing the process and user context of the reg.exe activity and identify - any other concurrent processes that might be associated with the attack upon triage. +description: |- + As a prerequisite, ensure that you are ingesting logs with process information from your endpoints. This analytic detects when reg.exe modify registry keys that define Windows services and their configurations in Windows to detect potential threats earlier and mitigate the risks. This detection is made by a Splunk query that searches for specific keywords in the process name, parent process name, user, and process ID. This detection is important because it suggests that an attacker has modified the registry keys that define Windows services and their configurations, which can allow them to maintain access to the system and potentially move laterally within the network. It is a common technique used by attackers to gain persistence on a compromised system and its impact can lead to data theft, ransomware, or other damaging outcomes. False positives can occur since legitimate uses of reg.exe to modify registry keys for Windows services can also trigger this alert. Next steps include reviewing the process and user context of the reg.exe activity and identify any other concurrent processes that might be associated with the attack upon triage. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 16a72d4238..ad44a4067b 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -5,24 +5,8 @@ date: '2018-10-23' author: Rico Valdez, Splunk status: experimental type: TTP -description: As a prerequisite, ensure that you are collecting and analyzing Sysmon - Event ID 5 data from your endpoints. This analytic detects the creation of permanent - event subscriptions using Windows Management Instrumentation (WMI), which is used - by attackers to achieve persistence in a compromised system. By creating a permanent - event subscription, an attacker can run malicious scripts or binaries in response - to specific system events that enables them to maintain access to the system undetected. - The detection is made by using Sysmon Event ID 5 data to detect instances where - the consumers of these events are not the expected "NTEventLogEventConsumer." The - detection is important because it identifies unusual or unexpected subscription - creation, which suggests that an attacker is attempting to achieve persistence within - the environment and might be executing malicious scripts or binaries in response - to specific system events. The impact of such an attack can be severe, potentially - leading to data theft, ransomware, or other damaging outcomes. False positives might - occur since False positives might occur since WMI event subscriptions can be used - for legitimate purposes by system administrators. You must have a thorough understanding - of WMI activity within the context of the monitored environment to effectively differentiate - between legitimate and malicious activity.Next steps include investigating the associated - scripts or binaries and identifying the source of the attack. +description: |- + As a prerequisite, ensure that you are collecting and analyzing Sysmon Event ID 5 data from your endpoints. This analytic detects the creation of permanent event subscriptions using Windows Management Instrumentation (WMI), which is used by attackers to achieve persistence in a compromised system. By creating a permanent event subscription, an attacker can run malicious scripts or binaries in response to specific system events that enables them to maintain access to the system undetected. The detection is made by using Sysmon Event ID 5 data to detect instances where the consumers of these events are not the expected "NTEventLogEventConsumer." The detection is important because it identifies unusual or unexpected subscription creation, which suggests that an attacker is attempting to achieve persistence within the environment and might be executing malicious scripts or binaries in response to specific system events. The impact of such an attack can be severe, potentially leading to data theft, ransomware, or other damaging outcomes. False positives might occur since False positives might occur since WMI event subscriptions can be used for legitimate purposes by system administrators. You must have a thorough understanding of WMI activity within the context of the monitored environment to effectively differentiate between legitimate and malicious activity.Next steps include investigating the associated scripts or binaries and identifying the source of the attack. data_source: - Sysmon Event ID 5 search: '`wmi` EventCode=5861 Binding | rex field=Message "Consumer =\s+(?[^;|^$]+)" diff --git a/detections/endpoint/wmi_temporary_event_subscription.yml b/detections/endpoint/wmi_temporary_event_subscription.yml index a4a2686938..974ad9e7cb 100644 --- a/detections/endpoint/wmi_temporary_event_subscription.yml +++ b/detections/endpoint/wmi_temporary_event_subscription.yml @@ -5,29 +5,9 @@ date: '2018-10-23' author: Rico Valdez, Splunk status: experimental type: TTP -description: 'This analytic detects the creation of WMI temporary event subscriptions. - WMI (Windows Management Instrumentation) is a management technology that allows - administrators to perform various tasks on Windows-based systems. Temporary event - subscriptions are created to monitor specific events or changes on a system that - help to detect potential threats early and take proactive measures to protect the - organization''s systems and data. - - The detection is made by using the Splunk query `wmi` EventCode=5860 Temporary to - search for events with EventCode 5860, which indicates the creation of a temporary - WMI event subscription. To further refine the search results, the query uses regular - expressions (rex) to extract the query used in the event subscription. Then, it - filters known benign queries related to system processes such as ''wsmprovhost.exe'' - and ''AntiVirusProduct'', ''FirewallProduct'', ''AntiSpywareProduct'', which helps - to focus on potentially malicious or suspicious queries. The detection is important - because it indicates malicious activity since attackers use WMI to run commands, - gather information, or maintain persistence within a compromised system. False positives - might occur since legitimate uses of WMI event subscriptions in the environment - might trigger benign activities to be flagged. Therefore, an extensive triage is - necessary to review the specific query and assess its intent. Additionally, capturing - and inspecting relevant on-disk artifacts and analyzing concurrent processes can - help to identify the source of the attack. Detecting the creation of these event - subscriptions to identify potential threats early and take appropriate actions to - mitigate the risks.' +description: |- + This analytic detects the creation of WMI temporary event subscriptions. WMI (Windows Management Instrumentation) is a management technology that allows administrators to perform various tasks on Windows-based systems. Temporary event subscriptions are created to monitor specific events or changes on a system that help to detect potential threats early and take proactive measures to protect the organization's systems and data. + The detection is made by using the Splunk query `wmi` EventCode=5860 Temporary to search for events with EventCode 5860, which indicates the creation of a temporary WMI event subscription. To further refine the search results, the query uses regular expressions (rex) to extract the query used in the event subscription. Then, it filters known benign queries related to system processes such as 'wsmprovhost.exe' and 'AntiVirusProduct', 'FirewallProduct', 'AntiSpywareProduct', which helps to focus on potentially malicious or suspicious queries. The detection is important because it indicates malicious activity since attackers use WMI to run commands, gather information, or maintain persistence within a compromised system. False positives might occur since legitimate uses of WMI event subscriptions in the environment might trigger benign activities to be flagged. Therefore, an extensive triage is necessary to review the specific query and assess its intent. Additionally, capturing and inspecting relevant on-disk artifacts and analyzing concurrent processes can help to identify the source of the attack. Detecting the creation of these event subscriptions to identify potential threats early and take appropriate actions to mitigate the risks. data_source: - Sysmon Event ID 5 search: '`wmi` EventCode=5860 Temporary | rex field=Message "NotificationQuery =\s+(?[^;|^$]+)" diff --git a/detections/network/detect_windows_dns_sigred_via_zeek.yml b/detections/network/detect_windows_dns_sigred_via_zeek.yml index 7131a73254..e445b0ff41 100644 --- a/detections/network/detect_windows_dns_sigred_via_zeek.yml +++ b/detections/network/detect_windows_dns_sigred_via_zeek.yml @@ -5,20 +5,8 @@ date: '2020-07-28' author: Shannon Davis, Splunk status: experimental type: TTP -description: This analytic detects the presence of SIGRed, a critical DNS vulnerability, - using Zeek DNS and Zeek Conn data. SIGRed vulnerability allows attackers to run - remote code on Windows DNS servers. By detecting SIGRed early, you can prevent further - damage and protect the organization's network infrastructure. The detection is made - by identifying specific DNS query types (SIG and KEY) in the Zeek DNS data and checks - for high data transfer in the Zeek Conn data. If multiple instances of these indicators - are found within a flow, it suggests the presence of SIGRed. The detection is important - because it indicates a potential compromise of Windows DNS servers that suggests - that an attacker might have gained unauthorized access to the DNS server and can - run arbitrary code. The impact of this attack can be severe, leading to data exfiltration, - unauthorized access, or disruption of critical services. Next steps include investigating - the affected flow and taking immediate action to mitigate the vulnerability. This - can involve patching the affected DNS server, isolating the server from the network, - or conducting a forensic analysis to determine the extent of the compromise. +description: |- + This analytic detects the presence of SIGRed, a critical DNS vulnerability, using Zeek DNS and Zeek Conn data. SIGRed vulnerability allows attackers to run remote code on Windows DNS servers. By detecting SIGRed early, you can prevent further damage and protect the organization's network infrastructure. The detection is made by identifying specific DNS query types (SIG and KEY) in the Zeek DNS data and checks for high data transfer in the Zeek Conn data. If multiple instances of these indicators are found within a flow, it suggests the presence of SIGRed. The detection is important because it indicates a potential compromise of Windows DNS servers that suggests that an attacker might have gained unauthorized access to the DNS server and can run arbitrary code. The impact of this attack can be severe, leading to data exfiltration, unauthorized access, or disruption of critical services. Next steps include investigating the affected flow and taking immediate action to mitigate the vulnerability. This can involve patching the affected DNS server, isolating the server from the network, or conducting a forensic analysis to determine the extent of the compromise. data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where DNS.query_type IN (SIG,KEY) by DNS.flow_id | rename DNS.flow_id as flow_id diff --git a/detections/network/detect_zerologon_via_zeek.yml b/detections/network/detect_zerologon_via_zeek.yml index 4d7b46231b..0dcb12559a 100644 --- a/detections/network/detect_zerologon_via_zeek.yml +++ b/detections/network/detect_zerologon_via_zeek.yml @@ -5,23 +5,8 @@ date: '2020-09-15' author: Shannon Davis, Splunk status: experimental type: TTP -description: As a prerequisite, ensure that you are ingesting Zeek logs that contain - RPC activity. This analytic detects attempts to exploit the Zerologon CVE-2020-1472 - vulnerability through Zeek RPC. By detecting attempts to exploit the Zerologon vulnerability - through Zeek RPC, SOC analysts can identify potential threats earlier and take appropriate - action to mitigate the risks. This detection is made by a Splunk query that looks - for specific Zeek RPC operations, including NetrServerPasswordSet2, NetrServerReqChallenge, - and NetrServerAuthenticate3, which are aggregated by source and destination IP address - and time. This detection is important because it suggests that an attacker is attempting - to exploit the Zerologon vulnerability to gain unauthorized access to the domain - controller. Zerologon vulnerability is a critical vulnerability that allows attackers - to take over domain controllers without authentication, leading to a complete takeover - of an organization's IT infrastructure. The impact of such an attack can be severe, - potentially leading to data theft, ransomware, or other devastating outcomes. False - positives might occur since legitimate Zeek RPC activity can trigger the analytic. - Next steps include reviewing the identified source and destination IP addresses - and the specific RPC operations used. Capture and inspect any relevant on-disk artifacts, - and review concurrent processes to identify the attack source upon triage . +description: |- + As a prerequisite, ensure that you are ingesting Zeek logs that contain RPC activity. This analytic detects attempts to exploit the Zerologon CVE-2020-1472 vulnerability through Zeek RPC. By detecting attempts to exploit the Zerologon vulnerability through Zeek RPC, SOC analysts can identify potential threats earlier and take appropriate action to mitigate the risks. This detection is made by a Splunk query that looks for specific Zeek RPC operations, including NetrServerPasswordSet2, NetrServerReqChallenge, and NetrServerAuthenticate3, which are aggregated by source and destination IP address and time. This detection is important because it suggests that an attacker is attempting to exploit the Zerologon vulnerability to gain unauthorized access to the domain controller. Zerologon vulnerability is a critical vulnerability that allows attackers to take over domain controllers without authentication, leading to a complete takeover of an organization's IT infrastructure. The impact of such an attack can be severe, potentially leading to data theft, ransomware, or other devastating outcomes. False positives might occur since legitimate Zeek RPC activity can trigger the analytic. Next steps include reviewing the identified source and destination IP addresses and the specific RPC operations used. Capture and inspect any relevant on-disk artifacts, and review concurrent processes to identify the attack source upon triage . data_source: [] search: '`zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) | bin span=5m _time | stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) diff --git a/detections/network/smb_traffic_spike.yml b/detections/network/smb_traffic_spike.yml index 38fa91dcd7..fda2f3e8e2 100644 --- a/detections/network/smb_traffic_spike.yml +++ b/detections/network/smb_traffic_spike.yml @@ -5,21 +5,8 @@ date: '2020-07-22' author: David Dorsey, Splunk status: experimental type: Anomaly -description: This analytic detects spikes in the number of Server Message Block (SMB) - traffic connections. SMB is a network protocol used for sharing files, printers, - and other resources between computers. This detection is made by a Splunk query - that looks for SMB traffic connections on ports 139 and 445, as well as connections - using the SMB application. The query calculates the average and standard deviation - of the number of SMB connections over the past 70 minutes, and identifies any sources - that exceed two standard deviations from the average. This helps to filter out false - positives caused by normal fluctuations in SMB traffic. This detection is important - because it identifies potential SMB-based attacks, such as ransomware or data theft, - which often involve a large number of SMB connections. This suggests that an attacker - is attempting to exfiltrate data or spread malware within the network. Next steps - include investigating the source of the traffic and determining if it is malicious. - This can involve reviewing network logs, capturing and analyzing any relevant network - packets, and correlating with other security events to identify the attack source - and mitigate the risk. +description: |- + This analytic detects spikes in the number of Server Message Block (SMB) traffic connections. SMB is a network protocol used for sharing files, printers, and other resources between computers. This detection is made by a Splunk query that looks for SMB traffic connections on ports 139 and 445, as well as connections using the SMB application. The query calculates the average and standard deviation of the number of SMB connections over the past 70 minutes, and identifies any sources that exceed two standard deviations from the average. This helps to filter out false positives caused by normal fluctuations in SMB traffic. This detection is important because it identifies potential SMB-based attacks, such as ransomware or data theft, which often involve a large number of SMB connections. This suggests that an attacker is attempting to exfiltrate data or spread malware within the network. Next steps include investigating the source of the traffic and determining if it is malicious. This can involve reviewing network logs, capturing and analyzing any relevant network packets, and correlating with other security events to identify the attack source and mitigate the risk. data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb diff --git a/detections/web/sql_injection_with_long_urls.yml b/detections/web/sql_injection_with_long_urls.yml index 63d2da3334..e39eb81544 100644 --- a/detections/web/sql_injection_with_long_urls.yml +++ b/detections/web/sql_injection_with_long_urls.yml @@ -5,27 +5,9 @@ date: '2022-03-28' author: Bhavin Patel, Splunk status: experimental type: TTP -description: 'This analytic detects long URLs that contain multiple SQL commands. - A proactive approach helps to detect and respond to potential threats earlier, mitigating - the risks associated with SQL injection attacks. This detection is made by a Splunk - query that searches for web traffic data where the destination category is a web - server and the URL length is greater than 1024 characters or the HTTP user agent - length is greater than 200 characters. This detection is important because it suggests - that an attacker is attempting to exploit a web application through SQL injection. - SQL injection is a common technique used by attackers to exploit vulnerabilities - in web applications and gain unauthorized access to databases. Attackers can insert - malicious SQL commands into a URL to manipulate the application''s database and - retrieve sensitive information or modify data. The impact of a successful SQL injection - attack can be severe, potentially leading to data breaches, unauthorized access, - and even complete compromise of the affected system. False positives might occur - since the legitimate use of web applications or specific URLs in your environment - can trigger the detection. Therefore, you must review and validate any alerts generated - by this analytic before taking any action. - - Next steps include reviewing the source and destination of the web traffic, as well - as the specific URL and HTTP user agent. Additionally, capture and analyze any relevant - on-disk artifacts and review concurrent processes to determine the source of the - attack.' +description: |- + This analytic detects long URLs that contain multiple SQL commands. A proactive approach helps to detect and respond to potential threats earlier, mitigating the risks associated with SQL injection attacks. This detection is made by a Splunk query that searches for web traffic data where the destination category is a web server and the URL length is greater than 1024 characters or the HTTP user agent length is greater than 200 characters. This detection is important because it suggests that an attacker is attempting to exploit a web application through SQL injection. SQL injection is a common technique used by attackers to exploit vulnerabilities in web applications and gain unauthorized access to databases. Attackers can insert malicious SQL commands into a URL to manipulate the application's database and retrieve sensitive information or modify data. The impact of a successful SQL injection attack can be severe, potentially leading to data breaches, unauthorized access, and even complete compromise of the affected system. False positives might occur since the legitimate use of web applications or specific URLs in your environment can trigger the detection. Therefore, you must review and validate any alerts generated by this analytic before taking any action. + Next steps include reviewing the source and destination of the web traffic, as well as the specific URL and HTTP user agent. Additionally, capture and analyze any relevant on-disk artifacts and review concurrent processes to determine the source of the attack. data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Web where Web.dest_category=web_server AND (Web.url_length > 1024 OR Web.http_user_agent_length diff --git a/detections/web/supernova_webshell.yml b/detections/web/supernova_webshell.yml index 0e877752d2..f8afaff317 100644 --- a/detections/web/supernova_webshell.yml +++ b/detections/web/supernova_webshell.yml @@ -5,20 +5,8 @@ date: '2021-01-06' author: John Stoner, Splunk status: experimental type: TTP -description: This analytic detects the presence of the Supernova webshell, which was - used in the SUNBURST attack. This webshell can be used by attackers to gain unauthorized - access to a compromised system and run arbitrary code. This detection is made by - a Splunk query that searches for specific patterns in web URLs, including "*logoimagehandler.ashx*codes*", - "*logoimagehandler.ashx*clazz*", "*logoimagehandler.ashx*method*", and "*logoimagehandler.ashx*args*". - These patterns are commonly used by the Supernova webshell to communicate with its - command and control server. This detection is important because it indicates a potential - compromise and unauthorized access to the system to run arbitrary code, which can - lead to data theft, ransomware, or other damaging outcomes. False positives might - occur since the patterns used by the webshell can also be present in legitimate - web traffic. In such cases, tune the search to the specific environment and monitor - it closely for any suspicious activity. Next steps include reviewing the web URLs - and inspecting any relevant on-disk artifacts. Additionally, review concurrent processes - and network connections to identify the source of the attack. +description: |- + This analytic detects the presence of the Supernova webshell, which was used in the SUNBURST attack. This webshell can be used by attackers to gain unauthorized access to a compromised system and run arbitrary code. This detection is made by a Splunk query that searches for specific patterns in web URLs, including "*logoimagehandler.ashx*codes*", "*logoimagehandler.ashx*clazz*", "*logoimagehandler.ashx*method*", and "*logoimagehandler.ashx*args*". These patterns are commonly used by the Supernova webshell to communicate with its command and control server. This detection is important because it indicates a potential compromise and unauthorized access to the system to run arbitrary code, which can lead to data theft, ransomware, or other damaging outcomes. False positives might occur since the patterns used by the webshell can also be present in legitimate web traffic. In such cases, tune the search to the specific environment and monitor it closely for any suspicious activity. Next steps include reviewing the web URLs and inspecting any relevant on-disk artifacts. Additionally, review concurrent processes and network connections to identify the source of the attack. data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Web.Web where web.url=*logoimagehandler.ashx*codes* OR Web.url=*logoimagehandler.ashx*clazz* OR From c66894787371cd1d8d1dac6d568f2cccf87d5b14 Mon Sep 17 00:00:00 2001 From: ljstella Date: Wed, 4 Oct 2023 18:06:19 -0500 Subject: [PATCH 03/37] Add lower to evals --- .../contentctl_infrastructure/builder/backend_splunk_ba.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index b6d745b595..fdeebb6c0f 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -110,7 +110,7 @@ $main = from source parent = new_val i = i + 1 continue - parser_str = '| eval ' + new_val + ' = ' + parent + '.' + val + ' ' + parser_str = '| eval ' + new_val + ' = ' + 'lower(' + parent + '.' + val + ') ' detection_str = detection_str + parser_str parsed_fields.append(new_val) parent = new_val From f512d5dab8f9de753549c69d9b31ad4568d58937 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 5 Oct 2023 08:16:26 -0700 Subject: [PATCH 04/37] convert sigma values to lowercase --- .../builder/backend_splunk_ba.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index fdeebb6c0f..a9f362ffc7 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -67,6 +67,7 @@ class SplunkBABackend(TextQueryBackend): wildcard_match_expression : ClassVar[Optional[str]] = "{field} LIKE {value}" + def __init__(self, processing_pipeline: Optional["sigma.processing.pipeline.ProcessingPipeline"] = None, collect_errors: bool = False, min_time : str = "-30d", max_time : str = "now", detection : Detection = None, field_mapping: dict = None, **kwargs): super().__init__(processing_pipeline, collect_errors, **kwargs) self.min_time = min_time or "-30d" @@ -116,7 +117,19 @@ $main = from source parent = new_val i = i + 1 - detection_str = detection_str + "| where " + query + ### Convert sigma values into lower case + lower_query = "" + in_quotes = False + for char in query: + if char == '"': + in_quotes = not in_quotes + if in_quotes: + lower_query += char.lower() + else: + lower_query += char + + detection_str = detection_str + "| where " + lower_query + detection_str = detection_str.replace("\\\\\\\\", "\\\\") return detection_str From c1e0211cfe282aeb76027280851e953c140fd467 Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 5 Oct 2023 16:48:53 -0500 Subject: [PATCH 05/37] launch.json config for debugging convert --- .vscode/launch.json | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.vscode/launch.json b/.vscode/launch.json index d19db00067..b8bd853f18 100644 --- a/.vscode/launch.json +++ b/.vscode/launch.json @@ -49,6 +49,15 @@ "justMyCode": true, "args": ["-p", "detections", "content_changer", "-cf", "fix_kill_chain"] }, + { + "name": "contentctl convert", + "type": "python", + "request": "launch", + "program": "${workspaceFolder}/contentctl.py", + "console": "integratedTerminal", + "justMyCode": true, + "args": ["-p", ".", "convert", "-dm", "ocsf", "-dp", "dev_ssa/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml", "-o", "ssa_detections/endpoint"] + }, { "name": "Python: Current File", "type": "python", From 6fd0f7724f91701edf3e150bf73968c6783346dd Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 5 Oct 2023 16:50:34 -0500 Subject: [PATCH 06/37] selectively lowercase eval'd fields --- .../contentctl_infrastructure/builder/backend_splunk_ba.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index a9f362ffc7..cf662bcbc5 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -111,7 +111,11 @@ $main = from source parent = new_val i = i + 1 continue - parser_str = '| eval ' + new_val + ' = ' + 'lower(' + parent + '.' + val + ') ' + new_val_spaces = new_val + "=" + if new_val_spaces not in query: + parser_str = '| eval ' + new_val + ' = ' + parent + '.' + val + ' ' + else: + parser_str = '| eval ' + new_val + ' = ' + 'lower(' + parent + '.' + val + ') ' detection_str = detection_str + parser_str parsed_fields.append(new_val) parent = new_val From d40d319dfba5271cadb445f0977d9286438f8856 Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 5 Oct 2023 16:51:23 -0500 Subject: [PATCH 07/37] Reconvert from sigma with new logic --- .../ssa___anomalous_usage_of_archive_tools.yml | 4 ++-- .../endpoint/ssa___attempt_to_delete_services.yml | 2 +- .../endpoint/ssa___attempt_to_disable_services.yml | 2 +- ...mpted_credential_dump_from_registry_via_reg_exe.yml | 2 +- .../ssa___bcdedit_failure_recovery_modification.yml | 2 +- ...ssa___clear_unallocated_sector_using_cipher_app.yml | 4 ++-- ssa_detections/endpoint/ssa___delete_a_net_user.yml | 2 +- .../endpoint/ssa___deleting_shadow_copies.yml | 2 +- .../ssa___deny_permission_using_cacls_utility.yml | 2 +- ...detect_prohibited_applications_spawning_cmd_exe.yml | 10 +++++----- .../ssa___detect_rclone_command_line_usage.yml | 2 +- .../endpoint/ssa___disable_net_user_account.yml | 2 +- .../ssa___dns_exfiltration_using_nslookup_app.yml | 2 +- ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml | 2 +- .../ssa___grant_permission_using_cacls_utility.yml | 2 +- ...___hiding_files_and_directories_with_attrib_exe.yml | 2 +- ...sa___modify_acls_permission_of_files_or_folders.yml | 2 +- ...a___office_product_spawning_windows_script_host.yml | 2 +- .../endpoint/ssa___resize_shadowstorage_volume.yml | 2 +- .../ssa___services_lolbas_execution_process_spawn.yml | 4 ++-- ...system_process_running_from_unexpected_location.yml | 2 +- .../endpoint/ssa___wbadmin_delete_system_backups.yml | 2 +- .../endpoint/ssa___wevtutil_usage_to_clear_logs.yml | 2 +- .../endpoint/ssa___wevtutil_usage_to_disable_logs.yml | 2 +- .../endpoint/ssa___windows_bits_job_persistence.yml | 2 +- .../endpoint/ssa___windows_bitsadmin_download_file.yml | 2 +- .../endpoint/ssa___windows_certutil_decode_file.yml | 3 ++- .../ssa___windows_certutil_urlcache_download.yml | 3 ++- .../ssa___windows_certutil_verifyctl_download.yml | 2 +- ...ndows_com_hijacking_inprocserver32_modification.yml | 2 +- ...ssa___windows_curl_upload_to_remote_destination.yml | 4 ++-- ..._default_group_policy_object_modified_with_gpme.yml | 6 +++--- .../ssa___windows_diskshadow_proxy_execution.yml | 4 ++-- ...___windows_execute_arbitrary_commands_with_msdt.yml | 2 +- .../endpoint/ssa___windows_findstr_gpp_discovery.yml | 2 +- ...___windows_ingress_tool_transfer_using_explorer.yml | 2 +- .../ssa___windows_lateral_tool_transfer_remcom.yml | 2 +- ...sa___windows_lolbin_binary_in_non_standard_path.yml | 2 +- .../endpoint/ssa___windows_mshta_child_process.yml | 2 +- .../endpoint/ssa___windows_mshta_command_line_url.yml | 2 +- .../ssa___windows_mshta_inline_hta_execution.yml | 2 +- .../ssa___windows_odbcconf_load_response_file.yml | 2 +- ...os_credential_dumping_with_ntdsutil_export_ntds.yml | 2 +- ...a___windows_os_credential_dumping_with_procdump.yml | 2 +- ...wershell_connect_to_internet_with_hidden_window.yml | 6 +++--- .../endpoint/ssa___windows_powershell_downloadfile.yml | 2 +- .../ssa___windows_powershell_start_bitstransfer.yml | 2 +- .../endpoint/ssa___windows_rasautou_dll_execution.yml | 2 +- .../endpoint/ssa___windows_remote_create_service.yml | 2 +- ...acccheckconsole_exe_lolbas_in_non_standard_path.yml | 2 +- ...tilities_adplus_exe_lolbas_in_non_standard_path.yml | 2 +- ...ilities_advpack_dll_lolbas_in_non_standard_path.yml | 2 +- ...s_agentexecutor_exe_lolbas_in_non_standard_path.yml | 2 +- ...es_appinstaller_exe_lolbas_in_non_standard_path.yml | 2 +- ...tilities_appvlp_exe_lolbas_in_non_standard_path.yml | 2 +- ...aspnet_compiler_exe_lolbas_in_non_standard_path.yml | 2 +- ...em_utilities_at_exe_lolbas_in_non_standard_path.yml | 2 +- ...lities_atbroker_exe_lolbas_in_non_standard_path.yml | 2 +- .../ssa___windows_rundll32_comsvcs_memory_dump.yml | 2 +- .../ssa___windows_rundll32_inline_hta_execution.yml | 2 +- .../ssa___windows_script_host_spawn_msbuild.yml | 4 ++-- .../ssa___windows_service_create_with_tscon.yml | 2 +- ...ry_proxy_execution_compiled_html_file_decompile.yml | 2 +- ...xecution_compiled_html_file_url_in_command_line.yml | 2 +- ...piled_html_file_using_infotech_storage_handlers.yml | 4 ++-- ...inary_proxy_execution_msiexec_dllregisterserver.yml | 2 +- ..._binary_proxy_execution_msiexec_remote_download.yml | 2 +- ...m_binary_proxy_execution_msiexec_unregister_dll.yml | 2 +- .../endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml | 4 ++-- 69 files changed, 87 insertions(+), 85 deletions(-) diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index f33f51c751..89cbcb2c41 100644 --- a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -11,12 +11,12 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name="WinRAR.exe" + | eval device_hostname = device.hostname | where (process_file_name="winrar.exe" OR process_file_name LIKE "7z%" OR process_file_name LIKE "winzip%") AND (actor_process_file_name LIKE "%powershell.exe" OR actor_process_file_name LIKE "%cmd.exe") --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml index c3c7cd2217..b9a6667e02 100644 --- a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml @@ -14,7 +14,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml index 60d0bb5063..66fa5684b5 100644 --- a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml @@ -14,7 +14,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index fde8461bd6..131e70cc9c 100644 --- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml index 648dc87fc4..490ccd7365 100644 --- a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml +++ b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml index 082417f901..16dc3e22df 100644 --- a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -12,13 +12,13 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="cipher.exe" - AND process_cmd_line LIKE "%/W:%" --finding_report--' + AND process_cmd_line LIKE "%/w:%" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/ssa_detections/endpoint/ssa___delete_a_net_user.yml b/ssa_detections/endpoint/ssa___delete_a_net_user.yml index 0c92f19069..cc5ba01ac0 100644 --- a/ssa_detections/endpoint/ssa___delete_a_net_user.yml +++ b/ssa_detections/endpoint/ssa___delete_a_net_user.yml @@ -15,7 +15,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___deleting_shadow_copies.yml b/ssa_detections/endpoint/ssa___deleting_shadow_copies.yml index 003b949652..c9d0b523bb 100644 --- a/ssa_detections/endpoint/ssa___deleting_shadow_copies.yml +++ b/ssa_detections/endpoint/ssa___deleting_shadow_copies.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index 3bb94bc52e..71d149d639 100644 --- a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 62afc13388..20f9a5a783 100644 --- a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -13,11 +13,11 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line + = lower(process.cmd_line) | eval actor_user = actor.user | eval actor_user_name + = actor_user.name | eval actor_process = actor.process | eval actor_process_pid + = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path + = actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name) | eval device_hostname = device.hostname | where ((actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe" diff --git a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml index 54126b3ce8..eb45e9c31c 100644 --- a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml +++ b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -16,7 +16,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___disable_net_user_account.yml b/ssa_detections/endpoint/ssa___disable_net_user_account.yml index 9ac1cb56ac..a32a119c51 100644 --- a/ssa_detections/endpoint/ssa___disable_net_user_account.yml +++ b/ssa_detections/endpoint/ssa___disable_net_user_account.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml index 42f165f747..bc5bb3bf91 100644 --- a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml @@ -15,7 +15,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml index d16c8727c3..23d23bd00c 100644 --- a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml +++ b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index f3b20295f2..9255ccb3a2 100644 --- a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml index c7a66d164b..c534286c7d 100644 --- a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 96b99a50d0..4366c9f455 100644 --- a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -15,7 +15,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml index 8f99a7f8fa..f3a7f3df3f 100644 --- a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml +++ b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml index 84a5006170..85f8458470 100644 --- a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml index 16a5caab63..d10b8607e1 100644 --- a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml +++ b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml @@ -16,11 +16,11 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name + actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name) | eval device_hostname = device.hostname | where actor_process_file_name="services.exe" AND (process_file_name="at.exe" OR process_file_name="atbroker.exe" OR process_file_name="bash.exe" OR process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" OR process_file_name="cmd.exe" diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index 0246d7e2d6..7e32155d10 100644 --- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -202,4 +202,4 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log - source: WinEventLog:Security + source: WinEventLog:Security \ No newline at end of file diff --git a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml index ade37b9816..43356595e9 100644 --- a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml +++ b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index 7924a16f66..3682c58a92 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index fea74b71fd..8441bacb19 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml index daf1f5e452..8627af7d15 100644 --- a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml +++ b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml @@ -16,7 +16,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml index 1f081b9633..b79a318cac 100644 --- a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml +++ b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml @@ -21,7 +21,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml index b29ebbf928..ed887a55b0 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml @@ -17,7 +17,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = @@ -41,6 +41,7 @@ tags: analytic_story: - Deobfuscate-Decode Files or Information - Living Off The Land + - Forest Blizzard asset_type: Endpoint confidence: 80 impact: 50 diff --git a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml index 021f54aab8..8b5ba9fb30 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml @@ -16,7 +16,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = @@ -38,6 +38,7 @@ tags: - Ingress Tool Transfer - DarkSide Ransomware - Living Off The Land + - Forest Blizzard asset_type: Endpoint confidence: 100 impact: 90 diff --git a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml index 342885f6dc..59dfceeda8 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml @@ -16,7 +16,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml index b2722a57f9..8445d72432 100644 --- a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -17,7 +17,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index 67be892bf2..fca4b9bb21 100644 --- a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -32,9 +32,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-F %" + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-f %" OR process_cmd_line LIKE "%--data %" OR process_cmd_line LIKE "%-d %" OR process_cmd_line - LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match(process_file_name, + LIKE "%--upload-file %" OR process_cmd_line LIKE "%-t %") AND match(process_file_name, /(?i)curl.exe/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml b/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml index b25cc43b1e..73fd94e27b 100644 --- a/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml +++ b/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml @@ -19,14 +19,14 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="mmc.exe" AND - process_cmd_line LIKE "%gpme.msc%") OR process_cmd_line LIKE "%31B2F340-016D-11D2-945F-00C04FB984F9%" - OR process_cmd_line LIKE "%6AC1786C-016F-11D2-945F-00C04fB984F9%" --finding_report--' + process_cmd_line LIKE "%gpme.msc%") OR process_cmd_line LIKE "%31b2f340-016d-11d2-945f-00c04fb984f9%" + OR process_cmd_line LIKE "%6ac1786c-016f-11d2-945f-00c04fb984f9%" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml index c5eebba164..54f7103cf6 100644 --- a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml @@ -15,13 +15,13 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%/s%" OR - process_cmd_line LIKE "%-S%") AND process_file_name="diskshadow.exe" --finding_report--' + process_cmd_line LIKE "%-s%") AND process_file_name="diskshadow.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml index 0af85436d8..5fc02af6f7 100644 --- a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -14,7 +14,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml b/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml index 3990d363b0..8433437906 100644 --- a/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml +++ b/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml @@ -17,7 +17,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml index bd290f26df..def9e3f480 100644 --- a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -17,7 +17,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml b/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml index 5ff0ea5241..dba9e4969f 100644 --- a/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml +++ b/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml index ccd9af5497..ffaa44bb25 100644 --- a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -14,7 +14,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml index 27226312ef..99f257d3c1 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml index aca5330bd7..e862a11d89 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml @@ -16,7 +16,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml index 5a5bee65d3..8ffe15ac19 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml @@ -14,7 +14,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml index 7922777483..7915b45b43 100644 --- a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml +++ b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml @@ -14,7 +14,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index ab807767f5..fb5718b9e9 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -20,7 +20,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml index d4ba5ce686..720650232a 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml @@ -19,7 +19,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 267fc4abc4..a5528b06f5 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -18,15 +18,15 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, - /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+/)=true --finding_report--' + OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+/)=true + --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml index 4e7323720d..d13c085e57 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml @@ -14,7 +14,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml index d7c0e9641b..cfc65c1ff4 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -16,7 +16,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml index 5b06e7fe22..83c2fadd4b 100644 --- a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml index 82a3000a0b..f1ac8cd75d 100644 --- a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml +++ b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index 8ddf0d7212..0adadd5008 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 089394a343..407dc0f73e 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index 396f7c09dd..854f3a923b 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index 3643a3c25a..e1de98319f 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index 0344c095dd..11954aaf1e 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 865e257a60..b3a2f8d92d 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index 9d2b863ad1..0a07bc7e25 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index c7972db282..7663c09e14 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index a6e598f94c..63cba40ab4 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml index bc39ea7fcf..4056532c22 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml index 2ed5d482c2..4bebb8e596 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml @@ -16,7 +16,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml index b5e78fe232..8338d2edf5 100644 --- a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml @@ -15,12 +15,12 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" + | eval device_hostname = device.hostname | where process_file_name="msbuild.exe" AND (match(actor_process_file_name, /(?i)cscript.exe/)=true OR match(actor_process_file_name, /(?i)wscript.exe/)=true) --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml index b303b0ddb8..9364de8ccc 100644 --- a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml +++ b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml @@ -18,7 +18,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 7c104da311..ec2e44126a 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -15,7 +15,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 8fe198cecf..039997a426 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -20,7 +20,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index 5070b3336c..0f79a31a04 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -23,12 +23,12 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%mk:@MSITStore:%" + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%mk:@msitstore:%" OR process_cmd_line LIKE "%its:%") AND process_file_name="hh.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index 7b90b0f9f5..ab9f6b3d83 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 60829a59b0..6d3ac426b5 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index d63f023d28..3bbd3ba13a 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -12,7 +12,7 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = diff --git a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml index f8a462ae4c..a37cea03d0 100644 --- a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -16,12 +16,12 @@ data_source: - Windows Security 4688 search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" + | eval device_hostname = device.hostname | where process_file_name="msbuild.exe" AND match(actor_process_file_name, /(?i)wmiprvse.exe/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from From 49d175146f03d3a79d99014ead20600000bbf5ae Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 6 Oct 2023 10:15:47 -0700 Subject: [PATCH 08/37] updating files and metadata --- .../detect_certipy_file_modifications.yml | 87 +++++++++++++++++++ ...on_certificates___esc1_authentication.yml} | 0 ...authentication_certificates_esc1_abuse.yml | 83 ++++++++++++++++++ 3 files changed, 170 insertions(+) create mode 100644 detections/endpoint/detect_certipy_file_modifications.yml rename detections/endpoint/{windows_steal_authentication_certificates___esc1_auth.yml => windows_steal_authentication_certificates___esc1_authentication.yml} (100%) create mode 100644 detections/endpoint/windows_steal_authentication_certificates_esc1_abuse.yml diff --git a/detections/endpoint/detect_certipy_file_modifications.yml b/detections/endpoint/detect_certipy_file_modifications.yml new file mode 100644 index 0000000000..a79f4dbad7 --- /dev/null +++ b/detections/endpoint/detect_certipy_file_modifications.yml @@ -0,0 +1,87 @@ +name: Detect Certipy File Modifications +id: 7e3df743-b1d8-4631-8fa8-bd5819688876 +version: 1 +date: '2023-06-25' +author: Steven Dick +status: production +type: TTP +description: The following analytic identifies when the attacker tool Certipy is used to enumerate Active Directory Certificate Services (AD CS) environments. The default behavior of this toolkit drops a number of file uniquely named files or file extensions related to it's information gathering and exfiltration process. +data_source: +- Windows Security 4663 +- Sysmon Event ID 11 +- Sysmon Event ID 15 +- Sysmon Event ID 26 +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime values(Processes.process_current_directory) as process_current_directory FROM datamodel=Endpoint.Processes where Processes.action="allowed" BY _time span=1h Processes.user Processes.dest Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.parent_process_name Processes.parent_process Processes.process_guid Processes.action +|`drop_dm_object_name(Processes)` +| join max=0 dest process_guid [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*_certipy.zip", "*_certipy.txt", "*_certipy.json", "*.ccache") by Filesystem.file_create_time Filesystem.process_id Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.dest +| `drop_dm_object_name(Filesystem)` +] +| fields firstTime lastTime user dest file_create_time file_name file_path parent_process_name parent_process process_name process_path process_current_directory process process_guid process_id +| where isnotnull(file_name) +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_certipy_file_modifications_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints as well as file creation or deletion events. +known_false_positives: Unknown +references: +- https://github.com/ly4k/Certipy +tags: + analytic_story: + - Windows Certificate Services + - Data Exfiltration + - Ingress Tool Transfer + asset_type: Endpoint + confidence: 90 + impact: 50 + message: Suspicious files $file_name$ related to Certipy detected on $dest$. + mitre_attack_id: + - T1649 + - T1560 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: User + role: + - Victim + - name: file_name + type: File Name + role: + - Attacker + - name: process_name + type: Process Name + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Processes.action + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.process_guid + - Filesystem.file_name + - Filesystem.file_path + - Filesystem.dest + risk_score: 45 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true \ No newline at end of file diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml similarity index 100% rename from detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml rename to detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml diff --git a/detections/endpoint/windows_steal_authentication_certificates_esc1_abuse.yml b/detections/endpoint/windows_steal_authentication_certificates_esc1_abuse.yml new file mode 100644 index 0000000000..00c075dd4a --- /dev/null +++ b/detections/endpoint/windows_steal_authentication_certificates_esc1_abuse.yml @@ -0,0 +1,83 @@ +name: Windows Steal Authentication Certificates - ESC1 Abuse +id: cbe761fc-d945-4c8c-a71d-e26d12255d32 +version: 1 +date: '2023-05-25' +author: Steven Dick +status: production +type: TTP +description: The following analytic identifies when a new certificate is requested and/or granted against the Active Directory Certificate Services (AD CS) using a Subject Alternative Name (SAN). This action by its self is not malicious, however improperly configured certificate templates can be abused to permit privilege escalation and environment compromise due to over permissive settings (AD CS ESC1) +data_source: +- Windows Security 4886 +- Windows Security 4887 +search: >- + `wineventlog_security` EventCode IN (4886,4887) Attributes="*SAN:*upn*" Attributes="*CertificateTemplate:*" + | stats count min(_time) as firstTime max(_time) as lastTime values(name) as name values(status) as status values(Subject) as ssl_subject + values(SubjectKeyIdentifier) as ssl_hash by Computer, EventCode, Requester, Attributes, RequestId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | rex field=Attributes "(?i)CertificateTemplate:(?[^\r\n]+)" + | rex field=Attributes "(?i)ccm:(?[^\r\n]+)" + | rex max_match=10 field=Attributes "(?i)(upn=(?[^\r\n&]+))" + | rex max_match=10 field=Attributes "(?i)(dns=(?[^\r\n&]+))" + | rex field=Requester "(.+\\\\)?(?[^\r\n]+)" + | eval flavor_text = case(EventCode=="4886","A suspicious certificate was requested using request ID: ".'RequestId',EventCode=="4887", "A suspicious certificate was issued using request ID: ".'RequestId'.". To revoke this certifacte use this request ID or the SSL fingerprint [".'ssl_hash'."]"), dest = upper(coalesce(req_dest_1,req_dest_2)), src = upper(coalesce(req_src,Computer)) | fields - req_* | rename Attributes as object_attrs, EventCode as signature_id, name as signature, RequestId as ssl_serial, Requester as ssl_subject_common_name| `windows_steal_authentication_certificates___esc1_abuse_filter` +how_to_implement: To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference. Recommend throttle correlation by RequestId/ssl_serial at minimum. +known_false_positives: False positives may be generated in environments where administrative users or processes are allowed to generate certificates with Subject Alternative Names. Sources or templates used in these processes may need to be tuned out for accurate function. +references: +- https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf +- https://github.com/ly4k/Certipy#esc1 +- https://pentestlaboratories.com/2021/11/08/threat-hunting-certificate-account-persistence/ +tags: + analytic_story: + - Windows Certificate Services + asset_type: Endpoint + confidence: 60 + impact: 100 + message: Possible AD CS ESC1 activity by $src_user$ - $flavor_text$ + mitre_attack_id: + - T1649 + observable: + - name: src + type: Hostname + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: src_user + type: User + role: + - Victim + - name: user + type: User + role: + - Victim + - name: ssl_hash + type: Other + role: + - Attacker + - name: ssl_serial + type: Other + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Attributes + - Computer + - EventCode + - Requester + - RequestId + risk_score: 60 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_winsecurity.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + update_timestamp: true \ No newline at end of file From a20f6b726b8b24234903487a7a6a527d1505af06 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 6 Oct 2023 15:46:36 -0400 Subject: [PATCH 09/37] adding new detection - diamond ticket --- ...s_domain_admin_impersonation_indicator.yml | 53 +++++++++++++++++++ lookups/domain_admins.csv | 2 + lookups/domain_admins.yml | 4 ++ 3 files changed, 59 insertions(+) create mode 100644 detections/endpoint/windows_domain_admin_impersonation_indicator.yml create mode 100644 lookups/domain_admins.csv create mode 100644 lookups/domain_admins.yml diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml new file mode 100644 index 0000000000..abf846d2fa --- /dev/null +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -0,0 +1,53 @@ +name: Windows Domain Admin Impersonation Indicator +id: 10381f93-6d38-470a-9c30-d25478e3bd3f +version: 1 +date: '2023-10-06' +author: Mauricio Velazco, Splunk +status: production +type: TTP +data_source: [] +description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Itss crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges. +search: ' `wineventlog_security` EventCode=4627 Logon_Type=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") + | where match(GroupMembership, "Domain Admins") + | lookup domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA + | search username = "NotDA" + | stats count by _time, TargetUserName, GroupMembership, host + | `windows_domain_admin_impersonation_indicator_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://trustedsec.com/blog/a-diamond-in-the-ruff +- https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks +- https://github.com/GhostPack/Rubeus/pull/136 +tags: + analytic_story: + - Active Directory Kerberos Attacks + asset_type: Endpoint + confidence: 100 + impact: 80 + message: $TargetUserName$ may be impersonating a Domain Administrator through a forged Kerberos ticket. + mitre_attack_id: + - T1558 + observable: + - name: TargetUserName + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 80 + required_fields: + - _time, + - EventCode + - Logon_Type + - TargetUserName + - GroupMembership + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/diamond_ticket/security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/lookups/domain_admins.csv b/lookups/domain_admins.csv new file mode 100644 index 0000000000..2f9ee7111c --- /dev/null +++ b/lookups/domain_admins.csv @@ -0,0 +1,2 @@ +username +Administrator \ No newline at end of file diff --git a/lookups/domain_admins.yml b/lookups/domain_admins.yml new file mode 100644 index 0000000000..8d7f834d7e --- /dev/null +++ b/lookups/domain_admins.yml @@ -0,0 +1,4 @@ +description: List of domain admins +filename: domain_admins.csv +name: domain_admins +case_sensitive_match: 'false' \ No newline at end of file From 1612821676f4fc6d78ddb417367039cba0572d83 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 6 Oct 2023 13:10:30 -0700 Subject: [PATCH 10/37] update for data --- detections/endpoint/detect_certipy_file_modifications.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_certipy_file_modifications.yml b/detections/endpoint/detect_certipy_file_modifications.yml index a79f4dbad7..748f345275 100644 --- a/detections/endpoint/detect_certipy_file_modifications.yml +++ b/detections/endpoint/detect_certipy_file_modifications.yml @@ -33,7 +33,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 50 - message: Suspicious files $file_name$ related to Certipy detected on $dest$. + message: Suspicious files $file_name$ related to Certipy detected on $dest$ mitre_attack_id: - T1649 - T1560 From 9a67bbd26a103d49fa4cb587430770812ba547b7 Mon Sep 17 00:00:00 2001 From: ljstella Date: Fri, 6 Oct 2023 15:54:41 -0500 Subject: [PATCH 11/37] Update two detections to use IN() --- ...ervices_lolbas_execution_process_spawn.yml | 34 ++++++-------- ...ows_lolbin_binary_in_non_standard_path.yml | 45 +++++++------------ 2 files changed, 28 insertions(+), 51 deletions(-) diff --git a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml index d10b8607e1..8c04177382 100644 --- a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml +++ b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml @@ -22,27 +22,19 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name) | eval device_hostname = device.hostname | where actor_process_file_name="services.exe" - AND (process_file_name="at.exe" OR process_file_name="atbroker.exe" OR process_file_name="bash.exe" - OR process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" OR process_file_name="cmd.exe" - OR process_file_name="cmstp.exe" OR process_file_name="dllhost.exe" OR process_file_name="dnscmd.exe" - OR process_file_name="extexport.exe" OR process_file_name="explorer.exe" OR process_file_name="forfiles.exe" - OR process_file_name="ftp.exe" OR process_file_name="gpscript.exe" OR process_file_name="hh.exe" - OR process_file_name="ie4uinit.exe" OR process_file_name="ieexec.exe" OR process_file_name="infdefaultinstall.exe" - OR process_file_name="installutil.exe" OR process_file_name="lucallbackproxy.exe" - OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe" - OR process_file_name="mmc.exe" OR process_file_name="msbuild.exe" OR process_file_name="msconfig.exe" - OR process_file_name="msdt.exe" OR process_file_name="mshta.exe" OR process_file_name="msiexec.exe" - OR process_file_name="netsh.exe" OR process_file_name="odbcconf.exe" OR process_file_name="offlinescannershell.exe" - OR process_file_name="pcwrun.exe" OR process_file_name="pcalua.exe" OR process_file_name="pnputil.exe" - OR process_file_name="presentationhost.exe" OR process_file_name="rasautou.exe" - OR process_file_name="regasm.exe" OR process_file_name="regsvcs.exe" OR process_file_name="regsvr32.exe" - OR process_file_name="register-cimprovider.exe" OR process_file_name="rundll32.exe" - OR process_file_name="runonce.exe" OR process_file_name="runscripthelper.exe" OR - process_file_name="schtasks.exe" OR process_file_name="scriptrunner.exe" OR process_file_name="settingsynchost.exe" - OR process_file_name="stordiag.exe" OR process_file_name="syncappvpublishingserver.exe" - OR process_file_name="ttdinject.exe" OR process_file_name="tttracer.exe" OR process_file_name="verclsid.exe" - OR process_file_name="wab.exe" OR process_file_name="wmic.exe" OR process_file_name="wuauclt.exe" - OR process_file_name="xwizard.exe") --finding_report--' + AND (process_file_name IN ("at.exe", "atbroker.exe", "bash.exe", "bitsadmin.exe", + "certoc.exe", "cmd.exe", "cmstp.exe", "dllhost.exe", "dnscmd.exe", "extexport.exe", + "explorer.exe", "forfiles.exe", "ftp.exe", "gpscript.exe", "hh.exe", "ie4uinit.exe", + "ieexec.exe", "infdefaultinstall.exe", "installutil.exe", "lucallbackproxy.exe", + "mavinject.exe", "microsoft.workflow.compiler.exe", "mmc.exe", "msbuild.exe", + "msconfig.exe", "msdt.exe", "mshta.exe", "msiexec.exe", "netsh.exe", "odbcconf.exe", + "offlinescannershell.exe", "pcwrun.exe", "pcalua.exe", "pnputil.exe", + "presentationhost.exe", "rasautou.exe", "regasm.exe", "regsvcs.exe", + "regsvr32.exe", "register-cimprovider.exe", "rundll32.exe", "runonce.exe", + "runscripthelper.exe", "schtasks.exe", "scriptrunner.exe", "settingsynchost.exe", + "stordiag.exe", "syncappvpublishingserver.exe", "ttdinject.exe", "tttracer.exe", + "verclsid.exe", "wab.exe", "wmic.exe", "wuauclt.exe", "xwizard.exe")) + --finding_report--' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml index ffaa44bb25..af73bc72f3 100644 --- a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -19,36 +19,21 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name="bitsadmin.exe" - OR process_file_name="certoc.exe" OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" - OR process_file_name="cmdkey.exe" OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" - OR process_file_name="configsecuritypolicy.exe" OR process_file_name="control.exe" - OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe" OR process_file_name="desktopimgdownldr.exe" - OR process_file_name="dfsvc.exe" OR process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" - OR process_file_name="dllhost.exe" OR process_file_name="dnscmd.exe" OR process_file_name="esentutl.exe" - OR process_file_name="eventvwr.exe" OR process_file_name="expand.exe" OR process_file_name="extexport.exe" - OR process_file_name="extrac32.exe" OR process_file_name="findstr.exe" OR process_file_name="finger.exe" - OR process_file_name="fltmc.exe" OR process_file_name="forfiles.exe" OR process_file_name="ftp.exe" - OR process_file_name="gfxdownloadwrapper.exe" OR process_file_name="gpscript.exe" - OR process_file_name="imewdbld.exe" OR process_file_name="ie4uinit.exe" OR process_file_name="ieexec.exe" - OR process_file_name="ilasm.exe" OR process_file_name="infdefaultinstall.exe" OR - process_file_name="makecab.exe" OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe" - OR process_file_name="mmc.exe" OR process_file_name="msconfig.exe" OR process_file_name="msdt.exe" - OR process_file_name="mshta.exe" OR process_file_name="msiexec.exe" OR process_file_name="netsh.exe" - OR process_file_name="odbcconf.exe" OR process_file_name="offlinescannershell.exe" - OR process_file_name="pcalua.exe" OR process_file_name="pcwrun.exe" OR process_file_name="pktmon.exe" - OR process_file_name="pnputil.exe" OR process_file_name="presentationhost.exe" OR - process_file_name="print.exe" OR process_file_name="printbrm.exe" OR process_file_name="psr.exe" - OR process_file_name="rasautou.exe" OR process_file_name="reg.exe" OR process_file_name="regini.exe" - OR process_file_name="register-cimprovider.exe" OR process_file_name="regsvr32.exe" - OR process_file_name="replace.exe" OR process_file_name="rpcping.exe" OR process_file_name="rundll32.exe" - OR process_file_name="runonce.exe" OR process_file_name="runscripthelper.exe" OR - process_file_name="sc.exe" OR process_file_name="schtasks.exe" OR process_file_name="scriptrunner.exe" - OR process_file_name="settingsynchost.exe" OR process_file_name="syncappvpublishingserver.exe" - OR process_file_name="ttdinject.exe" OR process_file_name="tttracer.exe" OR process_file_name="vbc.exe" - OR process_file_name="verclsid.exe" OR process_file_name="wab.exe" OR process_file_name="wlrmdr.exe" - OR process_file_name="wmic.exe" OR process_file_name="workfolders.exe" OR process_file_name="wscript.exe" - OR process_file_name="wsreset.exe" OR process_file_name="wuauclt.exe" OR process_file_name="xwizard.exe") + | eval device_hostname = device.hostname | where (process_file_name IN ("bitsadmin.exe", "certoc.exe", "certreq.exe", "certutil.exe", + "cmdkey.exe", "cmdl32.exe", "cmstp.exe", "configsecuritypolicy.exe", "control.exe", + "cscript.exe", "datasvcutil.exe", "desktopimgdownldr.exe", "dfsvc.exe", "diantz.exe", "diskshadow.exe", + "dllhost.exe", "dnscmd.exe", "esentutl.exe", "eventvwr.exe", "expand.exe", "extexport.exe", + "extrac32.exe", "findstr.exe", "finger.exe", "fltmc.exe", "forfiles.exe", "ftp.exe", + "gfxdownloadwrapper.exe", "gpscript.exe", "imewdbld.exe", "ie4uinit.exe", "ieexec.exe", + "ilasm.exe", "infdefaultinstall.exe", "makecab.exe", "mavinject.exe", "microsoft.workflow.compiler.exe", + "mmc.exe", "msconfig.exe", "msdt.exe", "mshta.exe", "msiexec.exe", "netsh.exe", + "odbcconf.exe", "offlinescannershell.exe", "pcalua.exe", "pcwrun.exe", "pktmon.exe", + "pnputil.exe", "presentationhost.exe", "print.exe", "printbrm.exe", "psr.exe", + "rasautou.exe", "reg.exe", "regini.exe", "register-cimprovider.exe", "regsvr32.exe", + "replace.exe", "rpcping.exe", "rundll32.exe", "runonce.exe", "runscripthelper.exe", "sc.exe", + "schtasks.exe", "scriptrunner.exe", "settingsynchost.exe", "syncappvpublishingserver.exe", + "ttdinject.exe", "tttracer.exe", "vbc.exe", "verclsid.exe", "wab.exe", "wlrmdr.exe", + "wmic.exe", "workfolders.exe", "wscript.exe", "wsreset.exe", "wuauclt.exe", "xwizard.exe")) AND (NOT (match(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR match(process_file_path, /(?i)(?i)\\windows\\syswow64/)=true OR match(process_file_path, /(?i)(?i)\\windows\\networkcontrolle/)=true OR match(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true OR match(process_file_path, From 3fce3dff3c347889e6668cebc833ea21e236762f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 6 Oct 2023 16:24:38 -0700 Subject: [PATCH 12/37] contentctl validate throws errors on the following playbooks. the first had an invalid uuid (improper number of characters). The second had unallowed characters in the name (underscores). I will reach out to the devs for this content to understand what implications these changes may have. --- ...G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml | 2 +- playbooks/Splunk_Attack_Analyzer_Dynamic_Analysis.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/playbooks/G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml b/playbooks/G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml index 4c7c0f0004..1cb92b64dd 100644 --- a/playbooks/G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml +++ b/playbooks/G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml @@ -1,5 +1,5 @@ name: G Suite for GMail Message Identifier Activity Analysis -id: 5299d6dd-e9c4-4afa-b051-928ace0ff816d +id: 5299d6dd-e9c4-4afa-b051-928ace0ff816 version: 1 date: '2023-05-12' author: Lou Stella, Splunk diff --git a/playbooks/Splunk_Attack_Analyzer_Dynamic_Analysis.yml b/playbooks/Splunk_Attack_Analyzer_Dynamic_Analysis.yml index 3a32316c0d..0db56f477e 100644 --- a/playbooks/Splunk_Attack_Analyzer_Dynamic_Analysis.yml +++ b/playbooks/Splunk_Attack_Analyzer_Dynamic_Analysis.yml @@ -1,4 +1,4 @@ -name: Splunk_Attack_Analyzer_Dynamic_Analysis +name: Splunk Attack Analyzer Dynamic Analysis id: c77faffe-1339-43b0-b870-86582da9063e version: 1 date: '2023-03-24' @@ -26,4 +26,4 @@ tags: - Enrichment - Phishing - Endpoint - defend_technique_id: D3-DA \ No newline at end of file + defend_technique_id: D3-DA From 7ff09049e3b377bab67e9de8eb1b075030153d80 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 6 Oct 2023 16:48:52 -0700 Subject: [PATCH 13/37] Fix the ids associated with a number of playbooks and fix incorrectly named referenced detections. Check with Playbook SME to understand the full implications of these changes. --- playbooks/log4j_investigate.yml | 2 +- playbooks/log4j_respond.yml | 2 +- playbooks/risk_notable_block_indicators.yml | 2 +- playbooks/risk_notable_enrich.yml | 2 +- playbooks/risk_notable_import_data.yml | 2 +- playbooks/risk_notable_investigate.yml | 2 +- playbooks/risk_notable_merge_events.yml | 2 +- playbooks/risk_notable_mitigate.yml | 2 +- playbooks/risk_notable_preprocess.yml | 2 +- playbooks/risk_notable_protect_assets_and_users.yml | 2 +- playbooks/risk_notable_review_indicators.yml | 2 +- playbooks/risk_notable_verdict.yml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/playbooks/log4j_investigate.yml b/playbooks/log4j_investigate.yml index 25097050bf..ef1fe43747 100644 --- a/playbooks/log4j_investigate.yml +++ b/playbooks/log4j_investigate.yml @@ -22,7 +22,7 @@ tags: - Curl Download and Bash Execution - Wget Download and Bash Execution - Linux Java Spawning Shell - - Windows Java Spawning Shell + - Windows Java Spawning Shells - Java Class File download by Java User Agent - Outbound Network Connection from Java Using Default Ports - Log4Shell JNDI Payload Injection Attempt diff --git a/playbooks/log4j_respond.yml b/playbooks/log4j_respond.yml index 01bf65e624..abf4e879f3 100644 --- a/playbooks/log4j_respond.yml +++ b/playbooks/log4j_respond.yml @@ -22,7 +22,7 @@ tags: - Curl Download and Bash Execution - Wget Download and Bash Execution - Linux Java Spawning Shell - - Windows Java Spawning Shell + - Windows Java Spawning Shells - Java Class File download by Java User Agent - Outbound Network Connection from Java Using Default Ports - Log4Shell JNDI Payload Injection Attempt diff --git a/playbooks/risk_notable_block_indicators.yml b/playbooks/risk_notable_block_indicators.yml index fef4d2fbb9..adad175212 100644 --- a/playbooks/risk_notable_block_indicators.yml +++ b/playbooks/risk_notable_block_indicators.yml @@ -1,5 +1,5 @@ name: Risk Notable Block Indicators -id: rn0edc96-ff2b-48b0-9f6f-83da3783fd63 +id: 000edc96-ff2b-48b0-9f6f-83da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_enrich.yml b/playbooks/risk_notable_enrich.yml index 12299a549d..445fc87919 100644 --- a/playbooks/risk_notable_enrich.yml +++ b/playbooks/risk_notable_enrich.yml @@ -1,5 +1,5 @@ name: Risk Notable Enrich -id: rn0edc96-ff2b-48b0-9f6f-43da3783fd63 +id: 010edc96-ff2b-48b0-9f6f-43da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_import_data.yml b/playbooks/risk_notable_import_data.yml index 65c3f0742b..d9707adb32 100644 --- a/playbooks/risk_notable_import_data.yml +++ b/playbooks/risk_notable_import_data.yml @@ -1,5 +1,5 @@ name: Risk Notable Import Data -id: rn0edc96-ff2b-48b0-9f6f-23da3783fd63 +id: 020edc96-ff2b-48b0-9f6f-23da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_investigate.yml b/playbooks/risk_notable_investigate.yml index ebbf5249a5..5c67101e47 100644 --- a/playbooks/risk_notable_investigate.yml +++ b/playbooks/risk_notable_investigate.yml @@ -1,5 +1,5 @@ name: Risk Notable Investigate -id: rn0edc96-ff2b-48b0-9f6f-03da3783fd63 +id: 030edc96-ff2b-48b0-9f6f-03da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_merge_events.yml b/playbooks/risk_notable_merge_events.yml index 05f6f92824..f294e78cd7 100644 --- a/playbooks/risk_notable_merge_events.yml +++ b/playbooks/risk_notable_merge_events.yml @@ -1,5 +1,5 @@ name: Risk Notable Merge Events -id: rn0edc96-ff2b-48b0-9f6f-53da3783fd63 +id: 040edc96-ff2b-48b0-9f6f-53da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_mitigate.yml b/playbooks/risk_notable_mitigate.yml index 6a57ba6f14..c3a547cf0a 100644 --- a/playbooks/risk_notable_mitigate.yml +++ b/playbooks/risk_notable_mitigate.yml @@ -1,5 +1,5 @@ name: Risk Notable Mitigate -id: rn0edc96-ff2b-48b0-9f6f-63da3783fd63 +id: 050edc96-ff2b-48b0-9f6f-63da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_preprocess.yml b/playbooks/risk_notable_preprocess.yml index d3d0c9b9cf..d48961a068 100644 --- a/playbooks/risk_notable_preprocess.yml +++ b/playbooks/risk_notable_preprocess.yml @@ -1,5 +1,5 @@ name: Risk Notable Preprocess -id: rn0edc96-ff2b-48b0-9f6f-13da3783fd63 +id: 060edc96-ff2b-48b0-9f6f-13da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_protect_assets_and_users.yml b/playbooks/risk_notable_protect_assets_and_users.yml index 4429c9bf1b..276fa1389e 100644 --- a/playbooks/risk_notable_protect_assets_and_users.yml +++ b/playbooks/risk_notable_protect_assets_and_users.yml @@ -1,5 +1,5 @@ name: Risk Notable Protect Assets and Users -id: rn0edc96-ff2b-48b0-9f6f-93da3783fd63 +id: 070edc96-ff2b-48b0-9f6f-93da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_review_indicators.yml b/playbooks/risk_notable_review_indicators.yml index 446aa2a2c6..e0319e9607 100644 --- a/playbooks/risk_notable_review_indicators.yml +++ b/playbooks/risk_notable_review_indicators.yml @@ -1,5 +1,5 @@ name: Risk Notable Review Indicators -id: rn0edc96-ff2b-48b0-9f6f-73da3783fd63 +id: 080edc96-ff2b-48b0-9f6f-73da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk diff --git a/playbooks/risk_notable_verdict.yml b/playbooks/risk_notable_verdict.yml index a8b06dd070..4f394d6f71 100644 --- a/playbooks/risk_notable_verdict.yml +++ b/playbooks/risk_notable_verdict.yml @@ -1,5 +1,5 @@ name: Risk Notable Verdict -id: rn0edc96-ff2b-48b0-9f6f-33da3783fd63 +id: 090edc96-ff2b-48b0-9f6f-33da3783fd63 version: 1 date: "2021-10-22" author: Kelby Shelton, Splunk From 6ba29754a6e7e6cb35386da4142c3d679d69182c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 6 Oct 2023 17:03:13 -0700 Subject: [PATCH 14/37] Meaningless commit to the release branch so that we can open a PR --- contentctl.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contentctl.py b/contentctl.py index ccee1712d6..8229a6e7c7 100644 --- a/contentctl.py +++ b/contentctl.py @@ -1,6 +1,6 @@ import sys import argparse -import os +import os from bin.contentctl_project.contentctl_core.domain.entities.link_validator import LinkValidator From f6786d9dcd4da65447617d1beb3f3d64c14361b4 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 9 Oct 2023 11:45:21 -0400 Subject: [PATCH 15/37] fixing detection --- .../endpoint/windows_domain_admin_impersonation_indicator.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index abf846d2fa..fed9c00272 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -7,7 +7,7 @@ status: production type: TTP data_source: [] description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Itss crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges. -search: ' `wineventlog_security` EventCode=4627 Logon_Type=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") +search: ' `wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") | where match(GroupMembership, "Domain Admins") | lookup domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA | search username = "NotDA" From 92b6c09fc558b2fbaf720e700ad16c1b72098c65 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 9 Oct 2023 13:52:36 -0400 Subject: [PATCH 16/37] updating detection --- .../windows_domain_admin_impersonation_indicator.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index fed9c00272..5a0323ce3e 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -6,19 +6,20 @@ author: Mauricio Velazco, Splunk status: production type: TTP data_source: [] -description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Itss crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges. +description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges. search: ' `wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") | where match(GroupMembership, "Domain Admins") | lookup domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA | search username = "NotDA" | stats count by _time, TargetUserName, GroupMembership, host | `windows_domain_admin_impersonation_indicator_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, you need to be ingesting Authentication events across all endpoints and ingest Event Id 4627. Specifically, the Audit Group Membership subcategory within the Logon Logooff category needs to be enabled. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. +known_false_positives: False positives may trigger the detections certain scenarios like directory service delays or out of date lookups. Filter as needed. references: - https://trustedsec.com/blog/a-diamond-in-the-ruff - https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks - https://github.com/GhostPack/Rubeus/pull/136 +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4627 tags: analytic_story: - Active Directory Kerberos Attacks @@ -41,7 +42,7 @@ tags: required_fields: - _time, - EventCode - - Logon_Type + - LogonType - TargetUserName - GroupMembership security_domain: endpoint From 02859139c6db6b742e5cfe805f512d241d8be3e2 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 9 Oct 2023 14:21:01 -0400 Subject: [PATCH 17/37] update detection --- .../endpoint/windows_domain_admin_impersonation_indicator.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index 5a0323ce3e..a7200981b8 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -9,7 +9,7 @@ data_source: [] description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges. search: ' `wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") | where match(GroupMembership, "Domain Admins") - | lookup domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA + | lookup domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA username | search username = "NotDA" | stats count by _time, TargetUserName, GroupMembership, host | `windows_domain_admin_impersonation_indicator_filter`' From 3e07515de2c0a13ac26fd5810237adb1cc9ced54 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 9 Oct 2023 15:14:35 -0400 Subject: [PATCH 18/37] adding analytic story --- .../endpoint/windows_domain_admin_impersonation_indicator.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index a7200981b8..c82d90909a 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -23,6 +23,7 @@ references: tags: analytic_story: - Active Directory Kerberos Attacks + - Active Directory Privilege Escalation asset_type: Endpoint confidence: 100 impact: 80 From 63c370e7483050439c75abb0c334316256ca43b7 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 10 Oct 2023 14:13:09 -0600 Subject: [PATCH 19/37] Sip Happens: Stirring Up the Crypto with a New Module --- .../windows_sip_provider_inventory.yml | 45 +++++++++++++++++++ ...trols_sip_and_trust_provider_hijacking.yml | 23 ++++++++++ 2 files changed, 68 insertions(+) create mode 100644 detections/endpoint/windows_sip_provider_inventory.yml create mode 100644 stories/subvert_trust_controls_sip_and_trust_provider_hijacking.yml diff --git a/detections/endpoint/windows_sip_provider_inventory.yml b/detections/endpoint/windows_sip_provider_inventory.yml new file mode 100644 index 0000000000..35f7ca565f --- /dev/null +++ b/detections/endpoint/windows_sip_provider_inventory.yml @@ -0,0 +1,45 @@ +name: Windows SIP Provider Inventory +id: 21c5af91-1a4a-4511-8603-64fb41df3fad +version: 1 +date: '2023-10-10' +author: Michael Haag, Splunk +status: production +type: Hunting +data_source: [] +description: The following inventory analytic is used with a PowerShell scripted inputs to capture all SIP providers on a Windows system. This analytic is used to identify potential malicious SIP providers that may be used to subvert trust controls. Upon review, look for new and non-standard paths for SIP providers. +search: 'sourcetype = PwSh:SubjectInterfacePackage Dll=*\\*.dll | stats count min(_time) as firstTime max(_time) as lastTime values(Dll) by Path host| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_sip_provider_inventory_filter`' +how_to_implement: To implement this analytic, one must first perform inventory using a scripted inputs. Review the following Gist - https://gist.github.com/MHaggis/75dd5db546c143ea67703d0e86cdbbd1 +known_false_positives: False positives are limited as this is a hunting query for inventory. +references: +- https://gist.github.com/MHaggis/75dd5db546c143ea67703d0e86cdbbd1 +tags: + analytic_story: + - Subvert Trust Controls SIP and Trust Provider Hijacking + asset_type: endpoint + atomic_guid: [] + confidence: 50 + impact: 50 + message: A list of SIP providers on the system is available. Review for new and non-standard paths for SIP providers on $host$. + mitre_attack_id: + - T1553.003 + observable: + - name: host + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 25 + required_fields: + - Path + - Dll + - host + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.003/sip/sip_inventory.log + source: powershell://SubjectInterfacePackage + sourcetype: PwSh:SubjectInterfacePackage diff --git a/stories/subvert_trust_controls_sip_and_trust_provider_hijacking.yml b/stories/subvert_trust_controls_sip_and_trust_provider_hijacking.yml new file mode 100644 index 0000000000..f64d517261 --- /dev/null +++ b/stories/subvert_trust_controls_sip_and_trust_provider_hijacking.yml @@ -0,0 +1,23 @@ +name: Subvert Trust Controls SIP and Trust Provider Hijacking +id: 7faf91b6-532a-4f18-807c-b2761e90b6dc +version: 1 +date: '2023-10-10' +author: Michael Haag, Splunk +description: Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. This technique involves modifying the Dll and FuncName Registry values that point to the dynamic link library (DLL) providing a SIP's function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value, an adversary can apply an acceptable signature value to all files using that SIP. This can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. +narrative: In user mode, Windows Authenticode digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code. The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats and are identified by globally unique identifiers (GUIDs). Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed. +references: + - https://attack.mitre.org/techniques/T1553/003/ + - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_sip_persistence.yml + - https://specterops.io/wp-content/uploads/sites/3/2022/06/SpecterOps_Subverting_Trust_in_Windows.pdf + - https://github.com/gtworek/PSBits/tree/master/SIP + - https://github.com/mattifestation/PoCSubjectInterfacePackage + - https://pentestlab.blog/2017/11/06/hijacking-digital-signatures/ +tags: + analytic_story: Subvert Trust Controls SIP and Trust Provider Hijacking + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From a1315040eebd2219bd754e1fa90c0221fb988d4a Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 10 Oct 2023 14:27:49 -0600 Subject: [PATCH 20/37] Create windows_registry_sip_provider_modification.yml --- ...ows_registry_sip_provider_modification.yml | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 detections/endpoint/windows_registry_sip_provider_modification.yml diff --git a/detections/endpoint/windows_registry_sip_provider_modification.yml b/detections/endpoint/windows_registry_sip_provider_modification.yml new file mode 100644 index 0000000000..31989a1550 --- /dev/null +++ b/detections/endpoint/windows_registry_sip_provider_modification.yml @@ -0,0 +1,56 @@ +name: 'Windows Registry SIP Provider Modification' +id: 3b4e18cb-497f-4073-85ad-1ada7c2107ab +version: 1 +date: '2023-10-10' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 7 +description: 'The following analytic detects modifications to the Windows Registry SIP Provider. It identifies this behavior by monitoring Sysmon Event ID 7, which logs registry modification events. The analytic specifically looks for changes in registry paths and values associated with Cryptography Providers and OID Encoding Types. This behavior is worth identifying as it may indicate an attempt to subvert trust controls, a technique often used by adversaries to bypass security measures and maintain persistence in an environment. If a true positive is found, it suggests an attacker is trying to manipulate the system''s cryptographic functions, potentially leading to unauthorized access, data theft, or other damaging outcomes. Upon triage, review the registry paths and values modified, and look for concurrent processes to identify the attack source. Review the path of the SIP being added. This approach helps analysts detect potential threats earlier and mitigate the risks.' +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Cryptography\\Providers\\*", "*\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType*", "*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\Providers\\*", "*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType*") Registry.registry_value_name IN ("Dll","$DLL") by + Registry.dest , Registry.user Registry.registry_value_name, Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)`| `windows_registry_sip_provider_modification_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: Be aware of potential false positives - legitimate applications may cause benign activities to be flagged. +references: + - https://attack.mitre.org/techniques/T1553/003/ + - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_sip_persistence.yml + - https://specterops.io/wp-content/uploads/sites/3/2022/06/SpecterOps_Subverting_Trust_in_Windows.pdf + - https://github.com/gtworek/PSBits/tree/master/SIP + - https://github.com/mattifestation/PoCSubjectInterfacePackage + - https://pentestlab.blog/2017/11/06/hijacking-digital-signatures/ +tags: + analytic_story: + - Subvert Trust Controls SIP and Trust Provider Hijacking + asset_type: endpoint + atomic_guid: [] + confidence: 80 + impact: 80 + message: Windows Registry SIP Provider Modification detected on $dest$. + mitre_attack_id: + - T1553.003 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_value_data + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.003/sip/sip_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From 981ef0caf9ea66d502c0d0d4508bc6afc4dc0c1b Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 10 Oct 2023 16:26:22 -0600 Subject: [PATCH 21/37] Trust this --- ...winverifytrust_failed_trust_validation.yml | 52 +++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 detections/endpoint/windows_sip_winverifytrust_failed_trust_validation.yml diff --git a/detections/endpoint/windows_sip_winverifytrust_failed_trust_validation.yml b/detections/endpoint/windows_sip_winverifytrust_failed_trust_validation.yml new file mode 100644 index 0000000000..598a06c38c --- /dev/null +++ b/detections/endpoint/windows_sip_winverifytrust_failed_trust_validation.yml @@ -0,0 +1,52 @@ +name: Windows SIP WinVerifyTrust Failed Trust Validation +id: 6ffc7f88-415b-4278-a80d-b957d6539e1a +version: 1 +date: '2023-10-10' +author: Michael Haag, Splunk +status: production +type: Anomaly +data_source: [] +description: The following analytic utilizes a Windows Event Log - CAPI2 - or CryptoAPI 2, to identify failed trust validation. Typically, this event log is meant for diagnosing PKI issues, however is a great source to identify failed trust validation. Note that this event log is noisy as it captures common PKI requests from many different processes. EventID 81 is generated anytime a trust validation fails. The description for EventID 81 is "The digital signature of the object did not verify." STRT tested this analytic using Mimikatz binary. +search: '`capi2_operational` EventID=81 "The digital signature of the object did not verify." | xmlkv UserData_Xml | stats count min(_time) as firstTime max(_time) as lastTime by Computer, UserData_Xml | rename Computer as dest | `windows_sip_winverifytrust_failed_trust_validation_filter`' +how_to_implement: To implement this analytic, one will need to enable the Microsoft-Windows-CAPI2/Operational + log within the Windows Event Log. Note this is a debug log for many purposes, and + the analytic only focuses in on EventID 81. Review the following gist for additional + enabling information. +known_false_positives: False positives may be present in some instances of legitimate binaries with invalid signatures. Filter as needed. +references: + - https://attack.mitre.org/techniques/T1553/003/ + - https://specterops.io/wp-content/uploads/sites/3/2022/06/SpecterOps_Subverting_Trust_in_Windows.pdf + - https://github.com/gtworek/PSBits/tree/master/SIP + - https://github.com/mattifestation/PoCSubjectInterfacePackage + - https://pentestlab.blog/2017/11/06/hijacking-digital-signatures/ +tags: + analytic_story: + - Subvert Trust Controls SIP and Trust Provider Hijacking + asset_type: endpoint + atomic_guid: [] + confidence: 80 + impact: 80 + message: Failed trust validation via the CryptoAPI 2 on $dest$ for a binary. + mitre_attack_id: + - T1553.003 + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - _time + - Computer + - UserData_Xml + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.003/sip/capi2-operational.log + source: XmlWinEventLog:Microsoft-Windows-CAPI2/Operational + sourcetype: xmlwineventlog From 724221f82b33d620ab63cd34425fc41cdfcce9e8 Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Tue, 10 Oct 2023 19:29:33 -0700 Subject: [PATCH 22/37] Manually update the .yml --- ...ged_role_assigned_to_service_principal.yml | 9 +-------- detections/cloud/github_dependabot_alert.yml | 4 +--- .../github_pull_request_from_unknown_user.yml | 20 +------------------ .../endpoint/common_ransomware_extensions.yml | 11 +--------- .../create_remote_thread_into_lsass.yml | 4 +--- ...ping_via_copy_command_from_shadow_copy.yml | 19 +----------------- ...aron_samedit_cve_2021_3156_via_osquery.yml | 19 +----------------- ...omain_controller_audit_policy_disabled.yml | 14 +------------ .../wmi_temporary_event_subscription.yml | 4 +--- ...t_windows_dns_sigred_via_splunk_stream.yml | 16 +-------------- .../web/sql_injection_with_long_urls.yml | 4 +--- 11 files changed, 11 insertions(+), 113 deletions(-) diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml index 308e54d719..b060963ab9 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml @@ -5,14 +5,7 @@ date: '2023-04-28' author: Mauricio Velazco, Splunk status: production type: TTP -description: "This analytic detects potential privilege escalation threats in Azure\ - \ Active Directory (AD). The detection is made by running a specific search within\ - \ the ingested Azure Active Directory events to leverage the AuditLogs log category.\ - \ \nThis detection is important because it identifies instances where privileged\ - \ roles that hold elevated permissions are assigned to service principals. This\ - \ prevents unauthorized access or malicious activities, which occur when these non-human\ - \ entities access Azure resources to exploit them. False positives might occur since\ - \ administrators can legitimately assign privileged roles to service principals." +description: "This analytic detects potential privilege escalation threats in Azure Active Directory (AD). The detection is made by running a specific search within the ingested Azure Active Directory events to leverage the AuditLogs log category. This detection is important because it identifies instances where privileged roles that hold elevated permissions are assigned to service principals. This prevents unauthorized access or malicious activities, which occur when these non-human entities access Azure resources to exploit them. False positives might occur since administrators can legitimately assign privileged roles to service principals." data_source: [] search: ' `azuread` operationName="Add member to role" | rename properties.* as * | search "targetResources{}.type"=ServicePrincipal | rename initiatedBy.user.userPrincipalName diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index 54305304f6..b228bffe01 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -5,9 +5,7 @@ date: '2021-09-01' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: |- - As a prerequisite, ensure that you ingest Github logs that contain information about Dependabot Alerts. This analytic detects Dependabot Alerts in Github logs. - The detection is made by first searching for logs that contain the action ""create"" and renames certain fields for easier analysis. Then, this analytic uses the ""stats"" command to calculate the first and last occurrence of the alert based on the timestamp. The fields included in the output are the action, affected package name, affected range, created date, external identifier, external reference, fixed version, severity, repository, repository URL, and user. The ""phase"" field is set to ""code"" to indicate that the alert pertains to code-related issues. The detection is important because dependabot Alerts can indicate vulnerabilities in the codebase that can be exploited by attackers. Detecting and investigating these alerts can help a SOC to proactively address security risks and prevent potential breaches or unauthorized access to sensitive information. False positives might occur since there are legitimate actions that trigger the ""create"" action or if other factors exist that can generate similar log entries. Next steps include reviewing the details of the alert, such as the affected package, severity, and fixed version to determine the appropriate response and mitigation steps. +description: "As a prerequisite, ensure that you ingest Github logs that contain information about Dependabot Alerts. This analytic detects Dependabot Alerts in Github logs. The detection is made by first searching for logs that contain the action \"create\" and renames certain fields for easier analysis. Then, this analytic uses the \"stats\" command to calculate the first and last occurrence of the alert based on the timestamp. The fields included in the output are the action, affected package name, affected range, created date, external identifier, external reference, fixed version, severity, repository, repository URL, and user. The \"phase\" field is set to \"code\" to indicate that the alert pertains to code-related issues. The detection is important because dependabot Alerts can indicate vulnerabilities in the codebase that can be exploited by attackers. Detecting and investigating these alerts can help a SOC to proactively address security risks and prevent potential breaches or unauthorized access to sensitive information. False positives might occur since there are legitimate actions that trigger the \"create\" action or if other factors exist that can generate similar log entries. Next steps include reviewing the details of the alert, such as the affected package, severity, and fixed version to determine the appropriate response and mitigation steps." data_source: [] search: '`github` alert.id=* action=create | rename repository.full_name as repository, repository.html_url as repository_url sender.login as user | stats min(_time) as diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml index 137f56bde9..25001b65f6 100644 --- a/detections/cloud/github_pull_request_from_unknown_user.yml +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -5,25 +5,7 @@ date: '2021-09-01' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: "As a prerequisite, ensure that you ingest GitHub logs into Splunk.\ - \ \nand have access to the following fields: (i)`check_suite.pull_requests` (ii)\ - \ `check_suite.head_commit.author.name`(iii) `repository.full_name` (iv) `check_suite.pull_requests.head.ref`(v)`check_suite.head_commit.message`\ - \ This analytic detects pull requests from unknown users on GitHub. The detection\ - \ is made by using a Splunk query to search for pull requests in the `check_suite.pull_requests`\ - \ field where the `id` is not specified. Next, the analytic retrieves information\ - \ such as the author's name, the repository's full name, the head reference of the\ - \ pull request, and the commit message from the `check_suite.head_commit` field.\ - \ The analytic also includes a step to exclude known users by using the `github_known_users`\ - \ lookup table, which helps to filter out pull requests from known users and focus\ - \ on the pull requests from unknown users.\nThe detection is important because it\ - \ locates potential malicious activity or unauthorized access since unknown users\ - \ can introduce malicious code or gain unauthorized access to repositories leading\ - \ to unauthorized code changes, data breaches, or other security incidents. Next\ - \ steps include reviewing the author's name, the repository involved, the head reference\ - \ of the pull request, and the commit message upon triage of a potential pull request\ - \ from an unknown user. You must also analyze any relevant on-disk artifacts and\ - \ investigate any concurrent processes to determine the source and intent of the\ - \ pull request." +description: "As a prerequisite, ensure that you ingest GitHub logs into Splunk and have access to the following fields: (i)`check_suite.pull_requests` (ii) `check_suite.head_commit.author.name` (iii) `repository.full_name` (iv) `check_suite.pull_requests.head.ref` (v) `check_suite.head_commit.message`. This analytic detects pull requests from unknown users on GitHub. The detection is made by using a Splunk query to search for pull requests in the `check_suite.pull_requests` field where the `id` is not specified. Next, the analytic retrieves information such as the author's name, the repository's full name, the head reference of the pull request, and the commit message from the `check_suite.head_commit` field. The analytic also includes a step to exclude known users by using the `github_known_users` lookup table, which helps to filter out pull requests from known users and focus on the pull requests from unknown users. The detection is important because it locates potential malicious activity or unauthorized access since unknown users can introduce malicious code or gain unauthorized access to repositories leading to unauthorized code changes, data breaches, or other security incidents. Next steps include reviewing the author's name, the repository involved, the head reference of the pull request, and the commit message upon triage of a potential pull request from an unknown user. You must also analyze any relevant on-disk artifacts and investigate any concurrent processes to determine the source and intent of the pull request." data_source: [] search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name repository.full_name check_suite.pull_requests{}.head.ref check_suite.head_commit.message diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index dcd741a159..cc2d6a7121 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -5,16 +5,7 @@ date: '2022-11-10' author: David Dorsey, Michael Haag, Splunk, Steven Dick status: production type: Hunting -description: "This analytic detects Searches for file modifications that commonly\ - \ occur with Ransomware to detect modifications to files with extensions that are\ - \ commonly used by Ransomware. The detection is made by searches for changes in\ - \ the datamodel=Endpoint.Filesystem, specifically modifications to file extensions\ - \ that match those commonly used by Ransomware.\nThe detection is important because\ - \ it suggests that an attacker is attempting to encrypt or otherwise modify files\ - \ in the environment using malware, potentially leading to data loss that can cause\ - \ significant damage to an organization's data and systems. \nFalse positives might\ - \ occur so the SOC must investigate the affected system to determine the source\ - \ of the modification and take appropriate action to contain and remediate the attack." +description: "This analytic detects Searches for file modifications that commonly occur with Ransomware to detect modifications to files with extensions that are commonly used by Ransomware. The detection is made by searches for changes in the datamodel=Endpoint.Filesystem, specifically modifications to file extensions that match those commonly used by Ransomware. The detection is important because it suggests that an attacker is attempting to encrypt or otherwise modify files in the environment using malware, potentially leading to data loss that can cause significant damage to an organization's data and systems. False positives might occur so the SOC must investigate the affected system to determine the source of the modification and take appropriate action to contain and remediate the attack." data_source: - Sysmon Event ID 11 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index a6e6542b6c..a2e4b04695 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -5,9 +5,7 @@ date: '2019-12-06' author: Patrick Bareiss, Splunk status: production type: TTP -description: |- - This analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS), which is a common tactic used by adversaries to steal user authentication credentials, known as credential dumping. The detection is made by leveraging Sysmon Event ID 8 logs and searches for processes that create remote threads in lsass.exe. This is an unusual activity that is generally linked to credential theft or credential dumping, which is a significant threat to network security. - The detection is important because it helps to detect potential credential dumping attacks, which can result in significant damage to an organization's security. False positives might occur though the confidence level of this alert is high. There might be cases where legitimate tools can access LSASS and generate similar logs. Therefore, you must understand the broader context of such events and differentiate between legitimate activities and possible threats. +description: "This analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS), which is a common tactic used by adversaries to steal user authentication credentials, known as credential dumping. The detection is made by leveraging Sysmon Event ID 8 logs and searches for processes that create remote threads in lsass.exe. This is an unusual activity that is generally linked to credential theft or credential dumping, which is a significant threat to network security. The detection is important because it helps to detect potential credential dumping attacks, which can result in significant damage to an organization's security. False positives might occur though the confidence level of this alert is high. There might be cases where legitimate tools can access LSASS and generate similar logs. Therefore, you must understand the broader context of such events and differentiate between legitimate activities and possible threats." data_source: - Sysmon Event ID 8 search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index 85a5e53e99..fdd3ebba26 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -5,24 +5,7 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk status: production type: TTP -description: "As a prerequisite, ensure that you are ingesting endpoint process logs\ - \ into your Splunk instance. \nThis analytic detects the use of the copy command\ - \ to dump credentials from a shadow copy so that you can detect potential threats\ - \ earlier and mitigate the risks associated with credential dumping. The detection\ - \ is made by using a Splunk query to search for specific processes that indicate\ - \ credential dumping activity. The query looks for processes with command lines\ - \ that include references to certain files, such as \"sam\", \"security\", \"system\"\ - , and \"ntds.dit\", located in system directories like \"system32\" or \"windows\"\ - . The detection is important because it suggests that an attacker is attempting\ - \ to extract credentials from a shadow copy. Credential dumping is a common technique\ - \ used by attackers to obtain sensitive login information and gain unauthorized\ - \ access to systems to escalate privileges, move laterally within the network, or\ - \ gain unauthorized access to sensitive data. False positives might occur since\ - \ legitimate processes might also reference these files. During triage, it is crucial\ - \ to review the process details, including the source and the command that is run.\ - \ Additionally, you must capture and analyze any relevant on-disk artifacts and\ - \ investigate concurrent processes to determine the source of the attack. Additional\ - \ steps include...." +description: "As a prerequisite, ensure that you are ingesting endpoint process logs into your Splunk instance. This analytic detects the use of the copy command to dump credentials from a shadow copy so that you can detect potential threats earlier and mitigate the risks associated with credential dumping. The detection is made by using a Splunk query to search for specific processes that indicate credential dumping activity. The query looks for processes with command lines that include references to certain files, such as \"sam\", \"security\", \"system\", and \"ntds.dit\", located in system directories like \"system32\" or \"windows\". The detection is important because it suggests that an attacker is attempting to extract credentials from a shadow copy. Credential dumping is a common technique used by attackers to obtain sensitive login information and gain unauthorized access to systems to escalate privileges, move laterally within the network, or gain unauthorized access to sensitive data. False positives might occur since legitimate processes might also reference these files. During triage, it is crucial to review the process details, including the source and the command that is run. Additionally, you must capture and analyze any relevant on-disk artifacts and investigate concurrent processes to determine the source of the attack. Additional steps include...." data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml index c96526a92b..5a76a919b9 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml @@ -5,24 +5,7 @@ date: '2021-01-28' author: Shannon Davis, Splunk status: experimental type: TTP -description: "This analytic detects the heap-based buffer overflow for the sudoedit\ - \ command and identifies instances where the command \"sudoedit -s *\" is run using\ - \ the osquery_process data source. \nThis indicates that the sudoedit command is\ - \ used with the \"-s\" flag, which is associated with the heap-based buffer overflow\ - \ vulnerability. The detection is important because it indicates a potential security\ - \ vulnerability, specifically Baron Samedit CVE-2021-3156, which helps to identify\ - \ and respond to potential heap-based buffer overflow attacks to enhance the security\ - \ posture of the organization. This vulnerability allows an attacker to escalate\ - \ privileges and potentially gain unauthorized access to the system. If the attack\ - \ is successful, the attacker can gain full control of the system, run arbitrary\ - \ code, or access sensitive data. Such attacks can lead to data breaches, unauthorized\ - \ access, and potential disruption of critical systems. False positives might occur\ - \ since the legitimate use of the sudoedit command with the \"-s\" flag can also\ - \ trigger this detection. You must carefully review and validate the findings before\ - \ taking any action. Next steps include investigating all true positive detections\ - \ promptly, reviewing the associated processes, gather relevant artifacts, identifying\ - \ the source of the attack to contain the threat, mitigate the risks, and prevent\ - \ further damage to the environment." +description: "This analytic detects the heap-based buffer overflow for the sudoedit command and identifies instances where the command \"sudoedit -s *\" is run using the osquery_process data source. This indicates that the sudoedit command is used with the \"-s\" flag, which is associated with the heap-based buffer overflow vulnerability. The detection is important because it indicates a potential security vulnerability, specifically Baron Samedit CVE-2021-3156, which helps to identify and respond to potential heap-based buffer overflow attacks to enhance the security posture of the organization. This vulnerability allows an attacker to escalate privileges and potentially gain unauthorized access to the system. If the attack is successful, the attacker can gain full control of the system, run arbitrary code, or access sensitive data. Such attacks can lead to data breaches, unauthorized access, and potential disruption of critical systems. False positives might occur since the legitimate use of the sudoedit command with the \"-s\" flag can also trigger this detection. You must carefully review and validate the findings before taking any action. Next steps include investigating all true positive detections promptly, reviewing the associated processes, gather relevant artifacts, identifying the source of the attack to contain the threat, mitigate the risks, and prevent further damage to the environment." data_source: [] search: '`osquery_process` | search "columns.cmdline"="sudoedit -s \\*" | `detect_baron_samedit_cve_2021_3156_via_osquery_filter`' how_to_implement: OSQuery installed and configured to pick up process events (info diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index 983bf790fd..e774168be3 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -7,19 +7,7 @@ type: TTP status: production data_source: - Windows Security 4719 -description: "As a prerequisite, ensure that logs containing information about audit\ - \ policy changes are being ingested from the domain controller. This analytic detects\ - \ the disabling of audit policies on a domain controller. \nThe detection is made\ - \ by identifying changes made to audit policies and checks for the removal of success\ - \ or failure auditing, which are common indicators of policy tampering. The detection\ - \ is important because it indicates that an attacker has gained access to the domain\ - \ controller and is attempting to evade detection and cover up malicious activity.\ - \ The impact of such an attack can be severe, including data theft, privilege escalation,\ - \ and compromise of the entire network. \nFalse positives might occur since legitimate\ - \ changes to audit policies might also trigger the analytic. Upon triage, review\ - \ the audit policy change event and investigate the source of the change. Additionally,\ - \ you must capture and inspect any relevant on-disk artifacts and review concurrent\ - \ processes to identify the attack source." +description: "As a prerequisite, ensure that logs containing information about audit policy changes are being ingested from the domain controller. This analytic detects the disabling of audit policies on a domain controller. The detection is made by identifying changes made to audit policies and checks for the removal of success or failure auditing, which are common indicators of policy tampering. The detection is important because it indicates that an attacker has gained access to the domain controller and is attempting to evade detection and cover up malicious activity. The impact of such an attack can be severe, including data theft, privilege escalation, and compromise of the entire network. False positives might occur since legitimate changes to audit policies might also trigger the analytic. Upon triage, review the audit policy change event and investigate the source of the change. Additionally, you must capture and inspect any relevant on-disk artifacts and review concurrent processes to identify the attack source." search: '`wineventlog_security` EventCode=4719 (AuditPolicyChanges IN ("%%8448","%%8450","%%8448, %%8450") OR Changes IN ("Failure removed","Success removed","Success removed, Failure removed")) dest_category="domain_controller"| replace "%%8448" with "Success removed", diff --git a/detections/endpoint/wmi_temporary_event_subscription.yml b/detections/endpoint/wmi_temporary_event_subscription.yml index 974ad9e7cb..e9847509ee 100644 --- a/detections/endpoint/wmi_temporary_event_subscription.yml +++ b/detections/endpoint/wmi_temporary_event_subscription.yml @@ -5,9 +5,7 @@ date: '2018-10-23' author: Rico Valdez, Splunk status: experimental type: TTP -description: |- - This analytic detects the creation of WMI temporary event subscriptions. WMI (Windows Management Instrumentation) is a management technology that allows administrators to perform various tasks on Windows-based systems. Temporary event subscriptions are created to monitor specific events or changes on a system that help to detect potential threats early and take proactive measures to protect the organization's systems and data. - The detection is made by using the Splunk query `wmi` EventCode=5860 Temporary to search for events with EventCode 5860, which indicates the creation of a temporary WMI event subscription. To further refine the search results, the query uses regular expressions (rex) to extract the query used in the event subscription. Then, it filters known benign queries related to system processes such as 'wsmprovhost.exe' and 'AntiVirusProduct', 'FirewallProduct', 'AntiSpywareProduct', which helps to focus on potentially malicious or suspicious queries. The detection is important because it indicates malicious activity since attackers use WMI to run commands, gather information, or maintain persistence within a compromised system. False positives might occur since legitimate uses of WMI event subscriptions in the environment might trigger benign activities to be flagged. Therefore, an extensive triage is necessary to review the specific query and assess its intent. Additionally, capturing and inspecting relevant on-disk artifacts and analyzing concurrent processes can help to identify the source of the attack. Detecting the creation of these event subscriptions to identify potential threats early and take appropriate actions to mitigate the risks. +description: "This analytic detects the creation of WMI temporary event subscriptions. WMI (Windows Management Instrumentation) is a management technology that allows administrators to perform various tasks on Windows-based systems. Temporary event subscriptions are created to monitor specific events or changes on a system that help to detect potential threats early and take proactive measures to protect the organization's systems and data. The detection is made by using the Splunk query `wmi` EventCode=5860 Temporary to search for events with EventCode 5860, which indicates the creation of a temporary WMI event subscription. To further refine the search results, the query uses regular expressions (rex) to extract the query used in the event subscription. Then, it filters known benign queries related to system processes such as 'wsmprovhost.exe' and 'AntiVirusProduct', 'FirewallProduct', 'AntiSpywareProduct', which helps to focus on potentially malicious or suspicious queries. The detection is important because it indicates malicious activity since attackers use WMI to run commands, gather information, or maintain persistence within a compromised system. False positives might occur since legitimate uses of WMI event subscriptions in the environment might trigger benign activities to be flagged. Therefore, an extensive triage is necessary to review the specific query and assess its intent. Additionally, capturing and inspecting relevant on-disk artifacts and analyzing concurrent processes can help to identify the source of the attack. Detecting the creation of these event subscriptions to identify potential threats early and take appropriate actions to mitigate the risks." data_source: - Sysmon Event ID 5 search: '`wmi` EventCode=5860 Temporary | rex field=Message "NotificationQuery =\s+(?[^;|^$]+)" diff --git a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml index 036b897c1c..34bd0c9c38 100644 --- a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml +++ b/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml @@ -5,21 +5,7 @@ date: '2020-07-28' author: Shannon Davis, Splunk status: experimental type: TTP -description: "Ensure that the following prerequisites are met: (i) Both Splunk Stream\ - \ DNS and TCP data are ingested. (ii) The macros 'stream:dns' and 'stream:tcp' are\ - \ replaced with the appropriate configurations that are specific to your Splunk\ - \ environment.This analytic detects SIGRed exploitation attempts. SIGRed is a critical\ - \ wormable vulnerability found in Windows DNS servers, known as CVE-2020-1350, which\ - \ allows remote code execution.The detection is made by using an experimental search\ - \ that focuses on identifying specific indicators that might suggest the presence\ - \ of the SIGRed exploit such as DNS SIG records, KEY records, and TCP payloads greater\ - \ than 65KB. This detection is important because it \ndetects and responds to potential\ - \ SIGRed exploitation attempts and minimizes the risk of a successful attack and\ - \ its impact on the organization's infrastructure and data. False positives might\ - \ occur due to the experimental nature of this analytic. Next steps include reviewing\ - \ and investigating each case thoroughly given the potential for unauthorized Windows\ - \ DNS server access, data breaches, and service disruptions. Additionally, you must\ - \ stay updated with Microsoft's guidance on the SIGRed vulnerability." +description: "Ensure that the following prerequisites are met: (i) Both Splunk Stream DNS and TCP data are ingested. (ii) The macros 'stream:dns' and 'stream:tcp' are replaced with the appropriate configurations that are specific to your Splunk environment. This analytic detects SIGRed exploitation attempts. SIGRed is a critical wormable vulnerability found in Windows DNS servers, known as CVE-2020-1350, which allows remote code execution. The detection is made by using an experimental search that focuses on identifying specific indicators that might suggest the presence of the SIGRed exploit such as DNS SIG records, KEY records, and TCP payloads greater than 65KB. This detection is important because it detects and responds to potential SIGRed exploitation attempts and minimizes the risk of a successful attack and its impact on the organization's infrastructure and data. False positives might occur due to the experimental nature of this analytic. Next steps include reviewing and investigating each case thoroughly given the potential for unauthorized Windows DNS server access, data breaches, and service disruptions. Additionally, you must stay updated with Microsoft's guidance on the SIGRed vulnerability." data_source: [] search: '`stream_dns` | spath "query_type{}" | search "query_type{}" IN (SIG,KEY) | spath protocol_stack | search protocol_stack="ip:tcp:dns" | append [search `stream_tcp` diff --git a/detections/web/sql_injection_with_long_urls.yml b/detections/web/sql_injection_with_long_urls.yml index e39eb81544..55e24ec94f 100644 --- a/detections/web/sql_injection_with_long_urls.yml +++ b/detections/web/sql_injection_with_long_urls.yml @@ -5,9 +5,7 @@ date: '2022-03-28' author: Bhavin Patel, Splunk status: experimental type: TTP -description: |- - This analytic detects long URLs that contain multiple SQL commands. A proactive approach helps to detect and respond to potential threats earlier, mitigating the risks associated with SQL injection attacks. This detection is made by a Splunk query that searches for web traffic data where the destination category is a web server and the URL length is greater than 1024 characters or the HTTP user agent length is greater than 200 characters. This detection is important because it suggests that an attacker is attempting to exploit a web application through SQL injection. SQL injection is a common technique used by attackers to exploit vulnerabilities in web applications and gain unauthorized access to databases. Attackers can insert malicious SQL commands into a URL to manipulate the application's database and retrieve sensitive information or modify data. The impact of a successful SQL injection attack can be severe, potentially leading to data breaches, unauthorized access, and even complete compromise of the affected system. False positives might occur since the legitimate use of web applications or specific URLs in your environment can trigger the detection. Therefore, you must review and validate any alerts generated by this analytic before taking any action. - Next steps include reviewing the source and destination of the web traffic, as well as the specific URL and HTTP user agent. Additionally, capture and analyze any relevant on-disk artifacts and review concurrent processes to determine the source of the attack. +description: "This analytic detects long URLs that contain multiple SQL commands. A proactive approach helps to detect and respond to potential threats earlier, mitigating the risks associated with SQL injection attacks. This detection is made by a Splunk query that searches for web traffic data where the destination category is a web server and the URL length is greater than 1024 characters or the HTTP user agent length is greater than 200 characters. This detection is important because it suggests that an attacker is attempting to exploit a web application through SQL injection. SQL injection is a common technique used by attackers to exploit vulnerabilities in web applications and gain unauthorized access to databases. Attackers can insert malicious SQL commands into a URL to manipulate the application's database and retrieve sensitive information or modify data. The impact of a successful SQL injection attack can be severe, potentially leading to data breaches, unauthorized access, and even complete compromise of the affected system. False positives might occur since the legitimate use of web applications or specific URLs in your environment can trigger the detection. Therefore, you must review and validate any alerts generated by this analytic before taking any action. Next steps include reviewing the source and destination of the web traffic, as well as the specific URL and HTTP user agent. Additionally, capture and analyze any relevant on-disk artifacts and review concurrent processes to determine the source of the attack." data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Web where Web.dest_category=web_server AND (Web.url_length > 1024 OR Web.http_user_agent_length From fb66f993c99d7aee57535a08b896af5cf8c12ad9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 12 Oct 2023 11:15:44 -0700 Subject: [PATCH 23/37] update source --- .../endpoint/windows_domain_admin_impersonation_indicator.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index c82d90909a..1adde7fd3b 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -51,5 +51,5 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/diamond_ticket/security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog \ No newline at end of file + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog From 69be7e2da96207c9bc9053aa5bb7b47c3a22ee10 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 13 Oct 2023 12:23:52 -0600 Subject: [PATCH 24/37] Create confluence_cve_2023_22515_trigger_vulnerability.yml --- ...e_cve_2023_22515_trigger_vulnerability.yml | 62 +++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml diff --git a/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml b/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml new file mode 100644 index 0000000000..50635e63aa --- /dev/null +++ b/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml @@ -0,0 +1,62 @@ +name: Confluence CVE-2023-22515 Trigger Vulnerability +id: 630ea8b2-2800-4f5d-9cbc-d65c567349b0 +version: 1 +date: '2023-10-12' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: [] +description: The following analytic identifies potential exploitation attempts on a known vulnerability in Atlassian Confluence, targeting the /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false* and /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0& URLs. By analyzing web logs within the Splunk 'Web' Data Model, it filters for successful accesses (HTTP status 200) to these vulnerable endpoints. Such behavior is crucial for a SOC to monitor, as it suggests attackers might be exploiting a privilege escalation flaw in Confluence. A true positive implies a possible unauthorized access or account creation with escalated privileges. Key details captured include user-agent, HTTP methods, URL length, and source and destination IPs. These insights aid SOCs in swiftly detecting and responding to threats, ensuring vulnerabilities are mitigated before substantial compromise. +search: '| tstats count min(_time) as firstTime max(_time) + as lastTime from datamodel=Web where Web.url IN ("/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false*","/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&") Web.http_method=GET Web.status=200 + by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `confluence_cve_2023_22515_trigger_vulnerability_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on Web traffic that include fields relavent for traffic into the `Web` datamodel. +known_false_positives: False positives may be present with legitimate applications. + Attempt to filter by dest IP or use Asset groups to restrict to Confluence servers. +references: +- https://github.com/Chocapikk/CVE-2023-22515/blob/main/exploit.py +- https://x.com/Shadowserver/status/1712378833536741430?s=20 +- https://github.com/j3seer/CVE-2023-22515-POC +tags: + analytic_story: + - Privilege Escalation Vulnerability Confluence Data Center and Server + asset_type: Web server + atomic_guid: [] + confidence: 80 + impact: 90 + message: Potential exploitation attempts on a known vulnerability in Atlassian Confluence detected. The source IP is $src$ and the destination hostname is $dest$. + mitre_attack_id: + - T1190 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: src + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 72 + required_fields: + - _time + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + - Web.http_user_agent + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/confluence/confluence_vuln_trigger_cve-2023-22515.log + source: suricata + sourcetype: suricata From ab59162008bad886d96b48812d10aeaac5bccf14 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 13 Oct 2023 11:26:26 -0700 Subject: [PATCH 25/37] new PR with correct yamls --- ...arepoint_server_elevation_of_privilege.yml | 64 +++++++++++++++++++ .../web/ws_ftp_remote_code_execution.yml | 3 +- ..._elevation_of_privilege_cve_2023_29357.yml | 20 ++++++ 3 files changed, 86 insertions(+), 1 deletion(-) create mode 100644 detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml create mode 100644 stories/microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml diff --git a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml new file mode 100644 index 0000000000..412ccf3d07 --- /dev/null +++ b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml @@ -0,0 +1,64 @@ +name: Microsoft SharePoint Server Elevation of Privilege +id: fcf4bd3f-a79f-4b7a-83bf-2692d60b859d +version: 1 +date: '2023-09-27' +author: Michael Haag, Gowthamaraj Rajendran, Splunk +status: production +type: TTP +data_source: [] +description: This analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2023-29357. This vulnerability pertains to an elevation of privilege due to improper handling of authentication tokens. By monitoring for suspicious activities related to SharePoint Server, the analytic identifies attempts to exploit this vulnerability. If a true positive is detected, it indicates a serious security breach where an attacker might have gained privileged access to the SharePoint environment, potentially leading to data theft or other malicious activities. +search: '| tstats count min(_time) as firstTime max(_time) + as lastTime from datamodel=Web where Web.url IN ("/_api/web/siteusers*","/_api/web/currentuser*") Web.status=200 Web.http_method=GET + by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `microsoft_sharepoint_server_elevation_of_privilege_filter`' +how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Microsoft SharePoint. +known_false_positives: False positives may occur if there are legitimate activities that mimic the exploitation pattern. It's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment. +references: +- https://socradar.io/microsoft-sharepoint-server-elevation-of-privilege-vulnerability-exploit-cve-2023-29357/ +- https://github.com/LuemmelSec/CVE-2023-29357/blob/main/CVE-2023-29357/Program.cs +tags: + cve: + - CVE-2023-29357 + analytic_story: + - Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357 + asset_type: Web Server + atomic_guid: [] + confidence: 50 + impact: 90 + message: Possible exploitation of CVE-2023-29357 against $dest$ from $src$. + mitre_attack_id: + - T1068 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: src + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 45 + required_fields: + - _time + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + - Web.http_user_agent + - Web.status + - sourcetype + security_domain: network + tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/sharepoint/sharepointeop.log + source: suricata + sourcetype: suricata \ No newline at end of file diff --git a/detections/web/ws_ftp_remote_code_execution.yml b/detections/web/ws_ftp_remote_code_execution.yml index e804743b1a..fd40b6ee7c 100644 --- a/detections/web/ws_ftp_remote_code_execution.yml +++ b/detections/web/ws_ftp_remote_code_execution.yml @@ -14,10 +14,11 @@ search: '| tstats count min(_time) as firstTime max(_time) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ws_ftp_remote_code_execution_filter`' how_to_implement: The following analytic requires the Web datamodel. Ensure data source is mapped correctly or modify and tune for your data source. -known_false_positives: If WS_FTP Server is not in use, this analytic will not return results. Monitor and tune for your environment. +known_false_positives: If WS_FTP Server is not in use, this analytic will not return results. Monitor and tune for your environment. Note the MetaSploit module is focused on only hitting /AHT/ and not the full /AHT/AhtApiService.asmx/AuthUser URL. references: - https://github.com/projectdiscovery/nuclei-templates/pull/8296/files - https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044 +- https://github.com/rapid7/metasploit-framework/pull/18414 tags: cve: - CVE-2023-40044 diff --git a/stories/microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml b/stories/microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml new file mode 100644 index 0000000000..bbd414de68 --- /dev/null +++ b/stories/microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml @@ -0,0 +1,20 @@ +name: Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357 +id: 95ae800d-485e-47f7-866e-8be281aa497d +version: 1 +date: '2023-09-27' +author: Michael Haag, Gowthamaraj Rajendran, Splunk +description: This analytic story focuses on the Microsoft SharePoint Server vulnerability CVE-2023-29357, which allows for an elevation of privilege due to improper handling of authentication tokens. Exploitation of this vulnerability could lead to a serious security breach where an attacker might gain privileged access to the SharePoint environment, potentially leading to data theft or other malicious activities. This story is associated with the detection `Microsoft SharePoint Server Elevation of Privilege` which identifies attempts to exploit this vulnerability. +narrative: Microsoft SharePoint Server is a widely used web-based collaborative platform. The vulnerability CVE-2023-29357 exposes a flaw in the handling of authentication tokens, allowing an attacker to escalate privileges and gain unauthorized access to the SharePoint environment. This could potentially lead to data theft, unauthorized system modifications, or other malicious activities. Organizations are urged to apply immediate patches and conduct regular system assessments to ensure security. +references: +- https://socradar.io/microsoft-sharepoint-server-elevation-of-privilege-vulnerability-exploit-cve-2023-29357/ +- https://github.com/Chocapikk/CVE-2023-29357 +tags: + analytic_story: Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357 + category: + - Vulnerability + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 39d89dc747cca9b8d50e532f6375898f684867ea Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 13 Oct 2023 12:32:19 -0600 Subject: [PATCH 26/37] macro --- detections/endpoint/windows_sip_provider_inventory.yml | 2 +- macros/subjectinterfacepackage.yml | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) create mode 100644 macros/subjectinterfacepackage.yml diff --git a/detections/endpoint/windows_sip_provider_inventory.yml b/detections/endpoint/windows_sip_provider_inventory.yml index 35f7ca565f..48e1667c8e 100644 --- a/detections/endpoint/windows_sip_provider_inventory.yml +++ b/detections/endpoint/windows_sip_provider_inventory.yml @@ -7,7 +7,7 @@ status: production type: Hunting data_source: [] description: The following inventory analytic is used with a PowerShell scripted inputs to capture all SIP providers on a Windows system. This analytic is used to identify potential malicious SIP providers that may be used to subvert trust controls. Upon review, look for new and non-standard paths for SIP providers. -search: 'sourcetype = PwSh:SubjectInterfacePackage Dll=*\\*.dll | stats count min(_time) as firstTime max(_time) as lastTime values(Dll) by Path host| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_sip_provider_inventory_filter`' +search: '`SubjectInterfacePackage` Dll=*\\*.dll | stats count min(_time) as firstTime max(_time) as lastTime values(Dll) by Path host| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_sip_provider_inventory_filter`' how_to_implement: To implement this analytic, one must first perform inventory using a scripted inputs. Review the following Gist - https://gist.github.com/MHaggis/75dd5db546c143ea67703d0e86cdbbd1 known_false_positives: False positives are limited as this is a hunting query for inventory. references: diff --git a/macros/subjectinterfacepackage.yml b/macros/subjectinterfacepackage.yml new file mode 100644 index 0000000000..0cad38ff22 --- /dev/null +++ b/macros/subjectinterfacepackage.yml @@ -0,0 +1,4 @@ +definition: sourcetype="PwSh:SubjectInterfacePackage" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: subjectinterfacepackage \ No newline at end of file From 4106413eef0d890ebce3d1019f81f59bf850e239 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 13 Oct 2023 11:36:19 -0700 Subject: [PATCH 27/37] update story name --- .../web/confluence_cve_2023_22515_trigger_vulnerability.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml b/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml index 50635e63aa..3400a2529c 100644 --- a/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml +++ b/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml @@ -23,7 +23,7 @@ references: - https://github.com/j3seer/CVE-2023-22515-POC tags: analytic_story: - - Privilege Escalation Vulnerability Confluence Data Center and Server + - CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server asset_type: Web server atomic_guid: [] confidence: 80 From 07f2c0ea2d261acc1e93dc2075f26fac6d7438ab Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 13 Oct 2023 11:55:25 -0700 Subject: [PATCH 28/37] macros error --- detections/endpoint/windows_sip_provider_inventory.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_sip_provider_inventory.yml b/detections/endpoint/windows_sip_provider_inventory.yml index 48e1667c8e..04a65d81d1 100644 --- a/detections/endpoint/windows_sip_provider_inventory.yml +++ b/detections/endpoint/windows_sip_provider_inventory.yml @@ -7,7 +7,7 @@ status: production type: Hunting data_source: [] description: The following inventory analytic is used with a PowerShell scripted inputs to capture all SIP providers on a Windows system. This analytic is used to identify potential malicious SIP providers that may be used to subvert trust controls. Upon review, look for new and non-standard paths for SIP providers. -search: '`SubjectInterfacePackage` Dll=*\\*.dll | stats count min(_time) as firstTime max(_time) as lastTime values(Dll) by Path host| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_sip_provider_inventory_filter`' +search: '`subjectinterfacepackage` Dll=*\\*.dll | stats count min(_time) as firstTime max(_time) as lastTime values(Dll) by Path host| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_sip_provider_inventory_filter`' how_to_implement: To implement this analytic, one must first perform inventory using a scripted inputs. Review the following Gist - https://gist.github.com/MHaggis/75dd5db546c143ea67703d0e86cdbbd1 known_false_positives: False positives are limited as this is a hunting query for inventory. references: From f3e2739ec52990c989fd7d6f0f4ce81e2f054dd0 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 13 Oct 2023 13:00:33 -0600 Subject: [PATCH 29/37] Update confluence_cve_2023_22515_trigger_vulnerability.yml --- .../web/confluence_cve_2023_22515_trigger_vulnerability.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml b/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml index 3400a2529c..ad34e60dd7 100644 --- a/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml +++ b/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml @@ -7,9 +7,7 @@ status: production type: TTP data_source: [] description: The following analytic identifies potential exploitation attempts on a known vulnerability in Atlassian Confluence, targeting the /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false* and /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0& URLs. By analyzing web logs within the Splunk 'Web' Data Model, it filters for successful accesses (HTTP status 200) to these vulnerable endpoints. Such behavior is crucial for a SOC to monitor, as it suggests attackers might be exploiting a privilege escalation flaw in Confluence. A true positive implies a possible unauthorized access or account creation with escalated privileges. Key details captured include user-agent, HTTP methods, URL length, and source and destination IPs. These insights aid SOCs in swiftly detecting and responding to threats, ensuring vulnerabilities are mitigated before substantial compromise. -search: '| tstats count min(_time) as firstTime max(_time) - as lastTime from datamodel=Web where Web.url IN ("/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false*","/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&") Web.http_method=GET Web.status=200 - by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype +search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false*","/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&*") Web.http_method=GET Web.status=200 by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `confluence_cve_2023_22515_trigger_vulnerability_filter`' @@ -53,6 +51,7 @@ tags: - Web.src - Web.dest - Web.http_user_agent + - Web.status security_domain: network tests: - name: True Positive Test From fdd10678037d8335d8b3630c0bbdf3c6efe3d186 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 13 Oct 2023 13:26:36 -0700 Subject: [PATCH 30/37] updated descriptions --- detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml | 2 +- ...d_compute_instance_created_with_previously_unseen_image.yml | 2 +- ...e_instance_created_with_previously_unseen_instance_type.yml | 3 +-- detections/cloud/github_dependabot_alert.yml | 2 +- detections/cloud/github_pull_request_from_unknown_user.yml | 2 +- detections/endpoint/access_lsass_memory_for_dump_creation.yml | 2 +- .../endpoint/attempt_to_add_certificate_to_untrusted_store.yml | 2 +- .../endpoint/create_or_delete_windows_shares_using_net_exe.yml | 2 +- .../credential_dumping_via_copy_command_from_shadow_copy.yml | 2 +- .../detect_credential_dumping_through_lsass_access.yml | 2 +- detections/endpoint/dump_lsass_via_comsvcs_dll.yml | 2 +- detections/endpoint/single_letter_process_on_endpoint.yml | 2 +- .../endpoint/suspicious_writes_to_windows_recycle_bin.yml | 2 +- detections/endpoint/unusually_long_command_line.yml | 2 +- .../windows_ad_domain_controller_audit_policy_disabled.yml | 2 +- .../endpoint/windows_service_creation_using_registry_entry.yml | 2 +- detections/endpoint/wmi_permanent_event_subscription.yml | 2 +- detections/network/detect_zerologon_via_zeek.yml | 2 +- 18 files changed, 18 insertions(+), 19 deletions(-) diff --git a/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml index 9826922319..02d44cdb96 100644 --- a/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml +++ b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml @@ -6,7 +6,7 @@ author: Rod Soto, Splunk status: experimental type: Hunting description: |- - As a prerequisite, ensure that you are ingesting logs from your Kubernetes environment, specifically the AWS CloudWatch logs for EKS. This analytic detects unauthenticated requests made against the Kubernetes' Pods API through proactive monitoring to protect the Kubernetes environment from unauthorized access and potential security breaches. The detection is made by using the Splunk query `aws_cloudwatchlogs_eks` with specific filters to identify these requests. Identifies events where the `user.username` is set to "system:anonymous", the `verb` is set to "list", and the `objectRef.resource` is set to "pods". Additionally, the search checks if the `requestURI` is equal to "/api/v1/pods". Analyzing these events helps you to identify any unauthorized access attempts to the Kubernetes' Pods API. Unauthenticated requests can indicate potential security breaches or unauthorized access to sensitive resources within the Kubernetes environment. The detection is important because unauthorized access to Kubernetes' Pods API can lead to the compromise of sensitive data, unauthorized execution of commands, or even the potential for lateral movement within the Kubernetes cluster. False positives might occur since there might be legitimate use cases for unauthenticated requests in certain scenarios. Therefore, you must review and validate any detected events before taking any action. Next steps include investigating the incident to mitigate any ongoing threats, and strengthening the security measures to prevent future unauthorized access attempts. + The following analytic detects unauthenticated requests made against the Kubernetes' Pods API through proactive monitoring to protect the Kubernetes environment from unauthorized access and potential security breaches. The detection is made by using the Splunk query `aws_cloudwatchlogs_eks` with specific filters to identify these requests. Identifies events where the `user.username` is set to "system:anonymous", the `verb` is set to "list", and the `objectRef.resource` is set to "pods". Additionally, the search checks if the `requestURI` is equal to "/api/v1/pods". Analyzing these events helps you to identify any unauthorized access attempts to the Kubernetes' Pods API. Unauthenticated requests can indicate potential security breaches or unauthorized access to sensitive resources within the Kubernetes environment. The detection is important because unauthorized access to Kubernetes' Pods API can lead to the compromise of sensitive data, unauthorized execution of commands, or even the potential for lateral movement within the Kubernetes cluster. False positives might occur since there might be legitimate use cases for unauthenticated requests in certain scenarios. Therefore, you must review and validate any detected events before taking any action. Next steps include investigating the incident to mitigate any ongoing threats, and strengthening the security measures to prevent future unauthorized access attempts. data_source: [] search: '`aws_cloudwatchlogs_eks` "user.username"="system:anonymous" verb=list objectRef.resource=pods requestURI="/api/v1/pods" | rename source as cluster_name sourceIPs{} as src_ip diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 068ef2ecd2..a3fdda8ed8 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -6,7 +6,7 @@ author: David Dorsey, Splunk status: experimental type: Anomaly description: |- - As a prerequisite, ensure that you are ingesting relevant logs that capture information about instance creation and image IDs in your cloud computing environment. This analytic detects potential instances that are created in a cloud computing environment using new or unknown image IDs that have not been seen before. This detection is important because it helps to investigate and take appropriate action to prevent further damage or unauthorized access to the Cloud environment, which can include data breaches, unauthorized access to sensitive information, or the deployment of malicious payloads within the cloud environment. False positives might occur since legitimate instances can also have previously unseen image IDs. Next steps include conducting an extensive triage and investigation to determine the nature of the activity. During triage, review the details of the created instances, including the user responsible for the creation, the image ID used, and any associated metadata. Additionally, consider inspecting any relevant on-disk artifacts and analyzing concurrent processes to identify the source of the attack. + The following analytic detects potential instances that are created in a cloud computing environment using new or unknown image IDs that have not been seen before. This detection is important because it helps to investigate and take appropriate action to prevent further damage or unauthorized access to the Cloud environment, which can include data breaches, unauthorized access to sensitive information, or the deployment of malicious payloads within the cloud environment. False positives might occur since legitimate instances can also have previously unseen image IDs. Next steps include conducting an extensive triage and investigation to determine the nature of the activity. During triage, review the details of the created instances, including the user responsible for the creation, the image ID used, and any associated metadata. Additionally, consider inspecting any relevant on-disk artifacts and analyzing concurrent processes to identify the source of the attack. data_source: [] search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id, diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index cc6c4b71b4..a5c9bd52f7 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -5,8 +5,7 @@ date: '2020-09-12' author: David Dorsey, Splunk status: experimental type: Anomaly -description: |- - As a prerequisite, ensure that you ingest logs that contain EC2 instance creation information into your Splunk environment. This analytic detects the creation of EC2 instances with previously unseen instance types. The detection is made by using a Splunk query to identify the EC2 instances. First, the query searches for changes in the EC2 instance creation action and filters for instances with instance types that are not recognized or previously seen. Next, the query uses the Splunk tstats command to gather the necessary information from the Change data model. Then, it filters the instances with unknown instance types and reviews previously seen instance types to determine if they are new or not. The detection is important because it identifies attackers attempting to create instances with unknown or potentially compromised instance types, which can be an attempt to gain unauthorized access to sensitive data, compromise of systems, exfiltrate data, potential disruption of services, or launch other malicious activities within the environment. False positives might occur since there might be legitimate reasons for creating instances with previously unseen instance types. Therefore, you must carefully review and triage all alerts. +description: The following analytic detects the creation of EC2 instances with previously unseen instance types. The detection is made by using a Splunk query to identify the EC2 instances. First, the query searches for changes in the EC2 instance creation action and filters for instances with instance types that are not recognized or previously seen. Next, the query uses the Splunk tstats command to gather the necessary information from the Change data model. Then, it filters the instances with unknown instance types and reviews previously seen instance types to determine if they are new or not. The detection is important because it identifies attackers attempting to create instances with unknown or potentially compromised instance types, which can be an attempt to gain unauthorized access to sensitive data, compromise of systems, exfiltrate data, potential disruption of services, or launch other malicious activities within the environment. False positives might occur since there might be legitimate reasons for creating instances with previously unseen instance types. Therefore, you must carefully review and triage all alerts. data_source: [] search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index b228bffe01..35fce616b3 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -5,7 +5,7 @@ date: '2021-09-01' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: "As a prerequisite, ensure that you ingest Github logs that contain information about Dependabot Alerts. This analytic detects Dependabot Alerts in Github logs. The detection is made by first searching for logs that contain the action \"create\" and renames certain fields for easier analysis. Then, this analytic uses the \"stats\" command to calculate the first and last occurrence of the alert based on the timestamp. The fields included in the output are the action, affected package name, affected range, created date, external identifier, external reference, fixed version, severity, repository, repository URL, and user. The \"phase\" field is set to \"code\" to indicate that the alert pertains to code-related issues. The detection is important because dependabot Alerts can indicate vulnerabilities in the codebase that can be exploited by attackers. Detecting and investigating these alerts can help a SOC to proactively address security risks and prevent potential breaches or unauthorized access to sensitive information. False positives might occur since there are legitimate actions that trigger the \"create\" action or if other factors exist that can generate similar log entries. Next steps include reviewing the details of the alert, such as the affected package, severity, and fixed version to determine the appropriate response and mitigation steps." +description: "The following analytic is made by first searching for logs that contain the action \"create\" and renames certain fields for easier analysis. Then, this analytic uses the \"stats\" command to calculate the first and last occurrence of the alert based on the timestamp. The fields included in the output are the action, affected package name, affected range, created date, external identifier, external reference, fixed version, severity, repository, repository URL, and user. The \"phase\" field is set to \"code\" to indicate that the alert pertains to code-related issues. The detection is important because dependabot Alerts can indicate vulnerabilities in the codebase that can be exploited by attackers. Detecting and investigating these alerts can help a SOC to proactively address security risks and prevent potential breaches or unauthorized access to sensitive information. False positives might occur since there are legitimate actions that trigger the \"create\" action or if other factors exist that can generate similar log entries. Next steps include reviewing the details of the alert, such as the affected package, severity, and fixed version to determine the appropriate response and mitigation steps." data_source: [] search: '`github` alert.id=* action=create | rename repository.full_name as repository, repository.html_url as repository_url sender.login as user | stats min(_time) as diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml index 25001b65f6..78ba133cf9 100644 --- a/detections/cloud/github_pull_request_from_unknown_user.yml +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -5,7 +5,7 @@ date: '2021-09-01' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: "As a prerequisite, ensure that you ingest GitHub logs into Splunk and have access to the following fields: (i)`check_suite.pull_requests` (ii) `check_suite.head_commit.author.name` (iii) `repository.full_name` (iv) `check_suite.pull_requests.head.ref` (v) `check_suite.head_commit.message`. This analytic detects pull requests from unknown users on GitHub. The detection is made by using a Splunk query to search for pull requests in the `check_suite.pull_requests` field where the `id` is not specified. Next, the analytic retrieves information such as the author's name, the repository's full name, the head reference of the pull request, and the commit message from the `check_suite.head_commit` field. The analytic also includes a step to exclude known users by using the `github_known_users` lookup table, which helps to filter out pull requests from known users and focus on the pull requests from unknown users. The detection is important because it locates potential malicious activity or unauthorized access since unknown users can introduce malicious code or gain unauthorized access to repositories leading to unauthorized code changes, data breaches, or other security incidents. Next steps include reviewing the author's name, the repository involved, the head reference of the pull request, and the commit message upon triage of a potential pull request from an unknown user. You must also analyze any relevant on-disk artifacts and investigate any concurrent processes to determine the source and intent of the pull request." +description: The following analytic detects pull requests from unknown users on GitHub. The detection is made by using a Splunk query to search for pull requests in the `check_suite.pull_requests` field where the `id` is not specified. Next, the analytic retrieves information such as the author's name, the repository's full name, the head reference of the pull request, and the commit message from the `check_suite.head_commit` field. The analytic also includes a step to exclude known users by using the `github_known_users` lookup table, which helps to filter out pull requests from known users and focus on the pull requests from unknown users. The detection is important because it locates potential malicious activity or unauthorized access since unknown users can introduce malicious code or gain unauthorized access to repositories leading to unauthorized code changes, data breaches, or other security incidents. Next steps include reviewing the author's name, the repository involved, the head reference of the pull request, and the commit message upon triage of a potential pull request from an unknown user. You must also analyze any relevant on-disk artifacts and investigate any concurrent processes to determine the source and intent of the pull request." data_source: [] search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name repository.full_name check_suite.pull_requests{}.head.ref check_suite.head_commit.message diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index 375e506937..ab81a6e841 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk status: production type: TTP description: |- - As a prerequisite, ensure that your Sysmon setup includes EventCode 10 logging for lsass.exe. This analytic detects the dumping of the LSASS process memory, which occurs during credential dumping attacks.The detection is made by using Sysmon logs, specifically EventCode 10, which is related to lsass.exe. This helps to search for indicators of LSASS memory dumping such as specific call traces to dbgcore.dll and dbghelp.dll. This detection is important because it prevents credential dumping attacks and the theft of sensitive information such as login credentials, which can be used to gain unauthorized access to systems and data. False positives might occur due to legitimate administrative tasks. Next steps include reviewing and investigating each case, given the high risk associated with potential credential dumping attacks. + The following analytic detects the dumping of the LSASS process memory, which occurs during credential dumping attacks.The detection is made by using Sysmon logs, specifically EventCode 10, which is related to lsass.exe. This helps to search for indicators of LSASS memory dumping such as specific call traces to dbgcore.dll and dbghelp.dll. This detection is important because it prevents credential dumping attacks and the theft of sensitive information such as login credentials, which can be used to gain unauthorized access to systems and data. False positives might occur due to legitimate administrative tasks. Next steps include reviewing and investigating each case, given the high risk associated with potential credential dumping attacks. data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index fce54c6a94..57604064cb 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -6,7 +6,7 @@ author: Patrick Bareiss, Rico Valdez, Splunk status: production type: TTP description: |- - As a prerequisite, ensure that you ingest data that records process activity and logs containing process names and command lines. This analytic detects whether a process is attempting to add a certificate to the untrusted certificate store, which might result in security tools being disabled. The detection is made by focusing on process activities and command-line arguments that are related to the 'certutil -addstore' command. This detection is important because it helps to identify attackers who might add a certificate to the untrusted certificate store to disable security tools and gain unauthorized access to a system. False positives might occur since legitimate reasons might exist for a process to add a certificate to the untrusted certificate store, such as system administration tasks. Next steps include conducting an extensive triage and investigation prior to taking any action. Additionally, you must understand the importance of trust and its subversion in system security. + The following analytic detects whether a process is attempting to add a certificate to the untrusted certificate store, which might result in security tools being disabled. The detection is made by focusing on process activities and command-line arguments that are related to the 'certutil -addstore' command. This detection is important because it helps to identify attackers who might add a certificate to the untrusted certificate store to disable security tools and gain unauthorized access to a system. False positives might occur since legitimate reasons might exist for a process to add a certificate to the untrusted certificate store, such as system administration tasks. Next steps include conducting an extensive triage and investigation prior to taking any action. Additionally, you must understand the importance of trust and its subversion in system security. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 19375f997f..408639d0d8 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk status: production type: TTP description: |- - As a prerequisite, ensure that you are collecting and ingesting endpoint process logs that include information about the net.exe command. This analytic detects the creation or deletion of hidden shares using the net.exe command for prompt response and mitigation to enhance the overall security posture of the organization and protect against potential data breaches, malware infections, and other damaging outcomes. This detection is made by searching for processes that involve the use of net.exe and filters for actions related to creation or deletion of shares. This detection is important because it suggests that an attacker is attempting to manipulate or exploit the network by creating or deleting hidden shares. The creation or deletion of hidden shares can indicate malicious activity since attackers might use hidden shares to exfiltrate data, distribute malware, or establish persistence within a network. The impact of such an attack can vary, but it often involves unauthorized access to sensitive information, disruption of services, or the introduction of malware. False positives might occur since legitimate actions can also involve the use of net.exe. An extensive triage and investigation is necessary to determine the intent and nature of the detected activity. Next steps include reviewing the details of the process involving the net.exe command, including the user, parent process, and timestamps during the triage. Additionally, capture and inspect any relevant on-disk artifacts and review concurrent processes to identify the source of the attack. + The following analytic detects the creation or deletion of hidden shares using the net.exe command for prompt response and mitigation to enhance the overall security posture of the organization and protect against potential data breaches, malware infections, and other damaging outcomes. This detection is made by searching for processes that involve the use of net.exe and filters for actions related to creation or deletion of shares. This detection is important because it suggests that an attacker is attempting to manipulate or exploit the network by creating or deleting hidden shares. The creation or deletion of hidden shares can indicate malicious activity since attackers might use hidden shares to exfiltrate data, distribute malware, or establish persistence within a network. The impact of such an attack can vary, but it often involves unauthorized access to sensitive information, disruption of services, or the introduction of malware. False positives might occur since legitimate actions can also involve the use of net.exe. An extensive triage and investigation is necessary to determine the intent and nature of the detected activity. Next steps include reviewing the details of the process involving the net.exe command, including the user, parent process, and timestamps during the triage. Additionally, capture and inspect any relevant on-disk artifacts and review concurrent processes to identify the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count values(Processes.user) as diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index fdd3ebba26..b42bec9689 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk status: production type: TTP -description: "As a prerequisite, ensure that you are ingesting endpoint process logs into your Splunk instance. This analytic detects the use of the copy command to dump credentials from a shadow copy so that you can detect potential threats earlier and mitigate the risks associated with credential dumping. The detection is made by using a Splunk query to search for specific processes that indicate credential dumping activity. The query looks for processes with command lines that include references to certain files, such as \"sam\", \"security\", \"system\", and \"ntds.dit\", located in system directories like \"system32\" or \"windows\". The detection is important because it suggests that an attacker is attempting to extract credentials from a shadow copy. Credential dumping is a common technique used by attackers to obtain sensitive login information and gain unauthorized access to systems to escalate privileges, move laterally within the network, or gain unauthorized access to sensitive data. False positives might occur since legitimate processes might also reference these files. During triage, it is crucial to review the process details, including the source and the command that is run. Additionally, you must capture and analyze any relevant on-disk artifacts and investigate concurrent processes to determine the source of the attack. Additional steps include...." +description: "The following analytic detects the use of the copy command to dump credentials from a shadow copy so that you can detect potential threats earlier and mitigate the risks associated with credential dumping. The detection is made by using a Splunk query to search for specific processes that indicate credential dumping activity. The query looks for processes with command lines that include references to certain files, such as \"sam\", \"security\", \"system\", and \"ntds.dit\", located in system directories like \"system32\" or \"windows\". The detection is important because it suggests that an attacker is attempting to extract credentials from a shadow copy. Credential dumping is a common technique used by attackers to obtain sensitive login information and gain unauthorized access to systems to escalate privileges, move laterally within the network, or gain unauthorized access to sensitive data. False positives might occur since legitimate processes might also reference these files. During triage, it is crucial to review the process details, including the source and the command that is run. Additionally, you must capture and analyze any relevant on-disk artifacts and investigate concurrent processes to determine the source of the attack" data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index 38baa7ddc4..637a996290 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk status: production type: TTP description: |- - As a prerequisite, ensure that sysmon events are being ingested and monitored. This analytic detects the reading of lsass memory, which is consistent with credential dumping. Reading lsass memory is a common technique used by attackers to steal credentials from the Windows operating system. The detection is made by monitoring the sysmon events and filtering for specific access permissions (0x1010 and 0x1410) on the lsass.exe process helps identify potential instances of credential dumping.The detection is important because it suggests that an attacker is attempting to extract credentials from the lsass memory, which can lead to unauthorized access, data breaches, and compromise of sensitive information. Credential dumping is often a precursor to further attacks, such as lateral movement, privilege escalation, or data exfiltration. False positives can occur due to legitimate actions that involve accessing lsass memory. Therefore, extensive triage and investigation are necessary to differentiate between malicious and benign activities. + The following analytic detects the reading of lsass memory, which is consistent with credential dumping. Reading lsass memory is a common technique used by attackers to steal credentials from the Windows operating system. The detection is made by monitoring the sysmon events and filtering for specific access permissions (0x1010 and 0x1410) on the lsass.exe process helps identify potential instances of credential dumping.The detection is important because it suggests that an attacker is attempting to extract credentials from the lsass memory, which can lead to unauthorized access, data breaches, and compromise of sensitive information. Credential dumping is often a precursor to further attacks, such as lateral movement, privilege escalation, or data exfiltration. False positives can occur due to legitimate actions that involve accessing lsass memory. Therefore, extensive triage and investigation are necessary to differentiate between malicious and benign activities. data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index b6ccf4ec21..0e9cc0380a 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk status: production type: TTP description: |- - 1. As a prerequisite, ensure that logs with process information are ingested from your endpoints. This analytic detects the behavior of dumping credentials from memory, a tactic commonly used by adversaries to exploit the Local Security Authority Subsystem Service (LSASS) in Windows, which manages system-level authentication. The detection is made by monitoring logs with process information from endpoints and identifying instances where the rundll32 process is used in conjunction with the comsvcs.dll and MiniDump. This indicates potential LSASS dumping attempts used by threat actors to obtain valuable credentials. The detection is important because credential theft can lead to broader system compromise, persistence, lateral movement, and escalated privileges. No legitimate use of this technique has been identified yet. This behavior is often part of more extensive attack campaigns and is associated with numerous threat groups that use the stolen credentials to access sensitive information or systems, leading to data theft, ransomware attacks, or other damaging outcomes. False positives can occur since legitimate uses of the LSASS process can cause benign activities to be flagged. Next steps include reviewing the processes involved in the LSASS dumping attempt after triage and inspecting any relevant on-disk artifacts and concurrent processes to identify the attack source. + The following analytic detects the behavior of dumping credentials from memory, a tactic commonly used by adversaries to exploit the Local Security Authority Subsystem Service (LSASS) in Windows, which manages system-level authentication. The detection is made by monitoring logs with process information from endpoints and identifying instances where the rundll32 process is used in conjunction with the comsvcs.dll and MiniDump. This indicates potential LSASS dumping attempts used by threat actors to obtain valuable credentials. The detection is important because credential theft can lead to broader system compromise, persistence, lateral movement, and escalated privileges. No legitimate use of this technique has been identified yet. This behavior is often part of more extensive attack campaigns and is associated with numerous threat groups that use the stolen credentials to access sensitive information or systems, leading to data theft, ransomware attacks, or other damaging outcomes. False positives can occur since legitimate uses of the LSASS process can cause benign activities to be flagged. Next steps include reviewing the processes involved in the LSASS dumping attempt after triage and inspecting any relevant on-disk artifacts and concurrent processes to identify the attack source. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index ca8470407a..93116a0bbb 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -6,7 +6,7 @@ author: David Dorsey, Splunk status: production type: TTP description: |- - As a prerequisite, ensure that endpoint logs are being ingested and processed by Splunk. This analytic detects a behavior where a process name consists only of a single letter that helps to detect potential threats earlier and mitigate the risks. This detection is important because it indicates the presence of malware or an attacker attempting to evade detection by using a process name that is difficult to identify or track so that he can carry out malicious activities such as data theft or ransomware attacks. False positives might occur since there might be legitimate uses of single-letter process names in your environment. Next steps include reviewing the process details and investigating any suspicious activity upon triage. + The following analytic detects a behavior where a process name consists only of a single letter that helps to detect potential threats earlier and mitigate the risks. This detection is important because it indicates the presence of malware or an attacker attempting to evade detection by using a process name that is difficult to identify or track so that he can carry out malicious activities such as data theft or ransomware attacks. False positives might occur since there might be legitimate uses of single-letter process names in your environment. Next steps include reviewing the process details and investigating any suspicious activity upon triage. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index e9043353c5..ad493f126c 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -6,7 +6,7 @@ author: Rico Valdez, Splunk status: production type: TTP description: |- - As a prerequisite, ensure that you are ingesting logs with the endpoint file system and process information. This analytic detects when a process other than explorer.exe writes to the Windows Recycle Bin to detect potential threats earlier and mitigate the risks. This detection is made by a Splunk query that utilizes the Endpoint.Filesystem data model and the Endpoint.Processes data model. The query looks for any process writing to the "*$Recycle.Bin*" file path, excluding explorer.exe. This detection is important because it suggests that an attacker is attempting to hide their activities by using the Recycle Bin, which can lead to data theft, ransomware, or other damaging outcomes. Detecting writes to the Recycle Bin by a process other than explorer.exe can help to investigate and determine if the activity is malicious or benign. False positives might occur since there might be legitimate uses of the Recycle Bin by processes other than explorer.exe. Next steps include reviewing the process writing to the Recycle Bin and any relevant on-disk artifacts upon triage. + The following analytic detects when a process other than explorer.exe writes to the Windows Recycle Bin to detect potential threats earlier and mitigate the risks. This detection is made by a Splunk query that utilizes the Endpoint.Filesystem data model and the Endpoint.Processes data model. The query looks for any process writing to the "*$Recycle.Bin*" file path, excluding explorer.exe. This detection is important because it suggests that an attacker is attempting to hide their activities by using the Recycle Bin, which can lead to data theft, ransomware, or other damaging outcomes. Detecting writes to the Recycle Bin by a process other than explorer.exe can help to investigate and determine if the activity is malicious or benign. False positives might occur since there might be legitimate uses of the Recycle Bin by processes other than explorer.exe. Next steps include reviewing the process writing to the Recycle Bin and any relevant on-disk artifacts upon triage. data_source: - Sysmon Event ID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml index 970416ca51..69b8b2ed72 100644 --- a/detections/endpoint/unusually_long_command_line.yml +++ b/detections/endpoint/unusually_long_command_line.yml @@ -6,7 +6,7 @@ author: David Dorsey, Splunk status: experimental type: Anomaly description: |- - As a prerequisite, ensure that you ingest logs with process information from your endpoints into Splunk. This analytic detects command lines that are extremely long, which might be indicative of malicious activity on your hosts because attackers often use obfuscated or complex command lines to hide their actions and evade detection. This helps to mitigate the risks associated with long command lines to enhance your overall security posture and reduce the impact of attacks. This detection is important because it suggests that an attacker might be attempting to execute a malicious command or payload on the host, which can lead to various damaging outcomes such as data theft, ransomware, or further compromise of the system. False positives might occur since legitimate processes or commands can sometimes result in long command lines. Next steps include conducting extensive triage and investigation to differentiate between legitimate and malicious activities. Review the source of the command line and the command itself during the triage. Additionally, capture and inspect any relevant on-disk artifacts and review concurrent processes to identify the source of the attack. + The following analytic detects command lines that are extremely long, which might be indicative of malicious activity on your hosts because attackers often use obfuscated or complex command lines to hide their actions and evade detection. This helps to mitigate the risks associated with long command lines to enhance your overall security posture and reduce the impact of attacks. This detection is important because it suggests that an attacker might be attempting to execute a malicious command or payload on the host, which can lead to various damaging outcomes such as data theft, ransomware, or further compromise of the system. False positives might occur since legitimate processes or commands can sometimes result in long command lines. Next steps include conducting extensive triage and investigation to differentiate between legitimate and malicious activities. Review the source of the command line and the command itself during the triage. Additionally, capture and inspect any relevant on-disk artifacts and review concurrent processes to identify the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index e774168be3..71433677a0 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -7,7 +7,7 @@ type: TTP status: production data_source: - Windows Security 4719 -description: "As a prerequisite, ensure that logs containing information about audit policy changes are being ingested from the domain controller. This analytic detects the disabling of audit policies on a domain controller. The detection is made by identifying changes made to audit policies and checks for the removal of success or failure auditing, which are common indicators of policy tampering. The detection is important because it indicates that an attacker has gained access to the domain controller and is attempting to evade detection and cover up malicious activity. The impact of such an attack can be severe, including data theft, privilege escalation, and compromise of the entire network. False positives might occur since legitimate changes to audit policies might also trigger the analytic. Upon triage, review the audit policy change event and investigate the source of the change. Additionally, you must capture and inspect any relevant on-disk artifacts and review concurrent processes to identify the attack source." +description: The following analytic detects the disabling of audit policies on a domain controller. The detection is made by identifying changes made to audit policies and checks for the removal of success or failure auditing, which are common indicators of policy tampering. The detection is important because it indicates that an attacker has gained access to the domain controller and is attempting to evade detection and cover up malicious activity. The impact of such an attack can be severe, including data theft, privilege escalation, and compromise of the entire network. False positives might occur since legitimate changes to audit policies might also trigger the analytic. Upon triage, review the audit policy change event and investigate the source of the change. Additionally, you must capture and inspect any relevant on-disk artifacts and review concurrent processes to identify the attack source." search: '`wineventlog_security` EventCode=4719 (AuditPolicyChanges IN ("%%8448","%%8450","%%8448, %%8450") OR Changes IN ("Failure removed","Success removed","Success removed, Failure removed")) dest_category="domain_controller"| replace "%%8448" with "Success removed", diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 5435050d48..b760357b94 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -6,7 +6,7 @@ author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP description: |- - As a prerequisite, ensure that you are ingesting logs with process information from your endpoints. This analytic detects when reg.exe modify registry keys that define Windows services and their configurations in Windows to detect potential threats earlier and mitigate the risks. This detection is made by a Splunk query that searches for specific keywords in the process name, parent process name, user, and process ID. This detection is important because it suggests that an attacker has modified the registry keys that define Windows services and their configurations, which can allow them to maintain access to the system and potentially move laterally within the network. It is a common technique used by attackers to gain persistence on a compromised system and its impact can lead to data theft, ransomware, or other damaging outcomes. False positives can occur since legitimate uses of reg.exe to modify registry keys for Windows services can also trigger this alert. Next steps include reviewing the process and user context of the reg.exe activity and identify any other concurrent processes that might be associated with the attack upon triage. + The following analytic detects when reg.exe modify registry keys that define Windows services and their configurations in Windows to detect potential threats earlier and mitigate the risks. This detection is made by a Splunk query that searches for specific keywords in the process name, parent process name, user, and process ID. This detection is important because it suggests that an attacker has modified the registry keys that define Windows services and their configurations, which can allow them to maintain access to the system and potentially move laterally within the network. It is a common technique used by attackers to gain persistence on a compromised system and its impact can lead to data theft, ransomware, or other damaging outcomes. False positives can occur since legitimate uses of reg.exe to modify registry keys for Windows services can also trigger this alert. Next steps include reviewing the process and user context of the reg.exe activity and identify any other concurrent processes that might be associated with the attack upon triage. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index ad44a4067b..504a5bd5b2 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -6,7 +6,7 @@ author: Rico Valdez, Splunk status: experimental type: TTP description: |- - As a prerequisite, ensure that you are collecting and analyzing Sysmon Event ID 5 data from your endpoints. This analytic detects the creation of permanent event subscriptions using Windows Management Instrumentation (WMI), which is used by attackers to achieve persistence in a compromised system. By creating a permanent event subscription, an attacker can run malicious scripts or binaries in response to specific system events that enables them to maintain access to the system undetected. The detection is made by using Sysmon Event ID 5 data to detect instances where the consumers of these events are not the expected "NTEventLogEventConsumer." The detection is important because it identifies unusual or unexpected subscription creation, which suggests that an attacker is attempting to achieve persistence within the environment and might be executing malicious scripts or binaries in response to specific system events. The impact of such an attack can be severe, potentially leading to data theft, ransomware, or other damaging outcomes. False positives might occur since False positives might occur since WMI event subscriptions can be used for legitimate purposes by system administrators. You must have a thorough understanding of WMI activity within the context of the monitored environment to effectively differentiate between legitimate and malicious activity.Next steps include investigating the associated scripts or binaries and identifying the source of the attack. + The following analytic detects the creation of permanent event subscriptions using Windows Management Instrumentation (WMI), which is used by attackers to achieve persistence in a compromised system. By creating a permanent event subscription, an attacker can run malicious scripts or binaries in response to specific system events that enables them to maintain access to the system undetected. The detection is made by using Sysmon Event ID 5 data to detect instances where the consumers of these events are not the expected "NTEventLogEventConsumer." The detection is important because it identifies unusual or unexpected subscription creation, which suggests that an attacker is attempting to achieve persistence within the environment and might be executing malicious scripts or binaries in response to specific system events. The impact of such an attack can be severe, potentially leading to data theft, ransomware, or other damaging outcomes. False positives might occur since False positives might occur since WMI event subscriptions can be used for legitimate purposes by system administrators. You must have a thorough understanding of WMI activity within the context of the monitored environment to effectively differentiate between legitimate and malicious activity.Next steps include investigating the associated scripts or binaries and identifying the source of the attack. data_source: - Sysmon Event ID 5 search: '`wmi` EventCode=5861 Binding | rex field=Message "Consumer =\s+(?[^;|^$]+)" diff --git a/detections/network/detect_zerologon_via_zeek.yml b/detections/network/detect_zerologon_via_zeek.yml index 0dcb12559a..e4260dedab 100644 --- a/detections/network/detect_zerologon_via_zeek.yml +++ b/detections/network/detect_zerologon_via_zeek.yml @@ -6,7 +6,7 @@ author: Shannon Davis, Splunk status: experimental type: TTP description: |- - As a prerequisite, ensure that you are ingesting Zeek logs that contain RPC activity. This analytic detects attempts to exploit the Zerologon CVE-2020-1472 vulnerability through Zeek RPC. By detecting attempts to exploit the Zerologon vulnerability through Zeek RPC, SOC analysts can identify potential threats earlier and take appropriate action to mitigate the risks. This detection is made by a Splunk query that looks for specific Zeek RPC operations, including NetrServerPasswordSet2, NetrServerReqChallenge, and NetrServerAuthenticate3, which are aggregated by source and destination IP address and time. This detection is important because it suggests that an attacker is attempting to exploit the Zerologon vulnerability to gain unauthorized access to the domain controller. Zerologon vulnerability is a critical vulnerability that allows attackers to take over domain controllers without authentication, leading to a complete takeover of an organization's IT infrastructure. The impact of such an attack can be severe, potentially leading to data theft, ransomware, or other devastating outcomes. False positives might occur since legitimate Zeek RPC activity can trigger the analytic. Next steps include reviewing the identified source and destination IP addresses and the specific RPC operations used. Capture and inspect any relevant on-disk artifacts, and review concurrent processes to identify the attack source upon triage . + The following analytic detects attempts to exploit the Zerologon CVE-2020-1472 vulnerability through Zeek RPC. By detecting attempts to exploit the Zerologon vulnerability through Zeek RPC, SOC analysts can identify potential threats earlier and take appropriate action to mitigate the risks. This detection is made by a Splunk query that looks for specific Zeek RPC operations, including NetrServerPasswordSet2, NetrServerReqChallenge, and NetrServerAuthenticate3, which are aggregated by source and destination IP address and time. This detection is important because it suggests that an attacker is attempting to exploit the Zerologon vulnerability to gain unauthorized access to the domain controller. Zerologon vulnerability is a critical vulnerability that allows attackers to take over domain controllers without authentication, leading to a complete takeover of an organization's IT infrastructure. The impact of such an attack can be severe, potentially leading to data theft, ransomware, or other devastating outcomes. False positives might occur since legitimate Zeek RPC activity can trigger the analytic. Next steps include reviewing the identified source and destination IP addresses and the specific RPC operations used. Capture and inspect any relevant on-disk artifacts, and review concurrent processes to identify the attack source upon triage . data_source: [] search: '`zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) | bin span=5m _time | stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) From bf7abc8ebfc05da662b358965a3ab0cd5c79bf7d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 13 Oct 2023 13:32:37 -0700 Subject: [PATCH 31/37] updated with proper format --- .../application/suspicious_email_attachment_extensions.yml | 2 +- .../application/web_servers_executing_suspicious_processes.yml | 2 +- .../azure_ad_privileged_role_assigned_to_service_principal.yml | 2 +- detections/cloud/circle_ci_disable_security_step.yml | 2 +- .../cloud/cloud_api_calls_from_previously_unseen_user_roles.yml | 2 +- detections/cloud/correlation_by_repository_and_risk.yml | 2 +- detections/cloud/correlation_by_user_and_risk.yml | 2 +- detections/cloud/o365_new_federated_domain_added.yml | 2 +- detections/cloud/o365_suspicious_user_email_forwarding.yml | 2 +- .../allow_inbound_traffic_by_firewall_rule_registry.yml | 2 +- detections/endpoint/attacker_tools_on_endpoint.yml | 2 +- detections/endpoint/attempt_to_stop_security_service.yml | 2 +- detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml | 2 +- detections/endpoint/common_ransomware_extensions.yml | 2 +- .../endpoint/create_local_admin_accounts_using_net_exe.yml | 2 +- detections/endpoint/create_remote_thread_into_lsass.yml | 2 +- .../creation_of_shadow_copy_with_wmic_and_powershell.yml | 2 +- .../endpoint/credential_dumping_via_symlink_to_shadow_copy.yml | 2 +- detections/endpoint/detect_baron_samedit_cve_2021_3156.yml | 2 +- .../endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml | 2 +- .../endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml | 2 +- detections/endpoint/detect_new_local_admin_account.yml | 2 +- detections/endpoint/disable_windows_app_hotkeys.yml | 2 +- detections/endpoint/file_with_samsam_extension.yml | 2 +- detections/endpoint/firewall_allowed_program_enable.yml | 2 +- detections/endpoint/linux_decode_base64_to_shell.yml | 2 +- detections/endpoint/powershell_invoke_wmiexec_usage.yml | 2 +- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- .../endpoint/scheduled_task_initiation_on_remote_endpoint.yml | 2 +- detections/endpoint/script_execution_via_wmi.yml | 2 +- detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml | 2 +- detections/endpoint/short_lived_windows_accounts.yml | 2 +- .../suspicious_process_dns_query_known_abuse_web_services.yml | 2 +- detections/endpoint/windows_abused_web_services.yml | 2 +- .../endpoint/windows_ad_domain_replication_acl_addition.yml | 2 +- .../endpoint/windows_command_shell_dcrat_forkbomb_payload.yml | 2 +- detections/endpoint/windows_moveit_transfer_writing_aspx.yml | 2 +- detections/endpoint/wmi_temporary_event_subscription.yml | 2 +- .../network/detect_windows_dns_sigred_via_splunk_stream.yml | 2 +- detections/network/detect_windows_dns_sigred_via_zeek.yml | 2 +- detections/network/smb_traffic_spike.yml | 2 +- .../web/microsoft_sharepoint_server_elevation_of_privilege.yml | 2 +- detections/web/sql_injection_with_long_urls.yml | 2 +- detections/web/supernova_webshell.yml | 2 +- 44 files changed, 44 insertions(+), 44 deletions(-) diff --git a/detections/application/suspicious_email_attachment_extensions.yml b/detections/application/suspicious_email_attachment_extensions.yml index bc9ad58e99..46ba35b0ff 100644 --- a/detections/application/suspicious_email_attachment_extensions.yml +++ b/detections/application/suspicious_email_attachment_extensions.yml @@ -6,7 +6,7 @@ author: David Dorsey, Splunk status: experimental type: Anomaly description: |- - This analytic detects emails that contain attachments with suspicious file extensions. Detecting and responding to emails with suspicious attachments can mitigate the risks associated with phishing and malware attacks, thereby protecting the organization's data and systems from potential harm. The detection is made by using a Splunk query that searches for emails in the datamodel=Email where the filename of the attachment is not empty. The analytic uses the tstats command to summarize the count, first time, and last time of the emails that meet the criteria. It groups the results by the source user, file name, and message ID of the email. The detection is important because it indicates potential phishing or malware delivery attempts in which an attacker attempts to deliver malicious content through email attachments, which can lead to data breaches, malware infections, or unauthorized access to sensitive information. Next steps include reviewing the identified emails and attachments and analyzing the source user, file name, and message ID to determine if they are legitimate or malicious. Additionally, you must inspect any relevant on-disk artifacts associated with the attachments and investigate any concurrent processes to identify the source of the attack. + The following analytic detects emails that contain attachments with suspicious file extensions. Detecting and responding to emails with suspicious attachments can mitigate the risks associated with phishing and malware attacks, thereby protecting the organization's data and systems from potential harm. The detection is made by using a Splunk query that searches for emails in the datamodel=Email where the filename of the attachment is not empty. The analytic uses the tstats command to summarize the count, first time, and last time of the emails that meet the criteria. It groups the results by the source user, file name, and message ID of the email. The detection is important because it indicates potential phishing or malware delivery attempts in which an attacker attempts to deliver malicious content through email attachments, which can lead to data breaches, malware infections, or unauthorized access to sensitive information. Next steps include reviewing the identified emails and attachments and analyzing the source user, file name, and message ID to determine if they are legitimate or malicious. Additionally, you must inspect any relevant on-disk artifacts associated with the attachments and investigate any concurrent processes to identify the source of the attack. data_source: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Email where All_Email.file_name="*" by All_Email.src_user, diff --git a/detections/application/web_servers_executing_suspicious_processes.yml b/detections/application/web_servers_executing_suspicious_processes.yml index c72751bf48..f3541da280 100644 --- a/detections/application/web_servers_executing_suspicious_processes.yml +++ b/detections/application/web_servers_executing_suspicious_processes.yml @@ -6,7 +6,7 @@ author: David Dorsey, Splunk status: experimental type: TTP description: |- - This analytic detects suspicious processes on systems labeled as web servers. This detection is made by a Splunk query that searches for specific process names that might indicate malicious activity. These suspicious processes include "whoami", "ping", "iptables", "wget", "service", and "curl". Uses the Splunk data model "Endpoint.Processes" and filters the results to only include systems categorized as web servers. This detection is important because it indicates unauthorized or malicious activity on web servers since these processes are commonly used by attackers to perform reconnaissance, establish persistence, or exfiltrate data from compromised systems. The impact of such an attack can be significant, ranging from data theft to the deployment of additional malicious payloads, potentially leading to ransomware or other damaging outcomes. False positives might occur since the legitimate use of these processes on web servers can trigger the analytic. Next steps include triaging and investigating to determine the legitimacy of the activity. Also, review the source and command of the suspicious process. You must also examine any relevant on-disk artifacts and look for concurrent processes to identify the source of the attack. + The following analytic detects suspicious processes on systems labeled as web servers. This detection is made by a Splunk query that searches for specific process names that might indicate malicious activity. These suspicious processes include "whoami", "ping", "iptables", "wget", "service", and "curl". Uses the Splunk data model "Endpoint.Processes" and filters the results to only include systems categorized as web servers. This detection is important because it indicates unauthorized or malicious activity on web servers since these processes are commonly used by attackers to perform reconnaissance, establish persistence, or exfiltrate data from compromised systems. The impact of such an attack can be significant, ranging from data theft to the deployment of additional malicious payloads, potentially leading to ransomware or other damaging outcomes. False positives might occur since the legitimate use of these processes on web servers can trigger the analytic. Next steps include triaging and investigating to determine the legitimacy of the activity. Also, review the source and command of the suspicious process. You must also examine any relevant on-disk artifacts and look for concurrent processes to identify the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml index b060963ab9..c471db3243 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml @@ -5,7 +5,7 @@ date: '2023-04-28' author: Mauricio Velazco, Splunk status: production type: TTP -description: "This analytic detects potential privilege escalation threats in Azure Active Directory (AD). The detection is made by running a specific search within the ingested Azure Active Directory events to leverage the AuditLogs log category. This detection is important because it identifies instances where privileged roles that hold elevated permissions are assigned to service principals. This prevents unauthorized access or malicious activities, which occur when these non-human entities access Azure resources to exploit them. False positives might occur since administrators can legitimately assign privileged roles to service principals." +description: "The following analytic detects potential privilege escalation threats in Azure Active Directory (AD). The detection is made by running a specific search within the ingested Azure Active Directory events to leverage the AuditLogs log category. This detection is important because it identifies instances where privileged roles that hold elevated permissions are assigned to service principals. This prevents unauthorized access or malicious activities, which occur when these non-human entities access Azure resources to exploit them. False positives might occur since administrators can legitimately assign privileged roles to service principals." data_source: [] search: ' `azuread` operationName="Add member to role" | rename properties.* as * | search "targetResources{}.type"=ServicePrincipal | rename initiatedBy.user.userPrincipalName diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/cloud/circle_ci_disable_security_step.yml index f4643e3681..c86ffa4ad7 100644 --- a/detections/cloud/circle_ci_disable_security_step.yml +++ b/detections/cloud/circle_ci_disable_security_step.yml @@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk status: experimental type: Anomaly description: |- - This analytic detects the disablement of security steps in a CircleCI pipeline. Addressing instances of security step disablement in CircleCI pipelines can mitigate the risks associated with potential security vulnerabilities and unauthorized changes. A proactive approach helps protect the organization's infrastructure, data, and overall security posture. The detection is made by a Splunk query that searches for specific criteria within CircleCI logs through a combination of field renaming, joining, and statistical analysis to identify instances where security steps are disabled. It retrieves information such as job IDs, job names, commit details, and user information from the CircleCI logs. The detection is important because it indicates potential security vulnerabilities or unauthorized changes to the pipeline caused by someone within the organization intentionally or unintentionally disabling security steps in the CircleCI pipeline.Disabling security steps can leave the pipeline and the associated infrastructure exposed to potential attacks, data breaches, or the introduction of malicious code into the pipeline. Investigate by reviewing the job name, commit details, and user information associated with the disablement of security steps. You must also examine any relevant on-disk artifacts and identify concurrent processes that might indicate the source of the attack or unauthorized change. + The following analytic detects the disablement of security steps in a CircleCI pipeline. Addressing instances of security step disablement in CircleCI pipelines can mitigate the risks associated with potential security vulnerabilities and unauthorized changes. A proactive approach helps protect the organization's infrastructure, data, and overall security posture. The detection is made by a Splunk query that searches for specific criteria within CircleCI logs through a combination of field renaming, joining, and statistical analysis to identify instances where security steps are disabled. It retrieves information such as job IDs, job names, commit details, and user information from the CircleCI logs. The detection is important because it indicates potential security vulnerabilities or unauthorized changes to the pipeline caused by someone within the organization intentionally or unintentionally disabling security steps in the CircleCI pipeline.Disabling security steps can leave the pipeline and the associated infrastructure exposed to potential attacks, data breaches, or the introduction of malicious code into the pipeline. Investigate by reviewing the job name, commit details, and user information associated with the disablement of security steps. You must also examine any relevant on-disk artifacts and identify concurrent processes that might indicate the source of the attack or unauthorized change. data_source: [] search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search `circleci` | stats values(name) as step_names count by job_id job_name ] | stats count by step_names diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index 5f53f0b674..50c0a843dc 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -6,7 +6,7 @@ author: David Dorsey, Splunk status: experimental type: Anomaly description: |- - This analytic detects when a new command is run by a user, who typically does not run those commands. The detection is made by a Splunk query to search for these commands in the Change data model. Identifies commands run by users with the user_type of AssumedRole and a status of success. The query retrieves the earliest and latest timestamps of each command run and groups the results by the user and command. Then, it drops the unnecessary data model object name and creates a lookup to verify if the command was seen before. The lookup table contains information about previously seen cloud API calls for each user role, including the first time the command was seen and whether enough data is available for analysis. If the firstTimeSeenUserApiCall field is null or greater than the relative time of 24 hours ago, it indicates that the command is new and was not seen before. The final result table includes the firstTime, user, object, and command fields of the new commands. It also applies the security_content_ctime function to format the timestamps and applies a filter to remove any cloud API calls from previously unseen user roles. The detection is important because it helps to identify new commands run by different user roles. New commands can indicate potential malicious activity or unauthorized actions within the environment. Detecting and investigating these new commands can help identify and mitigate potential security threats earlier, preventing data breaches, unauthorized access, or other damaging outcomes. + The following analytic detects when a new command is run by a user, who typically does not run those commands. The detection is made by a Splunk query to search for these commands in the Change data model. Identifies commands run by users with the user_type of AssumedRole and a status of success. The query retrieves the earliest and latest timestamps of each command run and groups the results by the user and command. Then, it drops the unnecessary data model object name and creates a lookup to verify if the command was seen before. The lookup table contains information about previously seen cloud API calls for each user role, including the first time the command was seen and whether enough data is available for analysis. If the firstTimeSeenUserApiCall field is null or greater than the relative time of 24 hours ago, it indicates that the command is new and was not seen before. The final result table includes the firstTime, user, object, and command fields of the new commands. It also applies the security_content_ctime function to format the timestamps and applies a filter to remove any cloud API calls from previously unseen user roles. The detection is important because it helps to identify new commands run by different user roles. New commands can indicate potential malicious activity or unauthorized actions within the environment. Detecting and investigating these new commands can help identify and mitigate potential security threats earlier, preventing data breaches, unauthorized access, or other damaging outcomes. data_source: [] search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, diff --git a/detections/cloud/correlation_by_repository_and_risk.yml b/detections/cloud/correlation_by_repository_and_risk.yml index 1558e53297..2b842ddf2f 100644 --- a/detections/cloud/correlation_by_repository_and_risk.yml +++ b/detections/cloud/correlation_by_repository_and_risk.yml @@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk status: production type: Correlation description: |- - This analytic detects by correlating repository and risk score to identify patterns and trends in the data based on the level of risk associated. The analytic adds any null values and calculates the sum of the risk scores for each detection. Then, the analytic captures the source and user information for each detection and sorts the results in ascending order based on the risk score. Finally, the analytic filters the detections with a risk score below 80 and focuses only on high-risk detections.This detection is important because it provides valuable insights into the distribution of high-risk activities across different repositories. It also identifies the most vulnerable repositories that are frequently targeted by potential threats. Additionally, it proactively detects and responds to potential threats, thereby minimizing the impact of attacks and safeguarding critical assets. Finally, it provides a comprehensive view of the risk landscape and helps to make informed decisions to protect the organization's data and infrastructure. False positives might occur so it is important to identify the impact of the attack and prioritize response and mitigation efforts. + The following analytic detects by correlating repository and risk score to identify patterns and trends in the data based on the level of risk associated. The analytic adds any null values and calculates the sum of the risk scores for each detection. Then, the analytic captures the source and user information for each detection and sorts the results in ascending order based on the risk score. Finally, the analytic filters the detections with a risk score below 80 and focuses only on high-risk detections.This detection is important because it provides valuable insights into the distribution of high-risk activities across different repositories. It also identifies the most vulnerable repositories that are frequently targeted by potential threats. Additionally, it proactively detects and responds to potential threats, thereby minimizing the impact of attacks and safeguarding critical assets. Finally, it provides a comprehensive view of the risk landscape and helps to make informed decisions to protect the organization's data and infrastructure. False positives might occur so it is important to identify the impact of the attack and prioritize response and mitigation efforts. data_source: [] search: '`risk_index` | fillnull | stats sum(risk_score) as risk_score values(source) as signals values(user) as user by repository | sort - risk_score | where risk_score diff --git a/detections/cloud/correlation_by_user_and_risk.yml b/detections/cloud/correlation_by_user_and_risk.yml index 2350f7cfe8..233f921bfb 100644 --- a/detections/cloud/correlation_by_user_and_risk.yml +++ b/detections/cloud/correlation_by_user_and_risk.yml @@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk status: production type: Correlation description: |- - This analytic detects the correlation between the user and risk score and identifies users with a high risk score that pose a significant security risk such as unauthorized access attempts, suspicious behavior, or potential insider threats. Next, the analytic calculates the sum of the risk scores and groups the results by user, the corresponding signals, and the repository. The results are sorted in descending order based on the risk score and filtered to include records with a risk score greater than 80. Finally, the results are passed through a correlation filter specific to the user and risk. This detection is important because it identifies users who have a high risk score and helps to prioritize investigations and allocate resources. False positives might occur but the impact of such an attack can vary depending on the specific scenario such as data exfiltration, system compromise, or the disruption of critical services. Please investigate this notable event. + The following analytic detects the correlation between the user and risk score and identifies users with a high risk score that pose a significant security risk such as unauthorized access attempts, suspicious behavior, or potential insider threats. Next, the analytic calculates the sum of the risk scores and groups the results by user, the corresponding signals, and the repository. The results are sorted in descending order based on the risk score and filtered to include records with a risk score greater than 80. Finally, the results are passed through a correlation filter specific to the user and risk. This detection is important because it identifies users who have a high risk score and helps to prioritize investigations and allocate resources. False positives might occur but the impact of such an attack can vary depending on the specific scenario such as data exfiltration, system compromise, or the disruption of critical services. Please investigate this notable event. data_source: [] search: '`risk_index` | fillnull | stats sum(risk_score) as risk_score values(source) as signals values(repository) as repository by user | sort - risk_score | where diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index a8f1083b00..4857d5b8aa 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -6,7 +6,7 @@ author: Rod Soto, Splunk status: production type: TTP description: |- - This analytic detects the addition of a new federated domain in an organization's Office 365 environment. Identifies instances where a new federated domain is added to the organization's Office 365 configuration and helps to take immediate action to mitigate the risks, prevent further unauthorized access, and protect the organization's data and systems. The detection is made by the Splunk query `o365_management_activity` with the parameters `Workload=Exchange` and `Operation="Add-FederatedDomain"`, which analyzes the management activity logs in Office 365 and filters for the specific operation to add a federated domain. The detection is important because identifying the addition of a new federated domain can indicate potential unauthorized access or compromise of the organization's Office 365 environment. A new Federated domain can be added by an attacker to gain unauthorized access, exfiltrate data, or carry out other malicious activity, which can lead to data breaches, unauthorized access to sensitive information, or compromise of the organization's systems and infrastructure. Next steps include viewing the details of the added federated domain, including the organization name, originating server, user ID, and user key. You must also capture and analyze any relevant on-disk artifacts. Additionally, you must identify the source of the attack by looking for concurrent processes or other indicators of compromise. + The following analytic detects the addition of a new federated domain in an organization's Office 365 environment. Identifies instances where a new federated domain is added to the organization's Office 365 configuration and helps to take immediate action to mitigate the risks, prevent further unauthorized access, and protect the organization's data and systems. The detection is made by the Splunk query `o365_management_activity` with the parameters `Workload=Exchange` and `Operation="Add-FederatedDomain"`, which analyzes the management activity logs in Office 365 and filters for the specific operation to add a federated domain. The detection is important because identifying the addition of a new federated domain can indicate potential unauthorized access or compromise of the organization's Office 365 environment. A new Federated domain can be added by an attacker to gain unauthorized access, exfiltrate data, or carry out other malicious activity, which can lead to data breaches, unauthorized access to sensitive information, or compromise of the organization's systems and infrastructure. Next steps include viewing the details of the added federated domain, including the organization name, originating server, user ID, and user key. You must also capture and analyze any relevant on-disk artifacts. Additionally, you must identify the source of the attack by looking for concurrent processes or other indicators of compromise. data_source: [] search: '`o365_management_activity` Operation IN ("*add*", "*new*") AND Operation="*domain*" | stats count values(ModifiedProperties{}.NewValue) as new_value by user user_agent diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 757964619e..026e001f13 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk status: production type: Anomaly description: |- - This analytic detects when multiple users have configured a forwarding rule to the same destination to proactively identify and investigate potential security risks related to email forwarding and take appropriate actions to protect the organization's data and prevent unauthorized access or data breaches. This detection is made by a Splunk query to O365 management activity logs with the operation `Set-Mailbox` to gather information about mailbox configurations. Then, the query uses the `spath` function to extract the parameters and rename the "Identity" field as "src_user" and searches for entries where the "ForwardingSmtpAddress" field is not empty, which indicates the presence of a forwarding rule. Next, the analytic uses the `stats` command to group the results by the forwarding email address and count the number of unique source users (`src_user`). Finally, it filters the results and only retains entries where the count of source users (`count_src_user`) is greater than 1, which indicates that multiple users have set up forwarding rules to the same destination. This detection is important because it suggests that multiple users are forwarding emails to the same destination without proper authorization, which can lead to the exposure of sensitive information, loss of data control, or unauthorized access to confidential emails. Investigating and addressing this issue promptly can help prevent data breaches and mitigate potential damage.indicates a potential security risk since multiple users forwarding emails to the same destination can be a sign of unauthorized access, data exfiltration, or a compromised account. Additionally, it also helps to determine if the forwarding rules are legitimate or if they indicate a security incident. False positives can occur if there are legitimate reasons for multiple users to forward emails to the same destination, such as a shared mailbox or a team collaboration scenario. Next steps include further investigation and context analysis to determine the legitimacy of the forwarding rules. + The following analytic detects when multiple users have configured a forwarding rule to the same destination to proactively identify and investigate potential security risks related to email forwarding and take appropriate actions to protect the organization's data and prevent unauthorized access or data breaches. This detection is made by a Splunk query to O365 management activity logs with the operation `Set-Mailbox` to gather information about mailbox configurations. Then, the query uses the `spath` function to extract the parameters and rename the "Identity" field as "src_user" and searches for entries where the "ForwardingSmtpAddress" field is not empty, which indicates the presence of a forwarding rule. Next, the analytic uses the `stats` command to group the results by the forwarding email address and count the number of unique source users (`src_user`). Finally, it filters the results and only retains entries where the count of source users (`count_src_user`) is greater than 1, which indicates that multiple users have set up forwarding rules to the same destination. This detection is important because it suggests that multiple users are forwarding emails to the same destination without proper authorization, which can lead to the exposure of sensitive information, loss of data control, or unauthorized access to confidential emails. Investigating and addressing this issue promptly can help prevent data breaches and mitigate potential damage.indicates a potential security risk since multiple users forwarding emails to the same destination can be a sign of unauthorized access, data exfiltration, or a compromised account. Additionally, it also helps to determine if the forwarding rules are legitimate or if they indicate a security incident. False positives can occur if there are legitimate reasons for multiple users to forward emails to the same destination, such as a shared mailbox or a team collaboration scenario. Next steps include further investigation and context analysis to determine the legitimacy of the forwarding rules. data_source: [] search: '`o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc(src_user) diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index b41aa519dd..978cd0ff78 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -5,7 +5,7 @@ date: '2023-03-29' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP -description: This analytic detects a potential suspicious modification of firewall +description: The following analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 0b4f1a21ca..4bedb11ac1 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk status: production type: TTP description: |- - This analytic detects the use of tools that are commonly exploited by cybercriminals since these tools are usually associated with malicious activities such as unauthorized access, network scanning, or data exfiltration and pose a significant threat to an organization's security infrastructure. It also provides enhanced visibility into potential security threats and helps to proactively detect and respond to mitigate the risks associated with cybercriminal activities. This detection is made by examining the process activity on the host, specifically focusing on processes that are known to be associated with attacker tool names. This detection is important because it acts as an early warning system for potential security incidents that allows you to respond to security incidents promptly. False positives might occur due to legitimate administrative activities that can resemble malicious actions. You must develop a comprehensive understanding of typical endpoint activities and behaviors within the organization to accurately interpret and respond to the alerts generated by this analytic. This ensures a proper balance between precision and minimizing false positives. + The following analytic detects the use of tools that are commonly exploited by cybercriminals since these tools are usually associated with malicious activities such as unauthorized access, network scanning, or data exfiltration and pose a significant threat to an organization's security infrastructure. It also provides enhanced visibility into potential security threats and helps to proactively detect and respond to mitigate the risks associated with cybercriminal activities. This detection is made by examining the process activity on the host, specifically focusing on processes that are known to be associated with attacker tool names. This detection is important because it acts as an early warning system for potential security incidents that allows you to respond to security incidents promptly. False positives might occur due to legitimate administrative activities that can resemble malicious actions. You must develop a comprehensive understanding of typical endpoint activities and behaviors within the organization to accurately interpret and respond to the alerts generated by this analytic. This ensures a proper balance between precision and minimizing false positives. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index 9a33bfa912..86719d804d 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -6,7 +6,7 @@ author: Rico Valdez, Splunk status: production type: TTP description: |- - This analytic detects attempts to stop security-related services on the endpoint and helps to mitigate potential threats earlier, thereby minimizing the impact on the organization's security. The detection is made by using a Splunk query that searches for processes that involve the "sc.exe" command and include the phrase "stop" in their command. The query collects information such as the process name, process ID, parent process, user, destination, and timestamps. The detection is important because attempts to stop security-related services can indicate malicious activity or an attacker's attempt to disable security measures. This can impact the organization's security posture and can lead to the compromise of the endpoint and potentially the entire network. Disabling security services can allow attackers to gain unauthorized access, exfiltrate sensitive data, or launch further attacks, such as malware installation or privilege escalation. False positives might occur since there might be legitimate reasons for stopping these services in certain situations. Therefore, you must exercise caution and consider the context of the activity before taking any action. Next steps include reviewing the identified process and its associated details. You must also investigate any on-disk artifacts related to the process and review concurrent processes to determine the source of the attack. + The following analytic detects attempts to stop security-related services on the endpoint and helps to mitigate potential threats earlier, thereby minimizing the impact on the organization's security. The detection is made by using a Splunk query that searches for processes that involve the "sc.exe" command and include the phrase "stop" in their command. The query collects information such as the process name, process ID, parent process, user, destination, and timestamps. The detection is important because attempts to stop security-related services can indicate malicious activity or an attacker's attempt to disable security measures. This can impact the organization's security posture and can lead to the compromise of the endpoint and potentially the entire network. Disabling security services can allow attackers to gain unauthorized access, exfiltrate sensitive data, or launch further attacks, such as malware installation or privilege escalation. False positives might occur since there might be legitimate reasons for stopping these services in certain situations. Therefore, you must exercise caution and consider the context of the activity before taking any action. Next steps include reviewing the identified process and its associated details. You must also investigate any on-disk artifacts related to the process and review concurrent processes to determine the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` values(Processes.process) as process diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index 422d1da8a8..c87f2334b0 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -5,7 +5,7 @@ date: '2021-05-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: This analytic detects a potential process using COM Object like CMLUA +description: The following analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. data_source: diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index cc2d6a7121..d423cb1609 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -5,7 +5,7 @@ date: '2022-11-10' author: David Dorsey, Michael Haag, Splunk, Steven Dick status: production type: Hunting -description: "This analytic detects Searches for file modifications that commonly occur with Ransomware to detect modifications to files with extensions that are commonly used by Ransomware. The detection is made by searches for changes in the datamodel=Endpoint.Filesystem, specifically modifications to file extensions that match those commonly used by Ransomware. The detection is important because it suggests that an attacker is attempting to encrypt or otherwise modify files in the environment using malware, potentially leading to data loss that can cause significant damage to an organization's data and systems. False positives might occur so the SOC must investigate the affected system to determine the source of the modification and take appropriate action to contain and remediate the attack." +description: "The following analytic detects Searches for file modifications that commonly occur with Ransomware to detect modifications to files with extensions that are commonly used by Ransomware. The detection is made by searches for changes in the datamodel=Endpoint.Filesystem, specifically modifications to file extensions that match those commonly used by Ransomware. The detection is important because it suggests that an attacker is attempting to encrypt or otherwise modify files in the environment using malware, potentially leading to data loss that can cause significant damage to an organization's data and systems. False positives might occur so the SOC must investigate the affected system to determine the source of the modification and take appropriate action to contain and remediate the attack." data_source: - Sysmon Event ID 11 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index dfde909970..9549b55d57 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk status: production type: TTP description: |- - This analytic detects the creation of local administrator accounts using the net.exe command to mitigate the risks associated with unauthorized access and prevent further damage to the environment by responding to potential threats earlier and taking appropriate actions to protect the organization's systems and data. This detection is made by a Splunk query to search for processes with the name net.exe or net1.exe that include the "/add" parameter and have specific keywords related to administrator accounts in their process name. This detection is important because the creation of unauthorized local administrator accounts might indicate that an attacker has successfully created a new administrator account and is trying to gain persistent access to a system or escalate their privileges for data theft, or other malicious activities. False positives might occur since there might be legitimate uses of the net.exe command and the creation of administrator accounts in certain circumstances. You must consider the context of the activity and other indicators of compromise before taking any action. For next steps, review the details of the identified process, including the user, parent process, and parent process name. Examine any relevant on-disk artifacts and look for concurrent processes to determine the source of the attack. + The following analytic detects the creation of local administrator accounts using the net.exe command to mitigate the risks associated with unauthorized access and prevent further damage to the environment by responding to potential threats earlier and taking appropriate actions to protect the organization's systems and data. This detection is made by a Splunk query to search for processes with the name net.exe or net1.exe that include the "/add" parameter and have specific keywords related to administrator accounts in their process name. This detection is important because the creation of unauthorized local administrator accounts might indicate that an attacker has successfully created a new administrator account and is trying to gain persistent access to a system or escalate their privileges for data theft, or other malicious activities. False positives might occur since there might be legitimate uses of the net.exe command and the creation of administrator accounts in certain circumstances. You must consider the context of the activity and other indicators of compromise before taking any action. For next steps, review the details of the identified process, including the user, parent process, and parent process name. Examine any relevant on-disk artifacts and look for concurrent processes to determine the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count values(Processes.user) as diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index 1d36230df4..6ab2c8e908 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -5,7 +5,7 @@ date: '2019-12-06' author: Patrick Bareiss, Splunk status: production type: TTP -description: "This analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS), which is a common tactic used by adversaries to steal user authentication credentials, known as credential dumping. The detection is made by leveraging Sysmon Event ID 8 logs and searches for processes that create remote threads in lsass.exe. This is an unusual activity that is generally linked to credential theft or credential dumping, which is a significant threat to network security. The detection is important because it helps to detect potential credential dumping attacks, which can result in significant damage to an organization's security. False positives might occur though the confidence level of this alert is high. There might be cases where legitimate tools can access LSASS and generate similar logs. Therefore, you must understand the broader context of such events and differentiate between legitimate activities and possible threats." +description: "The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS), which is a common tactic used by adversaries to steal user authentication credentials, known as credential dumping. The detection is made by leveraging Sysmon Event ID 8 logs and searches for processes that create remote threads in lsass.exe. This is an unusual activity that is generally linked to credential theft or credential dumping, which is a significant threat to network security. The detection is important because it helps to detect potential credential dumping attacks, which can result in significant damage to an organization's security. False positives might occur though the confidence level of this alert is high. There might be cases where legitimate tools can access LSASS and generate similar logs. Therefore, you must understand the broader context of such events and differentiate between legitimate activities and possible threats." data_source: - Sysmon Event ID 8 search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index 549358e4e1..7f1d5a9354 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk status: production type: TTP description: |- - This analytic detects the use of two specific tools, wmic and Powershell, to create a shadow copy to identify potential threats earlier and take appropriate actions to mitigate the risks. This detection is made by a Splunk query that searches for processes in the Endpoint.Processes data model where either the process name contains "wmic" or "Powershell" and the process command contains "shadowcopy" and "create". This detection is important because it suggests that an attacker is attempting to manipulate or access data in an unauthorized manner, which can lead to data theft, data manipulation, or other malicious activities. Attackers might use shadow copies to backup and exfiltrate sensitive data or to hide their tracks by restoring files to a previous state after an attack. Next steps include reviewing the user associated with the process, the process name, the original file name, the process command, and the destination of the process. Additionally, examine any relevant on-disk artifacts and review other concurrent processes to determine the source of the attack. + The following analytic detects the use of two specific tools, wmic and Powershell, to create a shadow copy to identify potential threats earlier and take appropriate actions to mitigate the risks. This detection is made by a Splunk query that searches for processes in the Endpoint.Processes data model where either the process name contains "wmic" or "Powershell" and the process command contains "shadowcopy" and "create". This detection is important because it suggests that an attacker is attempting to manipulate or access data in an unauthorized manner, which can lead to data theft, data manipulation, or other malicious activities. Attackers might use shadow copies to backup and exfiltrate sensitive data or to hide their tracks by restoring files to a previous state after an attack. Next steps include reviewing the user associated with the process, the process name, the original file name, the process command, and the destination of the process. Additionally, examine any relevant on-disk artifacts and review other concurrent processes to determine the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index ff37fc8b8d..1fd1cd1e58 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk status: production type: TTP description: |- - This analytic detects the creation of a symlink to a shadow copy to identify potential threats earlier and mitigate the risks associated with symlink creation to shadow copies. The detection is made by using a Splunk query that searches for processes with commands containing "mklink" and "HarddiskVolumeShadowCopy". This analytic retrieves information such as the destination, user, process name, process ID, parent process, original file name, and parent process ID from the Endpoint.Processes data model. The detection is important because it indicates potential malicious activity since attackers might use this technique to manipulate or delete shadow copies, which are used for system backup and recovery. This detection helps to determine if an attacker is attempting to cover their tracks or prevent data recovery in the event of an incident. The impact of such an attack can be significant since it can hinder incident response efforts, prevent data restoration, and potentially lead to data loss or compromise. Next steps include reviewing the details of the process, such as the destination and the user responsible for creating the symlink. Additionally, you must examine the parent process, any relevant on-disk artifacts, and concurrent processes to identify the source of the attack. + The following analytic detects the creation of a symlink to a shadow copy to identify potential threats earlier and mitigate the risks associated with symlink creation to shadow copies. The detection is made by using a Splunk query that searches for processes with commands containing "mklink" and "HarddiskVolumeShadowCopy". This analytic retrieves information such as the destination, user, process name, process ID, parent process, original file name, and parent process ID from the Endpoint.Processes data model. The detection is important because it indicates potential malicious activity since attackers might use this technique to manipulate or delete shadow copies, which are used for system backup and recovery. This detection helps to determine if an attacker is attempting to cover their tracks or prevent data recovery in the event of an incident. The impact of such an attack can be significant since it can hinder incident response efforts, prevent data restoration, and potentially lead to data loss or compromise. Next steps include reviewing the details of the process, such as the destination and the user responsible for creating the symlink. Additionally, you must examine the parent process, any relevant on-disk artifacts, and concurrent processes to identify the source of the attack. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml index e5074c4675..f05e62b8d9 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml @@ -6,7 +6,7 @@ author: Shannon Davis, Splunk status: experimental type: TTP description: |- - This analytic detects a specific type of vulnerability known as a heap-based buffer overflow in the sudoedit command, commonly referred to as Baron Samedit CVE-2021-3156. The detection is made by a Splunk query that searches for instances of the sudoedit command with the "-s" flag followed by a double quote. This combination of parameters is indicative of the vulnerability being exploited. The detection is important because it suggests that an attacker is attempting to exploit the Baron Samedit vulnerability. The Baron Samedit vulnerability allows an attacker to gain elevated privileges on a Linux system and run arbitrary code with root privileges, potentially leading to complete control over the affected system. The impact of a successful attack can be severe since it allows the attacker to bypass security measures and gain unauthorized access to sensitive data or systems. This can result in data breaches, unauthorized modifications, or even complete system compromise. Next steps include being aware of this vulnerability and actively monitoring any attempts to exploit it. By detecting and responding to such attacks in a timely manner, you can prevent or minimize the potential damage caused by the heap-based buffer overflow of sudoedit. + The following analytic detects a specific type of vulnerability known as a heap-based buffer overflow in the sudoedit command, commonly referred to as Baron Samedit CVE-2021-3156. The detection is made by a Splunk query that searches for instances of the sudoedit command with the "-s" flag followed by a double quote. This combination of parameters is indicative of the vulnerability being exploited. The detection is important because it suggests that an attacker is attempting to exploit the Baron Samedit vulnerability. The Baron Samedit vulnerability allows an attacker to gain elevated privileges on a Linux system and run arbitrary code with root privileges, potentially leading to complete control over the affected system. The impact of a successful attack can be severe since it allows the attacker to bypass security measures and gain unauthorized access to sensitive data or systems. This can result in data breaches, unauthorized modifications, or even complete system compromise. Next steps include being aware of this vulnerability and actively monitoring any attempts to exploit it. By detecting and responding to such attacks in a timely manner, you can prevent or minimize the potential damage caused by the heap-based buffer overflow of sudoedit. data_source: [] search: '`linux_hosts` "sudoedit -s \\" | `detect_baron_samedit_cve_2021_3156_filter`' how_to_implement: Splunk Universal Forwarder running on Linux systems, capturing logs diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml index cd0f3e7fd8..882b8c8188 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml @@ -6,7 +6,7 @@ author: Shannon Davis, Splunk status: experimental type: TTP description: |- - This analytic detects the occurrence of a heap-based buffer overflow in sudoedit.The detection is made by using a Splunk query to identify Linux hosts where the terms "sudoedit" and "segfault" appear in the logs. The detection is important because the heap-based buffer overflow vulnerability in sudoedit can be exploited by attackers to gain elevated root privileges on a vulnerable system, which might lead to the compromise of sensitive data, unauthorized access, and other malicious activities. False positives might occur. Therefore, you must review the logs and investigate further before taking any action. + The following analytic detects the occurrence of a heap-based buffer overflow in sudoedit.The detection is made by using a Splunk query to identify Linux hosts where the terms "sudoedit" and "segfault" appear in the logs. The detection is important because the heap-based buffer overflow vulnerability in sudoedit can be exploited by attackers to gain elevated root privileges on a vulnerable system, which might lead to the compromise of sensitive data, unauthorized access, and other malicious activities. False positives might occur. Therefore, you must review the logs and investigate further before taking any action. data_source: [] search: '`linux_hosts` TERM(sudoedit) TERM(segfault) | stats count min(_time) as firstTime max(_time) as lastTime by host | where count > 5 | `detect_baron_samedit_cve_2021_3156_segfault_filter`' diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml index 5a76a919b9..c6b942e6d7 100644 --- a/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml +++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml @@ -5,7 +5,7 @@ date: '2021-01-28' author: Shannon Davis, Splunk status: experimental type: TTP -description: "This analytic detects the heap-based buffer overflow for the sudoedit command and identifies instances where the command \"sudoedit -s *\" is run using the osquery_process data source. This indicates that the sudoedit command is used with the \"-s\" flag, which is associated with the heap-based buffer overflow vulnerability. The detection is important because it indicates a potential security vulnerability, specifically Baron Samedit CVE-2021-3156, which helps to identify and respond to potential heap-based buffer overflow attacks to enhance the security posture of the organization. This vulnerability allows an attacker to escalate privileges and potentially gain unauthorized access to the system. If the attack is successful, the attacker can gain full control of the system, run arbitrary code, or access sensitive data. Such attacks can lead to data breaches, unauthorized access, and potential disruption of critical systems. False positives might occur since the legitimate use of the sudoedit command with the \"-s\" flag can also trigger this detection. You must carefully review and validate the findings before taking any action. Next steps include investigating all true positive detections promptly, reviewing the associated processes, gather relevant artifacts, identifying the source of the attack to contain the threat, mitigate the risks, and prevent further damage to the environment." +description: "The following analytic detects the heap-based buffer overflow for the sudoedit command and identifies instances where the command \"sudoedit -s *\" is run using the osquery_process data source. This indicates that the sudoedit command is used with the \"-s\" flag, which is associated with the heap-based buffer overflow vulnerability. The detection is important because it indicates a potential security vulnerability, specifically Baron Samedit CVE-2021-3156, which helps to identify and respond to potential heap-based buffer overflow attacks to enhance the security posture of the organization. This vulnerability allows an attacker to escalate privileges and potentially gain unauthorized access to the system. If the attack is successful, the attacker can gain full control of the system, run arbitrary code, or access sensitive data. Such attacks can lead to data breaches, unauthorized access, and potential disruption of critical systems. False positives might occur since the legitimate use of the sudoedit command with the \"-s\" flag can also trigger this detection. You must carefully review and validate the findings before taking any action. Next steps include investigating all true positive detections promptly, reviewing the associated processes, gather relevant artifacts, identifying the source of the attack to contain the threat, mitigate the risks, and prevent further damage to the environment." data_source: [] search: '`osquery_process` | search "columns.cmdline"="sudoedit -s \\*" | `detect_baron_samedit_cve_2021_3156_via_osquery_filter`' how_to_implement: OSQuery installed and configured to pick up process events (info diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 0e8721e0d1..f95bcbaa00 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -6,7 +6,7 @@ author: David Dorsey, Splunk status: production type: TTP description: |- - This analytic detects the creation of new accounts that have been elevated to local administrators so that you can take immediate action to mitigate the risks and prevent further unauthorized access or malicious activities. This detection is made by using the Splunk query `wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) to search for relevant security events in the Windows event log. When a new account is created or an existing account is added to the Administrators group, this analytic identifies this behavior by looking for EventCode 4720 (A user account was created) or EventCode 4732 (A member was added to a security-enabled global group). This analytic specifically focuses on events where the Group_Name is set to Administrators. This detection is important because it suggests that an attacker has gained elevated privileges and can perform malicious actions with administrative access. This can lead to significant impact, such as unauthorized access to sensitive data, unauthorized modifications to systems or configurations, and potential disruption of critical services. identifying this behavior is crucial for a Security Operations Center (SOC). Next steps include reviewing the details of the security event, including the user account that was created or added to the Administrators group. Also, examine the time span between the first and last occurrence of the event to determine if the behavior is ongoing. Additionally, consider any contextual information, such as the destination where the account was created or added to understand the scope and potential impact of the attack. + The following analytic detects the creation of new accounts that have been elevated to local administrators so that you can take immediate action to mitigate the risks and prevent further unauthorized access or malicious activities. This detection is made by using the Splunk query `wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) to search for relevant security events in the Windows event log. When a new account is created or an existing account is added to the Administrators group, this analytic identifies this behavior by looking for EventCode 4720 (A user account was created) or EventCode 4732 (A member was added to a security-enabled global group). This analytic specifically focuses on events where the Group_Name is set to Administrators. This detection is important because it suggests that an attacker has gained elevated privileges and can perform malicious actions with administrative access. This can lead to significant impact, such as unauthorized access to sensitive data, unauthorized modifications to systems or configurations, and potential disruption of critical services. identifying this behavior is crucial for a Security Operations Center (SOC). Next steps include reviewing the details of the security event, including the user account that was created or added to the Administrators group. Also, examine the time span between the first and last occurrence of the event to determine if the behavior is ongoing. Additionally, consider any contextual information, such as the destination where the account was created or added to understand the scope and potential impact of the attack. data_source: - Windows Security 4732 - Windows Security 4720 diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index c16e65103a..cce1827b8a 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -5,7 +5,7 @@ date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunkk status: production type: TTP -description: This analytic detects a suspicious registry modification to disable Windows +description: The following analytic detects a suspicious registry modification to disable Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. This technique is used to impair the analyst in analyzing and removing the attacker diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index 2a1597a754..a75d16b944 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -6,7 +6,7 @@ author: Rico Valdez, Splunk status: production type: TTP description: |- - This analytic detects file writes with extensions that are consistent with a SamSam ransomware attack to proactively detect and respond to potential SamSam ransomware attacks, minimizing the impact and reducing the likelihood of successful ransomware infections. This detection is made by a Splunk query to search for specific file extensions that are commonly associated with SamSam ransomware, such as .stubbin, .berkshire, .satoshi, .sophos, and .keyxml. This identifies file extensions in the file names of the written files. If any file write events with these extensions are found, it suggests a potential SamSam ransomware attack. This detection is important because SamSam ransomware is a highly destructive and financially motivated attack and suggests that the organization is at risk of having its files encrypted and held for ransom, which can lead to significant financial losses, operational disruptions, and reputational damage. False positives might occur since legitimate files with these extensions can exist in the environment. Therefore, next steps include conducting a careful analysis and triage to confirm the presence of a SamSam ransomware attack. Next steps include taking immediate action to contain the attack, mitigate the impact, and prevent further spread of the ransomware. This might involve isolating affected systems, restoring encrypted files from backups, and conducting a thorough investigation to identify the attack source and prevent future incidents. + The following analytic detects file writes with extensions that are consistent with a SamSam ransomware attack to proactively detect and respond to potential SamSam ransomware attacks, minimizing the impact and reducing the likelihood of successful ransomware infections. This detection is made by a Splunk query to search for specific file extensions that are commonly associated with SamSam ransomware, such as .stubbin, .berkshire, .satoshi, .sophos, and .keyxml. This identifies file extensions in the file names of the written files. If any file write events with these extensions are found, it suggests a potential SamSam ransomware attack. This detection is important because SamSam ransomware is a highly destructive and financially motivated attack and suggests that the organization is at risk of having its files encrypted and held for ransom, which can lead to significant financial losses, operational disruptions, and reputational damage. False positives might occur since legitimate files with these extensions can exist in the environment. Therefore, next steps include conducting a careful analysis and triage to confirm the presence of a SamSam ransomware attack. Next steps include taking immediate action to contain the attack, mitigate the impact, and prevent further spread of the ransomware. This might involve isolating affected systems, restoring encrypted files from backups, and conducting a thorough investigation to identify the attack source and prevent future incidents. data_source: - Sysmon Event ID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index 2b4ad06cff..e8113eec50 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: This analytic detects a potential suspicious modification of firewall +description: The following analytic detects a potential suspicious modification of firewall rule allowing to execute specific application. This technique was identified when an adversary and red teams to bypassed firewall file execution restriction in a targetted host. Take note that this event or command can run by administrator during diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml index 2e32fe87d2..75470fb10f 100644 --- a/detections/endpoint/linux_decode_base64_to_shell.yml +++ b/detections/endpoint/linux_decode_base64_to_shell.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk status: production type: TTP description: |- - This analytic detects the behavior of decoding base64-encoded data and passing it to a Linux shell. Additionally, it mitigates the potential damage and protects the organization's systems and data.The detection is made by searching for specific commands in the Splunk query, namely "base64 -d" and "base64 --decode", within the Endpoint.Processes data model. The analytic also includes a filter for Linux shells. The detection is important because it indicates the presence of malicious activity since Base64 encoding is commonly used to obfuscate malicious commands or payloads, and decoding it can be a step in running those commands. It suggests that an attacker is attempting to run malicious commands on a Linux system to gain unauthorized access, for data exfiltration, or perform other malicious actions. + The following analytic detects the behavior of decoding base64-encoded data and passing it to a Linux shell. Additionally, it mitigates the potential damage and protects the organization's systems and data.The detection is made by searching for specific commands in the Splunk query, namely "base64 -d" and "base64 --decode", within the Endpoint.Processes data model. The analytic also includes a filter for Linux shells. The detection is important because it indicates the presence of malicious activity since Base64 encoding is commonly used to obfuscate malicious commands or payloads, and decoding it can be a step in running those commands. It suggests that an attacker is attempting to run malicious commands on a Linux system to gain unauthorized access, for data exfiltration, or perform other malicious actions. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/powershell_invoke_wmiexec_usage.yml b/detections/endpoint/powershell_invoke_wmiexec_usage.yml index 0315f78ea7..d0ee7ebc78 100644 --- a/detections/endpoint/powershell_invoke_wmiexec_usage.yml +++ b/detections/endpoint/powershell_invoke_wmiexec_usage.yml @@ -8,7 +8,7 @@ type: TTP status: production data_source: - Powershell 4104 -description: This analytic detects the usage of the Invoke-WMIExec utility within PowerShell Script Block Logging (EventCode 4104). The utility is used for executing WMI commands on targets using NTLMv2 pass-the-hash authentication. +description: The following analytic detects the usage of the Invoke-WMIExec utility within PowerShell Script Block Logging (EventCode 4104). The utility is used for executing WMI commands on targets using NTLMv2 pass-the-hash authentication. search: '`powershell` EventCode=4104 ScriptBlockText IN ("*invoke-wmiexec*") | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 294ed432a3..d8198192a5 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -6,7 +6,7 @@ author: Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk status: production type: TTP description: |- - This analytic detects the presence of a registry key related to the Remcos RAT agent on a host. This detection is made by a Splunk query to search for instances where the registry key "license" is found in the "Software\Remcos" path. This analytic combines information from two data models: Endpoint.Processes and Endpoint.Registry and retrieves process information such as user, process ID, process name, process path, destination, parent process name, parent process, and process GUID. This analytic also retrieves registry information such as registry path, registry key name, registry value name, registry value data, and process GUID. By joining the process GUID from the Endpoint.Processes data model with the process GUID from the Endpoint.Registry data model, the analytic identifies instances where the "license" registry key is found in the "Software\Remcos" path. This detection is important because it suggests that the host has been compromised by the Remcos RAT agent. Remcos is a well-known remote access Trojan that can be used by attackers to gain unauthorized access to systems and exfiltrate sensitive data. Identifying this behavior allows the SOC to take immediate action to remove the RAT agent and prevent further compromise. The impact of this attack can be severe, as the attacker can gain unauthorized access to the system, steal sensitive information, or use the compromised system as a launching point for further attacks. Next steps include using this analytic in conjunction with other security measures and threat intelligence to ensure accurate detection and response. + The following analytic detects the presence of a registry key related to the Remcos RAT agent on a host. This detection is made by a Splunk query to search for instances where the registry key "license" is found in the "Software\Remcos" path. This analytic combines information from two data models: Endpoint.Processes and Endpoint.Registry and retrieves process information such as user, process ID, process name, process path, destination, parent process name, parent process, and process GUID. This analytic also retrieves registry information such as registry path, registry key name, registry value name, registry value data, and process GUID. By joining the process GUID from the Endpoint.Processes data model with the process GUID from the Endpoint.Registry data model, the analytic identifies instances where the "license" registry key is found in the "Software\Remcos" path. This detection is important because it suggests that the host has been compromised by the Remcos RAT agent. Remcos is a well-known remote access Trojan that can be used by attackers to gain unauthorized access to systems and exfiltrate sensitive data. Identifying this behavior allows the SOC to take immediate action to remove the RAT agent and prevent further compromise. The impact of this attack can be severe, as the attacker can gain unauthorized access to the system, steal sensitive information, or use the compromised system as a launching point for further attacks. Next steps include using this analytic in conjunction with other security measures and threat intelligence to ensure accurate detection and response. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index b61efd6c77..ef5add6e41 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -5,7 +5,7 @@ date: '2021-11-11' author: Mauricio Velazco, Splunk status: production type: TTP -description: This analytic detects instances of 'schtasks.exe' being used to start +description: The following analytic detects instances of 'schtasks.exe' being used to start a Scheduled Task on a remote endpoint. Adversaries often abuse the Task Scheduler for lateral movement and remote code execution. The search parameters include process details such as the process name, parent process, and command-line executions. diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index edc529817b..8d76677720 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -6,7 +6,7 @@ author: Rico Valdez, Michael Haag, Splunk status: production type: TTP description: |- - This analytic detects any potential misuse of Windows Management Instrumentation (WMI) for malicious purposes since adversaries often use WMI to run scripts which allows them to carry out malicious activities without raising suspicion. The detection is made by monitoring the process 'scrcons.exe', which is essential to run WMI scripts. The detection is important because it proactively identifies and responds to potential threats that leverage WMI for malicious purposes that can lead to system compromise, data exfiltration, or the establishment of persistence within the environment. False positives might occur since administrators might occasionally use WMI to launch scripts for legitimate purposes. Therefore, you must distinguish between malicious and benign activities. + The following analytic detects any potential misuse of Windows Management Instrumentation (WMI) for malicious purposes since adversaries often use WMI to run scripts which allows them to carry out malicious activities without raising suspicion. The detection is made by monitoring the process 'scrcons.exe', which is essential to run WMI scripts. The detection is important because it proactively identifies and responds to potential threats that leverage WMI for malicious purposes that can lead to system compromise, data exfiltration, or the establishment of persistence within the environment. False positives might occur since administrators might occasionally use WMI to launch scripts for legitimate purposes. Therefore, you must distinguish between malicious and benign activities. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml index 5accd51ed6..de454726b1 100644 --- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -5,7 +5,7 @@ date: '2023-06-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: This analytic detects a potential usage of secretsdump.py tool for dumping +description: The following analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index 0f29405dfc..bbe55bf8df 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -6,7 +6,7 @@ author: David Dorsey, Splunk status: production type: TTP description: |- - This analytic detects the creation and deletion of accounts in a short time period to identify potential threats earlier and take appropriate actions to mitigate the risks. Helps prevent or minimize the potential damage caused by unauthorized access or malicious activities within the environment. This detection is made by a Splunk query that searches for events with the result IDs 4720 and 4726 in the "Change" data model. The query then groups the results by time, user, and destination. The result is filtered to only include events with the specified result IDs. The "transaction" command is used to group events that occur within a specified time span and have the same user but are not connected. Finally, the relevant information such as the first and last time of the event, the count, user, destination, and result ID are displayed in a table. This detection is important because it suggests that an attacker is attempting to create and delete accounts rapidly, potentially to cover their tracks or gain unauthorized access. The impact of such an attack can include unauthorized access to sensitive data, privilege escalation, or the ability to carry out further malicious activities within the environment. Next steps include investigating the events flagged by the analytic, review the account creation and deletion activities, and analyze any associated logs or artifacts to determine the intent and impact of the attack. + The following analytic detects the creation and deletion of accounts in a short time period to identify potential threats earlier and take appropriate actions to mitigate the risks. Helps prevent or minimize the potential damage caused by unauthorized access or malicious activities within the environment. This detection is made by a Splunk query that searches for events with the result IDs 4720 and 4726 in the "Change" data model. The query then groups the results by time, user, and destination. The result is filtered to only include events with the specified result IDs. The "transaction" command is used to group events that occur within a specified time span and have the same user but are not connected. Finally, the relevant information such as the first and last time of the event, the count, user, destination, and result ID are displayed in a table. This detection is important because it suggests that an attacker is attempting to create and delete accounts rapidly, potentially to cover their tracks or gain unauthorized access. The impact of such an attack can include unauthorized access to sensitive data, privilege escalation, or the ability to carry out further malicious activities within the environment. Next steps include investigating the events flagged by the analytic, review the account creation and deletion activities, and analyze any associated logs or artifacts to determine the intent and impact of the attack. data_source: [] search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index 380824a0c5..c15f730ffd 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -5,7 +5,7 @@ date: '2023-04-14' author: Teoderick Contreras, Splunk status: production type: TTP -description: This analytic detects a suspicious process making a DNS query via known, +description: The following analytic detects a suspicious process making a DNS query via known, abused text-paste web services, VoIP, instant messaging, and digital distribution platforms used to download external files. This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. This diff --git a/detections/endpoint/windows_abused_web_services.yml b/detections/endpoint/windows_abused_web_services.yml index e3578a6827..941257aa7c 100644 --- a/detections/endpoint/windows_abused_web_services.yml +++ b/detections/endpoint/windows_abused_web_services.yml @@ -7,7 +7,7 @@ status: production type: TTP data_source: - Sysmon Event ID 22 -description: This analytic detects a suspicious process making a DNS query via known, +description: The following analytic detects a suspicious process making a DNS query via known, abused text-paste web services, VoIP, internet via secure tunneling,instant messaging, and digital distribution platforms used to download external files. This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. This diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 6b8ee817e0..91eab3b69d 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -7,7 +7,7 @@ type: TTP status: experimental data_source: [] description: - This analytic detects the addition of the permissions necessary to perform a DCSync attack. + The following analytic detects the addition of the permissions necessary to perform a DCSync attack. In order to replicate AD objects, the initiating user or computer must have the following permissions on the domain. - DS-Replication-Get-Changes - DS-Replication-Get-Changes-All diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml index 3e87e0212b..81ccfb6e9a 100644 --- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml +++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml @@ -7,7 +7,7 @@ status: production type: TTP description: The following analytic identifies DCRat "forkbomb" payload feature. This technique was seen in dark crystal RAT backdoor capabilities where it will execute - several cmd child process executing "notepad.exe & pause". This analytic detects + several cmd child process executing "notepad.exe & pause". The following analytic detects the multiple cmd.exe and child process notepad.exe execution using batch script in the targeted host within 30s timeframe. this TTP can be a good pivot to check DCRat infection. diff --git a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml index 37ca8da052..6d5fe79c6f 100644 --- a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml +++ b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml @@ -7,7 +7,7 @@ status: experimental type: TTP data_source: - Sysmon Event ID 11 -description: This analytic detects the creation of new ASPX files in the MOVEit Transfer application's "wwwroot" directory. This activity is indicative of the recent critical vulnerability found in MOVEit Transfer, where threat actors have been observed exploiting a zero-day vulnerability to install a malicious ASPX file (e.g., "human2.aspx") in the wwwroot directory. The injected file could then be used to exfiltrate sensitive data, including user credentials and file metadata. The vulnerability affects the MOVEit Transfer managed file transfer software developed by Progress, a subsidiary of US-based Progress Software Corporation. This analytic requires endpoint data reflecting process and filesystem activity. The identified process must be responsible for the creation of new ASPX or ASHX files in the specified directory. +description: The following analytic detects the creation of new ASPX files in the MOVEit Transfer application's "wwwroot" directory. This activity is indicative of the recent critical vulnerability found in MOVEit Transfer, where threat actors have been observed exploiting a zero-day vulnerability to install a malicious ASPX file (e.g., "human2.aspx") in the wwwroot directory. The injected file could then be used to exfiltrate sensitive data, including user credentials and file metadata. The vulnerability affects the MOVEit Transfer managed file transfer software developed by Progress, a subsidiary of US-based Progress Software Corporation. This analytic requires endpoint data reflecting process and filesystem activity. The identified process must be responsible for the creation of new ASPX or ASHX files in the specified directory. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| diff --git a/detections/endpoint/wmi_temporary_event_subscription.yml b/detections/endpoint/wmi_temporary_event_subscription.yml index e9847509ee..d0f647f143 100644 --- a/detections/endpoint/wmi_temporary_event_subscription.yml +++ b/detections/endpoint/wmi_temporary_event_subscription.yml @@ -5,7 +5,7 @@ date: '2018-10-23' author: Rico Valdez, Splunk status: experimental type: TTP -description: "This analytic detects the creation of WMI temporary event subscriptions. WMI (Windows Management Instrumentation) is a management technology that allows administrators to perform various tasks on Windows-based systems. Temporary event subscriptions are created to monitor specific events or changes on a system that help to detect potential threats early and take proactive measures to protect the organization's systems and data. The detection is made by using the Splunk query `wmi` EventCode=5860 Temporary to search for events with EventCode 5860, which indicates the creation of a temporary WMI event subscription. To further refine the search results, the query uses regular expressions (rex) to extract the query used in the event subscription. Then, it filters known benign queries related to system processes such as 'wsmprovhost.exe' and 'AntiVirusProduct', 'FirewallProduct', 'AntiSpywareProduct', which helps to focus on potentially malicious or suspicious queries. The detection is important because it indicates malicious activity since attackers use WMI to run commands, gather information, or maintain persistence within a compromised system. False positives might occur since legitimate uses of WMI event subscriptions in the environment might trigger benign activities to be flagged. Therefore, an extensive triage is necessary to review the specific query and assess its intent. Additionally, capturing and inspecting relevant on-disk artifacts and analyzing concurrent processes can help to identify the source of the attack. Detecting the creation of these event subscriptions to identify potential threats early and take appropriate actions to mitigate the risks." +description: "The following analytic detects the creation of WMI temporary event subscriptions. WMI (Windows Management Instrumentation) is a management technology that allows administrators to perform various tasks on Windows-based systems. Temporary event subscriptions are created to monitor specific events or changes on a system that help to detect potential threats early and take proactive measures to protect the organization's systems and data. The detection is made by using the Splunk query `wmi` EventCode=5860 Temporary to search for events with EventCode 5860, which indicates the creation of a temporary WMI event subscription. To further refine the search results, the query uses regular expressions (rex) to extract the query used in the event subscription. Then, it filters known benign queries related to system processes such as 'wsmprovhost.exe' and 'AntiVirusProduct', 'FirewallProduct', 'AntiSpywareProduct', which helps to focus on potentially malicious or suspicious queries. The detection is important because it indicates malicious activity since attackers use WMI to run commands, gather information, or maintain persistence within a compromised system. False positives might occur since legitimate uses of WMI event subscriptions in the environment might trigger benign activities to be flagged. Therefore, an extensive triage is necessary to review the specific query and assess its intent. Additionally, capturing and inspecting relevant on-disk artifacts and analyzing concurrent processes can help to identify the source of the attack. Detecting the creation of these event subscriptions to identify potential threats early and take appropriate actions to mitigate the risks." data_source: - Sysmon Event ID 5 search: '`wmi` EventCode=5860 Temporary | rex field=Message "NotificationQuery =\s+(?[^;|^$]+)" diff --git a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml index 34bd0c9c38..1c4263b7e7 100644 --- a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml +++ b/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml @@ -5,7 +5,7 @@ date: '2020-07-28' author: Shannon Davis, Splunk status: experimental type: TTP -description: "Ensure that the following prerequisites are met: (i) Both Splunk Stream DNS and TCP data are ingested. (ii) The macros 'stream:dns' and 'stream:tcp' are replaced with the appropriate configurations that are specific to your Splunk environment. This analytic detects SIGRed exploitation attempts. SIGRed is a critical wormable vulnerability found in Windows DNS servers, known as CVE-2020-1350, which allows remote code execution. The detection is made by using an experimental search that focuses on identifying specific indicators that might suggest the presence of the SIGRed exploit such as DNS SIG records, KEY records, and TCP payloads greater than 65KB. This detection is important because it detects and responds to potential SIGRed exploitation attempts and minimizes the risk of a successful attack and its impact on the organization's infrastructure and data. False positives might occur due to the experimental nature of this analytic. Next steps include reviewing and investigating each case thoroughly given the potential for unauthorized Windows DNS server access, data breaches, and service disruptions. Additionally, you must stay updated with Microsoft's guidance on the SIGRed vulnerability." +description: "Ensure that the following prerequisites are met: (i) Both Splunk Stream DNS and TCP data are ingested. (ii) The macros 'stream:dns' and 'stream:tcp' are replaced with the appropriate configurations that are specific to your Splunk environment. The following analytic detects SIGRed exploitation attempts. SIGRed is a critical wormable vulnerability found in Windows DNS servers, known as CVE-2020-1350, which allows remote code execution. The detection is made by using an experimental search that focuses on identifying specific indicators that might suggest the presence of the SIGRed exploit such as DNS SIG records, KEY records, and TCP payloads greater than 65KB. This detection is important because it detects and responds to potential SIGRed exploitation attempts and minimizes the risk of a successful attack and its impact on the organization's infrastructure and data. False positives might occur due to the experimental nature of this analytic. Next steps include reviewing and investigating each case thoroughly given the potential for unauthorized Windows DNS server access, data breaches, and service disruptions. Additionally, you must stay updated with Microsoft's guidance on the SIGRed vulnerability." data_source: [] search: '`stream_dns` | spath "query_type{}" | search "query_type{}" IN (SIG,KEY) | spath protocol_stack | search protocol_stack="ip:tcp:dns" | append [search `stream_tcp` diff --git a/detections/network/detect_windows_dns_sigred_via_zeek.yml b/detections/network/detect_windows_dns_sigred_via_zeek.yml index e445b0ff41..88d788d304 100644 --- a/detections/network/detect_windows_dns_sigred_via_zeek.yml +++ b/detections/network/detect_windows_dns_sigred_via_zeek.yml @@ -6,7 +6,7 @@ author: Shannon Davis, Splunk status: experimental type: TTP description: |- - This analytic detects the presence of SIGRed, a critical DNS vulnerability, using Zeek DNS and Zeek Conn data. SIGRed vulnerability allows attackers to run remote code on Windows DNS servers. By detecting SIGRed early, you can prevent further damage and protect the organization's network infrastructure. The detection is made by identifying specific DNS query types (SIG and KEY) in the Zeek DNS data and checks for high data transfer in the Zeek Conn data. If multiple instances of these indicators are found within a flow, it suggests the presence of SIGRed. The detection is important because it indicates a potential compromise of Windows DNS servers that suggests that an attacker might have gained unauthorized access to the DNS server and can run arbitrary code. The impact of this attack can be severe, leading to data exfiltration, unauthorized access, or disruption of critical services. Next steps include investigating the affected flow and taking immediate action to mitigate the vulnerability. This can involve patching the affected DNS server, isolating the server from the network, or conducting a forensic analysis to determine the extent of the compromise. + The following analytic detects the presence of SIGRed, a critical DNS vulnerability, using Zeek DNS and Zeek Conn data. SIGRed vulnerability allows attackers to run remote code on Windows DNS servers. By detecting SIGRed early, you can prevent further damage and protect the organization's network infrastructure. The detection is made by identifying specific DNS query types (SIG and KEY) in the Zeek DNS data and checks for high data transfer in the Zeek Conn data. If multiple instances of these indicators are found within a flow, it suggests the presence of SIGRed. The detection is important because it indicates a potential compromise of Windows DNS servers that suggests that an attacker might have gained unauthorized access to the DNS server and can run arbitrary code. The impact of this attack can be severe, leading to data exfiltration, unauthorized access, or disruption of critical services. Next steps include investigating the affected flow and taking immediate action to mitigate the vulnerability. This can involve patching the affected DNS server, isolating the server from the network, or conducting a forensic analysis to determine the extent of the compromise. data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where DNS.query_type IN (SIG,KEY) by DNS.flow_id | rename DNS.flow_id as flow_id diff --git a/detections/network/smb_traffic_spike.yml b/detections/network/smb_traffic_spike.yml index fda2f3e8e2..c8513815dc 100644 --- a/detections/network/smb_traffic_spike.yml +++ b/detections/network/smb_traffic_spike.yml @@ -6,7 +6,7 @@ author: David Dorsey, Splunk status: experimental type: Anomaly description: |- - This analytic detects spikes in the number of Server Message Block (SMB) traffic connections. SMB is a network protocol used for sharing files, printers, and other resources between computers. This detection is made by a Splunk query that looks for SMB traffic connections on ports 139 and 445, as well as connections using the SMB application. The query calculates the average and standard deviation of the number of SMB connections over the past 70 minutes, and identifies any sources that exceed two standard deviations from the average. This helps to filter out false positives caused by normal fluctuations in SMB traffic. This detection is important because it identifies potential SMB-based attacks, such as ransomware or data theft, which often involve a large number of SMB connections. This suggests that an attacker is attempting to exfiltrate data or spread malware within the network. Next steps include investigating the source of the traffic and determining if it is malicious. This can involve reviewing network logs, capturing and analyzing any relevant network packets, and correlating with other security events to identify the attack source and mitigate the risk. + The following analytic detects spikes in the number of Server Message Block (SMB) traffic connections. SMB is a network protocol used for sharing files, printers, and other resources between computers. This detection is made by a Splunk query that looks for SMB traffic connections on ports 139 and 445, as well as connections using the SMB application. The query calculates the average and standard deviation of the number of SMB connections over the past 70 minutes, and identifies any sources that exceed two standard deviations from the average. This helps to filter out false positives caused by normal fluctuations in SMB traffic. This detection is important because it identifies potential SMB-based attacks, such as ransomware or data theft, which often involve a large number of SMB connections. This suggests that an attacker is attempting to exfiltrate data or spread malware within the network. Next steps include investigating the source of the traffic and determining if it is malicious. This can involve reviewing network logs, capturing and analyzing any relevant network packets, and correlating with other security events to identify the attack source and mitigate the risk. data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb diff --git a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml index 412ccf3d07..39c6f1cb5f 100644 --- a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml +++ b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml @@ -6,7 +6,7 @@ author: Michael Haag, Gowthamaraj Rajendran, Splunk status: production type: TTP data_source: [] -description: This analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2023-29357. This vulnerability pertains to an elevation of privilege due to improper handling of authentication tokens. By monitoring for suspicious activities related to SharePoint Server, the analytic identifies attempts to exploit this vulnerability. If a true positive is detected, it indicates a serious security breach where an attacker might have gained privileged access to the SharePoint environment, potentially leading to data theft or other malicious activities. +description: The following analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2023-29357. This vulnerability pertains to an elevation of privilege due to improper handling of authentication tokens. By monitoring for suspicious activities related to SharePoint Server, the analytic identifies attempts to exploit this vulnerability. If a true positive is detected, it indicates a serious security breach where an attacker might have gained privileged access to the SharePoint environment, potentially leading to data theft or other malicious activities. search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("/_api/web/siteusers*","/_api/web/currentuser*") Web.status=200 Web.http_method=GET by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype diff --git a/detections/web/sql_injection_with_long_urls.yml b/detections/web/sql_injection_with_long_urls.yml index 55e24ec94f..a4d7f4738a 100644 --- a/detections/web/sql_injection_with_long_urls.yml +++ b/detections/web/sql_injection_with_long_urls.yml @@ -5,7 +5,7 @@ date: '2022-03-28' author: Bhavin Patel, Splunk status: experimental type: TTP -description: "This analytic detects long URLs that contain multiple SQL commands. A proactive approach helps to detect and respond to potential threats earlier, mitigating the risks associated with SQL injection attacks. This detection is made by a Splunk query that searches for web traffic data where the destination category is a web server and the URL length is greater than 1024 characters or the HTTP user agent length is greater than 200 characters. This detection is important because it suggests that an attacker is attempting to exploit a web application through SQL injection. SQL injection is a common technique used by attackers to exploit vulnerabilities in web applications and gain unauthorized access to databases. Attackers can insert malicious SQL commands into a URL to manipulate the application's database and retrieve sensitive information or modify data. The impact of a successful SQL injection attack can be severe, potentially leading to data breaches, unauthorized access, and even complete compromise of the affected system. False positives might occur since the legitimate use of web applications or specific URLs in your environment can trigger the detection. Therefore, you must review and validate any alerts generated by this analytic before taking any action. Next steps include reviewing the source and destination of the web traffic, as well as the specific URL and HTTP user agent. Additionally, capture and analyze any relevant on-disk artifacts and review concurrent processes to determine the source of the attack." +description: "The following analytic detects long URLs that contain multiple SQL commands. A proactive approach helps to detect and respond to potential threats earlier, mitigating the risks associated with SQL injection attacks. This detection is made by a Splunk query that searches for web traffic data where the destination category is a web server and the URL length is greater than 1024 characters or the HTTP user agent length is greater than 200 characters. This detection is important because it suggests that an attacker is attempting to exploit a web application through SQL injection. SQL injection is a common technique used by attackers to exploit vulnerabilities in web applications and gain unauthorized access to databases. Attackers can insert malicious SQL commands into a URL to manipulate the application's database and retrieve sensitive information or modify data. The impact of a successful SQL injection attack can be severe, potentially leading to data breaches, unauthorized access, and even complete compromise of the affected system. False positives might occur since the legitimate use of web applications or specific URLs in your environment can trigger the detection. Therefore, you must review and validate any alerts generated by this analytic before taking any action. Next steps include reviewing the source and destination of the web traffic, as well as the specific URL and HTTP user agent. Additionally, capture and analyze any relevant on-disk artifacts and review concurrent processes to determine the source of the attack." data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Web where Web.dest_category=web_server AND (Web.url_length > 1024 OR Web.http_user_agent_length diff --git a/detections/web/supernova_webshell.yml b/detections/web/supernova_webshell.yml index f8afaff317..1080be1b61 100644 --- a/detections/web/supernova_webshell.yml +++ b/detections/web/supernova_webshell.yml @@ -6,7 +6,7 @@ author: John Stoner, Splunk status: experimental type: TTP description: |- - This analytic detects the presence of the Supernova webshell, which was used in the SUNBURST attack. This webshell can be used by attackers to gain unauthorized access to a compromised system and run arbitrary code. This detection is made by a Splunk query that searches for specific patterns in web URLs, including "*logoimagehandler.ashx*codes*", "*logoimagehandler.ashx*clazz*", "*logoimagehandler.ashx*method*", and "*logoimagehandler.ashx*args*". These patterns are commonly used by the Supernova webshell to communicate with its command and control server. This detection is important because it indicates a potential compromise and unauthorized access to the system to run arbitrary code, which can lead to data theft, ransomware, or other damaging outcomes. False positives might occur since the patterns used by the webshell can also be present in legitimate web traffic. In such cases, tune the search to the specific environment and monitor it closely for any suspicious activity. Next steps include reviewing the web URLs and inspecting any relevant on-disk artifacts. Additionally, review concurrent processes and network connections to identify the source of the attack. + The following analytic detects the presence of the Supernova webshell, which was used in the SUNBURST attack. This webshell can be used by attackers to gain unauthorized access to a compromised system and run arbitrary code. This detection is made by a Splunk query that searches for specific patterns in web URLs, including "*logoimagehandler.ashx*codes*", "*logoimagehandler.ashx*clazz*", "*logoimagehandler.ashx*method*", and "*logoimagehandler.ashx*args*". These patterns are commonly used by the Supernova webshell to communicate with its command and control server. This detection is important because it indicates a potential compromise and unauthorized access to the system to run arbitrary code, which can lead to data theft, ransomware, or other damaging outcomes. False positives might occur since the patterns used by the webshell can also be present in legitimate web traffic. In such cases, tune the search to the specific environment and monitor it closely for any suspicious activity. Next steps include reviewing the web URLs and inspecting any relevant on-disk artifacts. Additionally, review concurrent processes and network connections to identify the source of the attack. data_source: [] search: '| tstats `security_content_summariesonly` count from datamodel=Web.Web where web.url=*logoimagehandler.ashx*codes* OR Web.url=*logoimagehandler.ashx*clazz* OR From 52b666b7c9d94f3d4f03eea51056f4e07a52bdad Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 17 Oct 2023 11:10:25 -0600 Subject: [PATCH 32/37] Cisco IOS XE Vulnerability CVE-2023-20198 --- .../web/cisco_ios_xe_implant_access.yml | 58 +++++++++++++++++++ ...anagement_user_interface_vulnerability.yml | 18 ++++++ 2 files changed, 76 insertions(+) create mode 100644 detections/web/cisco_ios_xe_implant_access.yml create mode 100644 stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml diff --git a/detections/web/cisco_ios_xe_implant_access.yml b/detections/web/cisco_ios_xe_implant_access.yml new file mode 100644 index 0000000000..b544192873 --- /dev/null +++ b/detections/web/cisco_ios_xe_implant_access.yml @@ -0,0 +1,58 @@ +name: Cisco IOS XE Implant Access +id: 07c36cda-6567-43c3-bc1a-89dff61e2cd9 +version: 1 +date: '2023-10-17' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: [] +description: The following analytic identifies potential exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198). Successful exploitation allows an attacker to create an account on the affected device with privilege level 15 access, granting them full control of the compromised device. The detection is based on the observation of suspicious account creation and subsequent actions, including the deployment of an implant consisting of a configuration file. The implant is saved under the file path //usr//binos//conf//nginx-conf//cisco_service.conf and is not persistent, meaning a device reboot will remove it, but the newly created local user accounts remain active even after system reboots. The new user accounts have level 15 privileges, meaning they have full administrator access to the device. This privileged access to the devices and subsequent creation of new users is tracked as CVE-2023-20198. +search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("/webui/logoutconfirm.html?logon_hash=*") Web.http_method=POST Web.status=200 + by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `cisco_ios_xe_implant_access_filter`' +how_to_implement: This detection requires the Web datamodel to be populated from a + supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk + for Palo Alto. +known_false_positives: False positives may be present, restrict to Cisco IOS XE devices or perimeter appliances. Modify the analytic as needed based on hunting for successful exploitation of CVE-2023-20198. +references: +- https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/ +- https://github.com/vulncheck-oss/cisco-ios-xe-implant-scanner +tags: + cve: + - CVE-2023-20198 + analytic_story: + - Cisco IOS XE Software Web Management User Interface vulnerability + asset_type: Network + atomic_guid: + - UPDATE atomic_guid + confidence: 90 + impact: 90 + message: Possible exploitation of CVE-2023-20198 against $dest$. + mitre_attack_id: + - T1190 + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 81 + required_fields: + - _time + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/cisco/iosxe/ciscocve202320198.log + source: suricata + sourcetype: suricata diff --git a/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml b/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml new file mode 100644 index 0000000000..bca5355bae --- /dev/null +++ b/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml @@ -0,0 +1,18 @@ +name: Cisco IOS XE Software Web Management User Interface vulnerability +id: b5394b6a-b774-4bb6-a2bc-98f98cf7be88 +version: 1 +date: '2023-10-17' +author: Michael Haag, Splunk +description: Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks. Successful exploitation of this vulnerability allows an attacker to create an account on the affected device with privilege level 15 access, effectively granting them full control of the compromised device and allowing possible subsequent unauthorized activity. +narrative: Cisco discovered early evidence of potentially malicious activity on September 28, 2023, when a case was opened with Cisco's Technical Assistance Center (TAC) that identified unusual behavior on a customer device. Upon further investigation, they observed what they have determined to be related activity as early as September 18. The activity included an authorized user creating a local user account under the username “cisco_tac_admin” from a suspicious IP address. On October 12, Cisco Talos Incident Response (Talos IR) and TAC detected what they later determined to be an additional cluster of related activity that began on that same day. In this cluster, an unauthorized user was observed creating a local user account under the name “cisco_support” from a second suspicious IP address. Unlike the September case, this October activity included several subsequent actions, including the deployment of an implant consisting of a configuration file (“cisco_service.conf”). The configuration file defines the new web server endpoint (URI path) used to interact with the implant. That endpoint receives certain parameters, described in more detail below, that allows the actor to execute arbitrary commands at the system level or IOS level. For the implant to become active, the web server must be restarted; in at least one observed case the server was not restarted so the implant never became active despite being installed. +references: +- https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/ +tags: + analytic_story: Cisco IOS XE Software Web Management User Interface vulnerability + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 0c1e54f925fcbe7bd583aa75a9f2c0caec09986c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 17 Oct 2023 11:17:03 -0600 Subject: [PATCH 33/37] Update cisco_ios_xe_software_web_management_user_interface_vulnerability.yml --- ..._xe_software_web_management_user_interface_vulnerability.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml b/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml index bca5355bae..6e014d9d42 100644 --- a/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml +++ b/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml @@ -4,7 +4,7 @@ version: 1 date: '2023-10-17' author: Michael Haag, Splunk description: Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks. Successful exploitation of this vulnerability allows an attacker to create an account on the affected device with privilege level 15 access, effectively granting them full control of the compromised device and allowing possible subsequent unauthorized activity. -narrative: Cisco discovered early evidence of potentially malicious activity on September 28, 2023, when a case was opened with Cisco's Technical Assistance Center (TAC) that identified unusual behavior on a customer device. Upon further investigation, they observed what they have determined to be related activity as early as September 18. The activity included an authorized user creating a local user account under the username “cisco_tac_admin” from a suspicious IP address. On October 12, Cisco Talos Incident Response (Talos IR) and TAC detected what they later determined to be an additional cluster of related activity that began on that same day. In this cluster, an unauthorized user was observed creating a local user account under the name “cisco_support” from a second suspicious IP address. Unlike the September case, this October activity included several subsequent actions, including the deployment of an implant consisting of a configuration file (“cisco_service.conf”). The configuration file defines the new web server endpoint (URI path) used to interact with the implant. That endpoint receives certain parameters, described in more detail below, that allows the actor to execute arbitrary commands at the system level or IOS level. For the implant to become active, the web server must be restarted; in at least one observed case the server was not restarted so the implant never became active despite being installed. +narrative: Cisco discovered early evidence of potentially malicious activity on September 28, 2023, when a case was opened with Cisco's Technical Assistance Center (TAC) that identified unusual behavior on a customer device. Upon further investigation, they observed what they have determined to be related activity as early as September 18. The activity included an authorized user creating a local user account under the username cisco_tac_admin from a suspicious IP address. On October 12, Cisco Talos Incident Response (Talos IR) and TAC detected what they later determined to be an additional cluster of related activity that began on that same day. In this cluster, an unauthorized user was observed creating a local user account under the name cisco_support from a second suspicious IP address. Unlike the September case, this October activity included several subsequent actions, including the deployment of an implant consisting of a configuration file (cisco_service.conf). The configuration file defines the new web server endpoint (URI path) used to interact with the implant. That endpoint receives certain parameters, described in more detail below, that allows the actor to execute arbitrary commands at the system level or IOS level. For the implant to become active, the web server must be restarted; in at least one observed case the server was not restarted so the implant never became active despite being installed. references: - https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/ tags: From 4855e9d357aee0b45e9a990e2eb407ea96605395 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 17 Oct 2023 11:23:14 -0600 Subject: [PATCH 34/37] fix --- detections/web/cisco_ios_xe_implant_access.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/web/cisco_ios_xe_implant_access.yml b/detections/web/cisco_ios_xe_implant_access.yml index b544192873..d9aa7cac7f 100644 --- a/detections/web/cisco_ios_xe_implant_access.yml +++ b/detections/web/cisco_ios_xe_implant_access.yml @@ -25,8 +25,7 @@ tags: analytic_story: - Cisco IOS XE Software Web Management User Interface vulnerability asset_type: Network - atomic_guid: - - UPDATE atomic_guid + atomic_guid: [] confidence: 90 impact: 90 message: Possible exploitation of CVE-2023-20198 against $dest$. From 64775a0bf6046753a7372bdaced1afaa37e264ce Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 17 Oct 2023 11:24:13 -0600 Subject: [PATCH 35/37] Update cisco_ios_xe_implant_access.yml --- detections/web/cisco_ios_xe_implant_access.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/detections/web/cisco_ios_xe_implant_access.yml b/detections/web/cisco_ios_xe_implant_access.yml index b544192873..bcab0de85c 100644 --- a/detections/web/cisco_ios_xe_implant_access.yml +++ b/detections/web/cisco_ios_xe_implant_access.yml @@ -29,7 +29,7 @@ tags: - UPDATE atomic_guid confidence: 90 impact: 90 - message: Possible exploitation of CVE-2023-20198 against $dest$. + message: Possible exploitation of CVE-2023-20198 against $dest$ by $src$. mitre_attack_id: - T1190 observable: @@ -37,6 +37,10 @@ tags: type: Hostname role: - Victim + - name: src + type: IP Address + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security From 57aa264e8531775c1da00d917adeeb5b8594db3b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 17 Oct 2023 15:21:29 -0700 Subject: [PATCH 36/37] fixing indentation --- ...microsoft_sharepoint_server_elevation_of_privilege.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml index 39c6f1cb5f..06a63fd357 100644 --- a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml +++ b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml @@ -56,9 +56,9 @@ tags: - Web.status - sourcetype security_domain: network - tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/sharepoint/sharepointeop.log +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/sharepoint/sharepointeop.log source: suricata sourcetype: suricata \ No newline at end of file From 585e1256ad7d27c312ec8c9d0f86c5cf61bde886 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 17 Oct 2023 16:58:32 -0700 Subject: [PATCH 37/37] minor --- .../microsoft_sharepoint_server_elevation_of_privilege.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml index 06a63fd357..535d8604ac 100644 --- a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml +++ b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml @@ -60,5 +60,5 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/sharepoint/sharepointeop.log - source: suricata - sourcetype: suricata \ No newline at end of file + source: suricata + sourcetype: suricata \ No newline at end of file