mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge branch 'develop' into minor_mispelling
This commit is contained in:
Bhavin Patel
@@ -6,9 +6,9 @@ atomicwrites==1.4.0
|
||||
attackcti==0.3.3
|
||||
attrs==20.3.0
|
||||
bcrypt==3.2.0
|
||||
botocore==1.19.15
|
||||
botocore==1.19.16
|
||||
certifi==2019.11.28
|
||||
boto3==1.16.15
|
||||
boto3==1.16.16
|
||||
cffi==1.14.3
|
||||
cfgv==2.0.1
|
||||
chardet==3.0.4
|
||||
@@ -56,7 +56,7 @@ python-dateutil==2.8.1
|
||||
python-terraform==0.10.1
|
||||
pywinrm==0.4.1
|
||||
PyYAML==5.3.1
|
||||
requests==2.22.0
|
||||
requests==2.25.0
|
||||
requests-ntlm==1.1.0
|
||||
s3transfer==0.3.3
|
||||
six==1.13.0
|
||||
@@ -65,7 +65,7 @@ splunk-sdk==1.6.14
|
||||
tabulate==0.8.7
|
||||
termcolor==1.1.0
|
||||
toml==0.10.2
|
||||
urllib3==1.26.0
|
||||
urllib3==1.26.1
|
||||
virtualenv==20.1.0
|
||||
wcwidth==0.2.5
|
||||
wget==3.2
|
||||
|
||||
+25
-11
@@ -9,10 +9,11 @@ import sys
|
||||
import coloredlogs
|
||||
import logging
|
||||
import json
|
||||
import hashlib
|
||||
|
||||
SSML_CWD = ".humvee"
|
||||
HUMVEE_ARTIFACT_SEARCH = "https://repo.splunk.com/artifactory/api/search/artifact?name=humvee&repos=maven-splunk-local"
|
||||
|
||||
TEST_TIMEOUT = 600
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
logger.setLevel(logging.INFO)
|
||||
@@ -98,10 +99,18 @@ def build_humvee():
|
||||
if not os.path.exists(get_path(SSML_CWD)):
|
||||
os.mkdir(get_path(SSML_CWD))
|
||||
latest_humvee_object = get_latest_humvee_object()
|
||||
log(logging.INFO, "Downloading Latest Humvee")
|
||||
log(logging.DEBUG, "Humvee details", detail=latest_humvee_object)
|
||||
urllib.request.urlretrieve(latest_humvee_object['downloadUri'], "%s/humvee.jar" % get_path(SSML_CWD))
|
||||
|
||||
humvee_path = "%s/humvee.jar" % get_path(SSML_CWD)
|
||||
humvee_md5 = ""
|
||||
if os.path.exists(humvee_path):
|
||||
with open(humvee_path, 'rb') as jar_fh:
|
||||
humvee_md5 = hashlib.md5(jar_fh.read()).hexdigest()
|
||||
log(logging.DEBUG, "Current local checksum of Humvee", detail=humvee_md5)
|
||||
if humvee_md5 != latest_humvee_object['checksums']['md5']:
|
||||
log(logging.INFO, "Downloading Latest Humvee")
|
||||
log(logging.DEBUG, "Humvee details", detail=latest_humvee_object)
|
||||
urllib.request.urlretrieve(latest_humvee_object['downloadUri'], humvee_path)
|
||||
else:
|
||||
log(logging.DEBUG, "Already latest checksum %s" % humvee_md5, detail=latest_humvee_object)
|
||||
|
||||
|
||||
def activate_detection(detection, data, pass_condition):
|
||||
@@ -148,12 +157,17 @@ def test_detection(test, args):
|
||||
spl2_fh.write(spl2)
|
||||
# Execute SPL2
|
||||
log(logging.INFO, "Humvee test %s" % detection['name'])
|
||||
subprocess.run(["/usr/bin/java",
|
||||
"-jar", get_path("%s/humvee.jar" % SSML_CWD),
|
||||
'cli',
|
||||
'-i', spl2_file,
|
||||
'-o', test_out],
|
||||
stderr=subprocess.DEVNULL)
|
||||
try:
|
||||
subprocess.run(["/usr/bin/java",
|
||||
"-jar", get_path("%s/humvee.jar" % SSML_CWD),
|
||||
'cli',
|
||||
'-i', spl2_file,
|
||||
'-o', test_out],
|
||||
stderr=subprocess.DEVNULL,
|
||||
timeout=TEST_TIMEOUT)
|
||||
except TimeoutError:
|
||||
log(logging.ERROR, "%s test timeout" % detection['name'])
|
||||
return False
|
||||
# Validate that it can run
|
||||
with open(test_status, "r") as test_status_fh:
|
||||
status = '\n'.join(test_status_fh.readlines())
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
name: Detect Kerberoasting - SSA
|
||||
id: dabdd6d7-3e10-42be-8711-4e124f7a3850
|
||||
version: 1
|
||||
date: '2020-10-21'
|
||||
description: This search detects a potential kerberoasting attack via service principal
|
||||
name requests
|
||||
how_to_implement: The test data is converted from Windows Security Event logs generated
|
||||
from Attach Range simulation and used in SPL search and extended to SPL2
|
||||
type: SSA
|
||||
references: [Initial ESCU implementation by Jose Hernandez and Patrick Bareiss]
|
||||
author: Xiao Lin, Splunk
|
||||
search: ' | from read_ssa_enriched_events()
|
||||
| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, "service_id")
|
||||
| where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
|
||||
| first_time_event cache_partitions=1 input_columns="EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID"
|
||||
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
|
||||
| eval start_time=_time, end_time=_time, body="TBD", entities="TBD"
|
||||
| select start_time, end_time, entities, body
|
||||
| into write_ssa_detected_events(); '
|
||||
known_false_positives: Older systems that support kerberos RC4 by default NetApp may
|
||||
generate false positives
|
||||
tags:
|
||||
mitre_attack_id:
|
||||
- T1558.003
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
cis20:
|
||||
- CIS 8
|
||||
- CIS 16
|
||||
nist:
|
||||
- DE.CM
|
||||
security_domain: endpoint
|
||||
risk_severity: low
|
||||
@@ -0,0 +1,37 @@
|
||||
name: Detect Pass the Hash - SSA
|
||||
id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f
|
||||
version: 1
|
||||
date: '2020-10-21'
|
||||
description: This search looks for specific authentication events from the Windows
|
||||
Security Event logs to detect potential attempts using Pass-the-Hash technique.
|
||||
how_to_implement: The test data is converted from Windows Security Event logs generated
|
||||
from Attach Range simulation and used in SPL search and extended to SPL2
|
||||
type: SSA
|
||||
references: [Initial ESCU implementation by Bhavin Patel and Patrick Bareiss]
|
||||
author: Xiao Lin, Splunk
|
||||
search: ' | from read_ssa_enriched_events()
|
||||
| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), LogonType=map_get(input_event, "logon_type"), LogonProcess=map_get(input_event, "logon_process"), ComputerName=map_get(input_event, "dest_ip_primary_artifact"), AccountName=map_get(input_event, "dest_user_primary_artifact")
|
||||
| where (LogonType="3" AND LogonProcess="NtLmSsp" AND AccountName IS NOT NULL) OR (LogonType="9" AND LogonProcess="seclogo")
|
||||
| first_time_event cache_partitions=1 input_columns="EventCode,LogonProcess,ComputerName"
|
||||
| where first_time_EventCode_LogonProcess_ComputerName
|
||||
| eval start_time=_time, end_time=_time, body="TBD", entities="TBD"
|
||||
| select start_time, end_time, entities, body
|
||||
| into write_ssa_detected_events(); '
|
||||
known_false_positives: Legitimate logon activity by authorized NTLM systems may be
|
||||
detected by this search. Please investigate as appropriate.
|
||||
tags:
|
||||
mitre_attack_id:
|
||||
- T1550.002
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
nist:
|
||||
- PR.PT
|
||||
- PR.AT
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
security_domain: endpoint
|
||||
risk_severity: low
|
||||
@@ -20,8 +20,7 @@ references: [ ]
|
||||
type: SSA
|
||||
author: Xiao Lin, Splunk
|
||||
search: '| from read_ssa_enriched_events()
|
||||
| where source_type="email"
|
||||
| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), eventLine=concat(ucast(map_get(jsonMap, "From"), "string", " "), " ", ucast(map_get(jsonMap, "Subject"), "string", " "), " ", ucast(map_get(jsonMap, "Content"), "string", " "), " "), _time=map_get(jsonMap, "_time")
|
||||
| eval eventLine=concat(ucast(map_get(input_event, "From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", " "), " ", ucast(map_get(input_event, "Content"), "string", " "), " "), _time=map_get(input_event, "_time")
|
||||
| where eventLine IS NOT NULL
|
||||
| eval mapC={" ": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40, ")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49, "2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58, ";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67, "D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76, "M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85, "V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94, "_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g": 103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o": 111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w": 119, "x": 120, "y": 121, "z": 122, "{": 123, "|": 124, "}": 125, "~": 126},
|
||||
ml_in = for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i, 1)), "float") )
|
||||
|
||||
@@ -35,7 +35,7 @@ tags:
|
||||
mitre_attack_id:
|
||||
- T1200
|
||||
- T1498
|
||||
- T1557
|
||||
- T1557.002
|
||||
cis20:
|
||||
- CIS 1
|
||||
- CIS 11
|
||||
|
||||
@@ -0,0 +1,53 @@
|
||||
name: Detect IPv6 Network Infrastructure Threats
|
||||
id: c3be767e-7959-44c5-8976-0e9c12a91ad2
|
||||
version: 1
|
||||
date: '2020-10-28'
|
||||
description: By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's
|
||||
network devices, we will be able to detect various attacks such as packet forging in the Infrastructure.
|
||||
how_to_implement: This search uses a standard SPL query on logs from Cisco Network
|
||||
devices. The network devices must be configured with one or more First Hop Security measures such as
|
||||
RA Guard, DHCP Guard and/or device tracking. See References for more information.
|
||||
The search also requires that the Cisco Networks Add-on for Splunk
|
||||
(https://splunkbase.splunk.com/app/1467) is used to
|
||||
parse the logs from the Cisco network devices.
|
||||
type: ESCU
|
||||
references:
|
||||
- https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf
|
||||
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-ra-guard.html
|
||||
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-snooping.html
|
||||
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-dad-proxy.html
|
||||
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-nd-mcast-supp.html
|
||||
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-dhcpv6-guard.html
|
||||
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-src-guard.html
|
||||
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ipv6-dest-guard.html
|
||||
author: Mikael Bjerkeland, Splunk
|
||||
search: '`cisco_networks` facility="SISF" mnemonic IN ("IP_THEFT","MAC_THEFT","MAC_AND_IP_THEFT","PAK_DROP") | eval src_interface=src_int_prefix_long+src_int_suffix
|
||||
| eval dest_interface=dest_int_prefix_long+dest_int_suffix
|
||||
| stats min(_time) AS firstTime max(_time) AS lastTime values(src_mac) AS src_mac values(src_vlan) AS src_vlan
|
||||
values(mnemonic) AS mnemonic values(vendor_explanation) AS vendor_explanation values(src_ip) AS src_ip values(dest_ip) AS dest_ip
|
||||
values(dest_interface) AS dest_interface values(action) AS action count BY host src_interface
|
||||
| table host src_interface dest_interface src_mac src_ip dest_ip src_vlan mnemonic vendor_explanation action count
|
||||
| `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
|
||||
| `detect_ipv6_network_infrastructure_threats_filter`'
|
||||
known_false_positives: None currently known
|
||||
tags:
|
||||
analytics_story:
|
||||
- Router and Infrastructure Security
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
- Delivery
|
||||
- Actions on Objectives
|
||||
mitre_attack_id:
|
||||
- T1200
|
||||
- T1498
|
||||
- T1557.002
|
||||
cis20:
|
||||
- CIS 1
|
||||
- CIS 11
|
||||
nist:
|
||||
- ID.AM
|
||||
- PR.DS
|
||||
detection_name: Detect IPv6 Network Infrastructure Threats
|
||||
security_domain: network
|
||||
asset_type: Infrastructure
|
||||
|
||||
@@ -0,0 +1,47 @@
|
||||
name: Detect Port Security Violation
|
||||
id: 2de3d5b8-a4fa-45c5-8540-6d071c194d24
|
||||
version: 1
|
||||
date: '2020-10-28'
|
||||
description: By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs.
|
||||
how_to_implement: This search uses a standard SPL query on logs from Cisco Network
|
||||
devices. The network devices must be configured with Port Security and Error Disable for this to work
|
||||
(see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html)
|
||||
and log with a severity level of minimum "5 - notification".
|
||||
The search also requires that the Cisco Networks Add-on for Splunk
|
||||
(https://splunkbase.splunk.com/app/1467) is used to
|
||||
parse the logs from the Cisco network devices.
|
||||
type: ESCU
|
||||
references: []
|
||||
author: Mikael Bjerkeland, Splunk
|
||||
search: '`cisco_networks` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="psecure-violation")
|
||||
OR (facility="PORT_SECURITY" mnemonic="PSECURE_VIOLATION" OR mnemonic="PSECURE_VIOLATION_VLAN")
|
||||
| eval src_interface=src_int_prefix_long+src_int_suffix
|
||||
| stats min(_time) AS firstTime max(_time) AS lastTime values(disable_cause) AS disable_cause values(src_mac) AS src_mac
|
||||
values(src_vlan) AS src_vlan values(action) AS action count by host src_interface
|
||||
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `detect_port_security_violation_filter`'
|
||||
known_false_positives: This search might be prone to high false positives if
|
||||
you have malfunctioning devices connected to your ethernet ports or if end
|
||||
users periodically connect physical devices to the network.
|
||||
tags:
|
||||
analytics_story:
|
||||
- Router and Infrastructure Security
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
- Delivery
|
||||
- Exploitation
|
||||
- Actions on Objectives
|
||||
mitre_attack_id:
|
||||
- T1200
|
||||
- T1498
|
||||
- T1557.002
|
||||
cis20:
|
||||
- CIS 1
|
||||
- CIS 11
|
||||
nist:
|
||||
- ID.AM
|
||||
- PR.DS
|
||||
detection_name: Detect Port Security Violation
|
||||
security_domain: network
|
||||
asset_type: Infrastructure
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
name: Detect Software Download To Network Device
|
||||
id: cc590c66-f65f-48f2-986a-4797244762f8
|
||||
version: 1
|
||||
date: '2020-10-28'
|
||||
description: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.
|
||||
how_to_implement: This search looks for Network Traffic events to TFTP, FTP or SSH/SCP ports from network devices. Make sure to tag any network devices as network, router or switch in order for this detection to work. If the TFTP traffic doesn't traverse a firewall nor packet inspection, these events will not be logged. This is typically an issue if the TFTP server is on the same subnet as the network device. There is also a chance of the network device loading software using a DHCP assigned IP address (netboot) which is not in the Asset inventory.
|
||||
type: ESCU
|
||||
references: []
|
||||
author: Mikael Bjerkeland, Splunk
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Network_Traffic where
|
||||
(All_Traffic.transport=udp AND All_Traffic.dest_port=69)
|
||||
OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=21)
|
||||
OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=22) AND
|
||||
All_Traffic.dest_category!=common_software_repo_destination AND All_Traffic.src_category=network OR All_Traffic.src_category=router OR All_Traffic.src_category=switch
|
||||
by All_Traffic.src All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")`
|
||||
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_software_download_to_network_device_filter`'
|
||||
known_false_positives: This search will also report any legitimate attempts of software downloads to network devices as well as outbound SSH sessions from network devices.
|
||||
tags:
|
||||
analytics_story:
|
||||
- Router and Infrastructure Security
|
||||
kill_chain_phases:
|
||||
- Delivery
|
||||
mitre_attack_id:
|
||||
- T1542.005
|
||||
cis20:
|
||||
- CIS 1
|
||||
- CIS 11
|
||||
nist:
|
||||
- ID.AM
|
||||
- PR.DS
|
||||
detection_name: Detect Software Download To Network Device
|
||||
security_domain: network
|
||||
asset_type: Infrastructure
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
name: Detect Traffic Mirroring
|
||||
id: 42b3b753-5925-49c5-9742-36fa40a73990
|
||||
version: 1
|
||||
date: '2020-10-28'
|
||||
description: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device.
|
||||
how_to_implement: This search uses a standard SPL query on logs from Cisco Network
|
||||
devices. The network devices must log with a severity level of minimum "5 - notification".
|
||||
The search also requires that the Cisco Networks Add-on for Splunk
|
||||
(https://splunkbase.splunk.com/app/1467) is used to
|
||||
parse the logs from the Cisco network devices and that the devices have been configured according to the documentation of the Cisco Networks Add-on.
|
||||
Also note that an attacker may disable logging from the device prior to enabling traffic mirroring.
|
||||
type: ESCU
|
||||
references: []
|
||||
author: Mikael Bjerkeland, Splunk
|
||||
search: '`cisco_networks` (facility="MIRROR" mnemonic="ETH_SPAN_SESSION_UP")
|
||||
OR (facility="SPAN" mnemonic="SESSION_UP")
|
||||
OR (facility="SPAN" mnemonic="PKTCAP_START")
|
||||
OR (mnemonic="CFGLOG_LOGGEDCMD" command="monitor session*")
|
||||
| stats min(_time) AS firstTime max(_time) AS lastTime count
|
||||
BY host facility mnemonic
|
||||
| `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` |
|
||||
`detect_traffic_mirroring_filter`'
|
||||
known_false_positives: This search will return false positives for any legitimate traffic captures by network administrators.
|
||||
tags:
|
||||
analytics_story:
|
||||
- Router and Infrastructure Security
|
||||
kill_chain_phases:
|
||||
- Delivery
|
||||
- Actions on Objectives
|
||||
mitre_attack_id:
|
||||
- T1200
|
||||
- T1498
|
||||
- T1020.001
|
||||
cis20:
|
||||
- CIS 1
|
||||
- CIS 11
|
||||
nist:
|
||||
- ID.AM
|
||||
- PR.DS
|
||||
detection_name: Detect Traffic Mirroring
|
||||
security_domain: network
|
||||
asset_type: Infrastructure
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
definition: search *
|
||||
description: Use this macro to add additional filters to prevent i.e. false positives
|
||||
name: detect_arp_poisoning_filter
|
||||
@@ -0,0 +1,3 @@
|
||||
definition: search *
|
||||
description: Use this macro to add additional filters to prevent i.e. false positives
|
||||
name: detect_port_security_violation_filter
|
||||
@@ -0,0 +1,3 @@
|
||||
definition: search *
|
||||
description: Use this macro to add additional filters to prevent i.e. false positives
|
||||
name: detect_software_download_to_network_device_filter
|
||||
@@ -0,0 +1,3 @@
|
||||
definition: search *
|
||||
description: Use this macro to add additional filters to prevent i.e. false positives
|
||||
name: detect_traffic_mirroring_filter
|
||||
@@ -0,0 +1,143 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"# Detect Kerberoasting\n",
|
||||
"### This is the SPL2 to test content: detections/endpoint/detect_kerberoasting__ssa.yml"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 1,
|
||||
"metadata": {
|
||||
"execution": {
|
||||
"iopub.execute_input": "2020-10-28T22:35:40.972663Z",
|
||||
"iopub.status.busy": "2020-10-28T22:35:40.972286Z",
|
||||
"iopub.status.idle": "2020-10-28T22:35:42.632374Z",
|
||||
"shell.execute_reply": "2020-10-28T22:35:42.631440Z",
|
||||
"shell.execute_reply.started": "2020-10-28T22:35:40.972629Z"
|
||||
}
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"data": {
|
||||
"application/vnd.jupyter.widget-view+json": {
|
||||
"model_id": "2ea98fa914f748d487beaf1b4b188a4d",
|
||||
"version_major": 2,
|
||||
"version_minor": 0
|
||||
},
|
||||
"text/plain": [
|
||||
"HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
},
|
||||
{
|
||||
"name": "stdout",
|
||||
"output_type": "stream",
|
||||
"text": [
|
||||
" Finished. "
|
||||
]
|
||||
},
|
||||
{
|
||||
"data": {
|
||||
"text/html": [
|
||||
"<div>\n",
|
||||
"<style scoped>\n",
|
||||
" .dataframe tbody tr th:only-of-type {\n",
|
||||
" vertical-align: middle;\n",
|
||||
" }\n",
|
||||
"\n",
|
||||
" .dataframe tbody tr th {\n",
|
||||
" vertical-align: top;\n",
|
||||
" }\n",
|
||||
"\n",
|
||||
" .dataframe thead th {\n",
|
||||
" text-align: right;\n",
|
||||
" }\n",
|
||||
"</style>\n",
|
||||
"<table border=\"1\" class=\"dataframe\">\n",
|
||||
" <thead>\n",
|
||||
" <tr style=\"text-align: right;\">\n",
|
||||
" <th></th>\n",
|
||||
" <th>end_time</th>\n",
|
||||
" <th>start_time</th>\n",
|
||||
" <th>body</th>\n",
|
||||
" <th>entities</th>\n",
|
||||
" </tr>\n",
|
||||
" </thead>\n",
|
||||
" <tbody>\n",
|
||||
" <tr>\n",
|
||||
" <th>0</th>\n",
|
||||
" <td>1119</td>\n",
|
||||
" <td>1119</td>\n",
|
||||
" <td>TBD</td>\n",
|
||||
" <td>TBD</td>\n",
|
||||
" </tr>\n",
|
||||
" </tbody>\n",
|
||||
"</table>\n",
|
||||
"</div>"
|
||||
],
|
||||
"text/plain": [
|
||||
" end_time start_time body entities\n",
|
||||
"0 1119 1119 TBD TBD"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
},
|
||||
{
|
||||
"name": "stdout",
|
||||
"output_type": "stream",
|
||||
"text": [
|
||||
"\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"data": {
|
||||
"text/plain": [
|
||||
"<spl2_kernel.spl2_runner.SPL2Job at 0x7efb7b3facd0>"
|
||||
]
|
||||
},
|
||||
"execution_count": 1,
|
||||
"metadata": {},
|
||||
"output_type": "execute_result"
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"| from read_text(\"s3://smle-experiments/datasets/ssa/T1558.003.json\")\n",
|
||||
"| eval input_event=from_json_object(value)\n",
|
||||
"| eval _time=map_get(input_event, \"_time\"), EventCode=map_get(input_event, \"event_code\"), TicketOptions=map_get(input_event, \"ticket_options\"), TicketEncryptionType=map_get(input_event, \"ticket_encryption_type\"), ServiceName=map_get(input_event, \"service_name\"), ServiceID=map_get(input_event, \"service_id\")\n",
|
||||
"| where EventCode=\"4769\" AND TicketOptions=\"0x40810000\" AND TicketEncryptionType=\"0x17\"\n",
|
||||
"| first_time_event cache_partitions=1 input_columns=\"EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID\"\n",
|
||||
"| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID\n",
|
||||
"| eval start_time=_time, end_time=_time, body=\"TBD\", entities=\"TBD\"\n",
|
||||
"| select start_time, end_time, entities, body \n",
|
||||
";"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": []
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "SPL2",
|
||||
"language": "SPL",
|
||||
"name": "spl2"
|
||||
},
|
||||
"language_info": {
|
||||
"mimetype": "text/spl",
|
||||
"name": "SPL"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 4
|
||||
}
|
||||
@@ -0,0 +1,159 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"metadata": {
|
||||
"execution": {
|
||||
"iopub.execute_input": "2020-10-14T00:24:08.027638Z",
|
||||
"iopub.status.busy": "2020-10-14T00:24:08.027292Z",
|
||||
"iopub.status.idle": "2020-10-14T00:24:08.030791Z",
|
||||
"shell.execute_reply": "2020-10-14T00:24:08.030084Z",
|
||||
"shell.execute_reply.started": "2020-10-14T00:24:08.027607Z"
|
||||
}
|
||||
},
|
||||
"source": [
|
||||
"# Detect Pass the Hash\n",
|
||||
"### This is the SPL2 to test content: detections/endpoint/detect_pass_hash__ssa.yml"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 1,
|
||||
"metadata": {
|
||||
"execution": {
|
||||
"iopub.execute_input": "2020-10-28T22:35:49.966691Z",
|
||||
"iopub.status.busy": "2020-10-28T22:35:49.966422Z",
|
||||
"iopub.status.idle": "2020-10-28T22:35:51.544851Z",
|
||||
"shell.execute_reply": "2020-10-28T22:35:51.543629Z",
|
||||
"shell.execute_reply.started": "2020-10-28T22:35:49.966620Z"
|
||||
}
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"data": {
|
||||
"application/vnd.jupyter.widget-view+json": {
|
||||
"model_id": "bc96630916c54e68bc29ac51a679c08e",
|
||||
"version_major": 2,
|
||||
"version_minor": 0
|
||||
},
|
||||
"text/plain": [
|
||||
"HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
},
|
||||
{
|
||||
"name": "stdout",
|
||||
"output_type": "stream",
|
||||
"text": [
|
||||
" Finished. "
|
||||
]
|
||||
},
|
||||
{
|
||||
"data": {
|
||||
"text/html": [
|
||||
"<div>\n",
|
||||
"<style scoped>\n",
|
||||
" .dataframe tbody tr th:only-of-type {\n",
|
||||
" vertical-align: middle;\n",
|
||||
" }\n",
|
||||
"\n",
|
||||
" .dataframe tbody tr th {\n",
|
||||
" vertical-align: top;\n",
|
||||
" }\n",
|
||||
"\n",
|
||||
" .dataframe thead th {\n",
|
||||
" text-align: right;\n",
|
||||
" }\n",
|
||||
"</style>\n",
|
||||
"<table border=\"1\" class=\"dataframe\">\n",
|
||||
" <thead>\n",
|
||||
" <tr style=\"text-align: right;\">\n",
|
||||
" <th></th>\n",
|
||||
" <th>end_time</th>\n",
|
||||
" <th>start_time</th>\n",
|
||||
" <th>body</th>\n",
|
||||
" <th>entities</th>\n",
|
||||
" </tr>\n",
|
||||
" </thead>\n",
|
||||
" <tbody>\n",
|
||||
" <tr>\n",
|
||||
" <th>0</th>\n",
|
||||
" <td>6</td>\n",
|
||||
" <td>6</td>\n",
|
||||
" <td>TBD</td>\n",
|
||||
" <td>TBD</td>\n",
|
||||
" </tr>\n",
|
||||
" <tr>\n",
|
||||
" <th>1</th>\n",
|
||||
" <td>8</td>\n",
|
||||
" <td>8</td>\n",
|
||||
" <td>TBD</td>\n",
|
||||
" <td>TBD</td>\n",
|
||||
" </tr>\n",
|
||||
" </tbody>\n",
|
||||
"</table>\n",
|
||||
"</div>"
|
||||
],
|
||||
"text/plain": [
|
||||
" end_time start_time body entities\n",
|
||||
"0 6 6 TBD TBD\n",
|
||||
"1 8 8 TBD TBD"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
},
|
||||
{
|
||||
"name": "stdout",
|
||||
"output_type": "stream",
|
||||
"text": [
|
||||
"\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"data": {
|
||||
"text/plain": [
|
||||
"<spl2_kernel.spl2_runner.SPL2Job at 0x7f9335390a90>"
|
||||
]
|
||||
},
|
||||
"execution_count": 1,
|
||||
"metadata": {},
|
||||
"output_type": "execute_result"
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"| from read_text(\"s3://smle-experiments/datasets/ssa/T1550.002.json\")\n",
|
||||
"| eval input_event=from_json_object(value)\n",
|
||||
"| eval _time=map_get(input_event, \"_time\"), EventCode=map_get(input_event, \"event_code\"), LogonType=map_get(input_event, \"logon_type\"), LogonProcess=map_get(input_event, \"logon_process\"), ComputerName=map_get(input_event, \"dest_ip_primary_artifact\"), AccountName=map_get(input_event, \"dest_user_primary_artifact\")\n",
|
||||
"| where (LogonType=\"3\" AND LogonProcess=\"NtLmSsp\" AND AccountName IS NOT NULL) OR (LogonType=\"9\" AND LogonProcess=\"seclogo\")\n",
|
||||
"| first_time_event cache_partitions=1 input_columns=\"EventCode,LogonProcess,ComputerName\"\n",
|
||||
"| where first_time_EventCode_LogonProcess_ComputerName\n",
|
||||
"| eval start_time=_time, end_time=_time, body=\"TBD\", entities=\"TBD\"\n",
|
||||
"| select start_time, end_time, entities, body \n",
|
||||
";"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": []
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "SPL2",
|
||||
"language": "SPL",
|
||||
"name": "spl2"
|
||||
},
|
||||
"language_info": {
|
||||
"mimetype": "text/spl",
|
||||
"name": "SPL"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 4
|
||||
}
|
||||
+2
-2
@@ -28,7 +28,7 @@ pyrsistent==0.17.3
|
||||
python-dateutil==2.8.1
|
||||
pytz==2020.4
|
||||
PyYAML==5.3.1
|
||||
requests==2.24.0
|
||||
requests==2.25.0
|
||||
scandir==1.10.0
|
||||
semantic-version==2.8.5
|
||||
simplejson==3.17.2
|
||||
@@ -39,6 +39,6 @@ stix2-patterns==1.3.1
|
||||
taxii2-client==2.2.2
|
||||
toml==0.10.2
|
||||
typing==3.7.4.3
|
||||
urllib3==1.25.11
|
||||
urllib3==1.26.1
|
||||
virtualenv==20.1.0
|
||||
zipp==3.4.0
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
name: Detect Kerberoasting - SSA Unit test
|
||||
detections:
|
||||
- name: Detect kerberoasting
|
||||
file: endpoint/ssa___detect_kerberoasting.yml
|
||||
pass_condition: ''
|
||||
description: Test detection of kerberoasting
|
||||
attack_data:
|
||||
- file_name: T1558.003.json
|
||||
data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1558.003/T1558.003.json
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
name: Detect Pass the Hash - SSA Unit test
|
||||
detections:
|
||||
- name: Detect Pass the Hash
|
||||
file: endpoint/ssa___detect_pass_hash.yml
|
||||
pass_condition: ''
|
||||
description: Test detection of pass-the-hash
|
||||
attack_data:
|
||||
- file_name: T1550.002.json
|
||||
data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1550.002/T1550.002.json
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
name: IPv6 Network Infrastructure Threats
|
||||
detections:
|
||||
- name: Detect IPv6 Network Infrastructure Threats
|
||||
file: network/detect_ipv6_network_infrastructure_threats.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
description: Test IPv6 Network Infrastructure Threats detection
|
||||
simulation_technique: 'T1557.002'
|
||||
attack_data:
|
||||
- file_name: cisco_ios.log
|
||||
data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1557.002/cisco_ios.log
|
||||
source: udp:514
|
||||
sourcetype: cisco:ios
|
||||
Reference in New Issue
Block a user