diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 6cf387b1f1..d111301c41 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -6,9 +6,9 @@ atomicwrites==1.4.0
attackcti==0.3.3
attrs==20.3.0
bcrypt==3.2.0
-botocore==1.19.15
+botocore==1.19.16
certifi==2019.11.28
-boto3==1.16.15
+boto3==1.16.16
cffi==1.14.3
cfgv==2.0.1
chardet==3.0.4
@@ -56,7 +56,7 @@ python-dateutil==2.8.1
python-terraform==0.10.1
pywinrm==0.4.1
PyYAML==5.3.1
-requests==2.22.0
+requests==2.25.0
requests-ntlm==1.1.0
s3transfer==0.3.3
six==1.13.0
@@ -65,7 +65,7 @@ splunk-sdk==1.6.14
tabulate==0.8.7
termcolor==1.1.0
toml==0.10.2
-urllib3==1.26.0
+urllib3==1.26.1
virtualenv==20.1.0
wcwidth==0.2.5
wget==3.2
diff --git a/bin/validate_ssa.py b/bin/validate_ssa.py
index 76cbefb9c8..289297045b 100644
--- a/bin/validate_ssa.py
+++ b/bin/validate_ssa.py
@@ -9,10 +9,11 @@ import sys
import coloredlogs
import logging
import json
+import hashlib
SSML_CWD = ".humvee"
HUMVEE_ARTIFACT_SEARCH = "https://repo.splunk.com/artifactory/api/search/artifact?name=humvee&repos=maven-splunk-local"
-
+TEST_TIMEOUT = 600
logger = logging.getLogger(__name__)
logger.setLevel(logging.INFO)
@@ -98,10 +99,18 @@ def build_humvee():
if not os.path.exists(get_path(SSML_CWD)):
os.mkdir(get_path(SSML_CWD))
latest_humvee_object = get_latest_humvee_object()
- log(logging.INFO, "Downloading Latest Humvee")
- log(logging.DEBUG, "Humvee details", detail=latest_humvee_object)
- urllib.request.urlretrieve(latest_humvee_object['downloadUri'], "%s/humvee.jar" % get_path(SSML_CWD))
-
+ humvee_path = "%s/humvee.jar" % get_path(SSML_CWD)
+ humvee_md5 = ""
+ if os.path.exists(humvee_path):
+ with open(humvee_path, 'rb') as jar_fh:
+ humvee_md5 = hashlib.md5(jar_fh.read()).hexdigest()
+ log(logging.DEBUG, "Current local checksum of Humvee", detail=humvee_md5)
+ if humvee_md5 != latest_humvee_object['checksums']['md5']:
+ log(logging.INFO, "Downloading Latest Humvee")
+ log(logging.DEBUG, "Humvee details", detail=latest_humvee_object)
+ urllib.request.urlretrieve(latest_humvee_object['downloadUri'], humvee_path)
+ else:
+ log(logging.DEBUG, "Already latest checksum %s" % humvee_md5, detail=latest_humvee_object)
def activate_detection(detection, data, pass_condition):
@@ -148,12 +157,17 @@ def test_detection(test, args):
spl2_fh.write(spl2)
# Execute SPL2
log(logging.INFO, "Humvee test %s" % detection['name'])
- subprocess.run(["/usr/bin/java",
- "-jar", get_path("%s/humvee.jar" % SSML_CWD),
- 'cli',
- '-i', spl2_file,
- '-o', test_out],
- stderr=subprocess.DEVNULL)
+ try:
+ subprocess.run(["/usr/bin/java",
+ "-jar", get_path("%s/humvee.jar" % SSML_CWD),
+ 'cli',
+ '-i', spl2_file,
+ '-o', test_out],
+ stderr=subprocess.DEVNULL,
+ timeout=TEST_TIMEOUT)
+ except TimeoutError:
+ log(logging.ERROR, "%s test timeout" % detection['name'])
+ return False
# Validate that it can run
with open(test_status, "r") as test_status_fh:
status = '\n'.join(test_status_fh.readlines())
diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml
new file mode 100644
index 0000000000..351f156c92
--- /dev/null
+++ b/detections/endpoint/ssa___detect_kerberoasting.yml
@@ -0,0 +1,33 @@
+name: Detect Kerberoasting - SSA
+id: dabdd6d7-3e10-42be-8711-4e124f7a3850
+version: 1
+date: '2020-10-21'
+description: This search detects a potential kerberoasting attack via service principal
+ name requests
+how_to_implement: The test data is converted from Windows Security Event logs generated
+ from Attach Range simulation and used in SPL search and extended to SPL2
+type: SSA
+references: [Initial ESCU implementation by Jose Hernandez and Patrick Bareiss]
+author: Xiao Lin, Splunk
+search: ' | from read_ssa_enriched_events()
+| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, "service_id")
+| where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
+| first_time_event cache_partitions=1 input_columns="EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID"
+| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
+| eval start_time=_time, end_time=_time, body="TBD", entities="TBD"
+| select start_time, end_time, entities, body
+| into write_ssa_detected_events(); '
+known_false_positives: Older systems that support kerberos RC4 by default NetApp may
+ generate false positives
+tags:
+ mitre_attack_id:
+ - T1558.003
+ kill_chain_phases:
+ - Actions on Objectives
+ cis20:
+ - CIS 8
+ - CIS 16
+ nist:
+ - DE.CM
+ security_domain: endpoint
+ risk_severity: low
diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml
new file mode 100644
index 0000000000..1a93dfe51a
--- /dev/null
+++ b/detections/endpoint/ssa___detect_pass_hash.yml
@@ -0,0 +1,37 @@
+name: Detect Pass the Hash - SSA
+id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f
+version: 1
+date: '2020-10-21'
+description: This search looks for specific authentication events from the Windows
+ Security Event logs to detect potential attempts using Pass-the-Hash technique.
+how_to_implement: The test data is converted from Windows Security Event logs generated
+ from Attach Range simulation and used in SPL search and extended to SPL2
+type: SSA
+references: [Initial ESCU implementation by Bhavin Patel and Patrick Bareiss]
+author: Xiao Lin, Splunk
+search: ' | from read_ssa_enriched_events()
+| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), LogonType=map_get(input_event, "logon_type"), LogonProcess=map_get(input_event, "logon_process"), ComputerName=map_get(input_event, "dest_ip_primary_artifact"), AccountName=map_get(input_event, "dest_user_primary_artifact")
+| where (LogonType="3" AND LogonProcess="NtLmSsp" AND AccountName IS NOT NULL) OR (LogonType="9" AND LogonProcess="seclogo")
+| first_time_event cache_partitions=1 input_columns="EventCode,LogonProcess,ComputerName"
+| where first_time_EventCode_LogonProcess_ComputerName
+| eval start_time=_time, end_time=_time, body="TBD", entities="TBD"
+| select start_time, end_time, entities, body
+| into write_ssa_detected_events(); '
+known_false_positives: Legitimate logon activity by authorized NTLM systems may be
+ detected by this search. Please investigate as appropriate.
+tags:
+ mitre_attack_id:
+ - T1550.002
+ kill_chain_phases:
+ - Actions on Objectives
+ cis20:
+ - CIS 3
+ - CIS 5
+ - CIS 16
+ nist:
+ - PR.PT
+ - PR.AT
+ - PR.AC
+ - PR.IP
+ security_domain: endpoint
+ risk_severity: low
diff --git a/detections/experimental/application/detect_phishing_content___ssa.yml b/detections/experimental/application/detect_phishing_content___ssa.yml
index b0853c6f12..9aa9b1f21d 100644
--- a/detections/experimental/application/detect_phishing_content___ssa.yml
+++ b/detections/experimental/application/detect_phishing_content___ssa.yml
@@ -20,8 +20,7 @@ references: [ ]
type: SSA
author: Xiao Lin, Splunk
search: '| from read_ssa_enriched_events()
-| where source_type="email"
-| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), eventLine=concat(ucast(map_get(jsonMap, "From"), "string", " "), " ", ucast(map_get(jsonMap, "Subject"), "string", " "), " ", ucast(map_get(jsonMap, "Content"), "string", " "), " "), _time=map_get(jsonMap, "_time")
+| eval eventLine=concat(ucast(map_get(input_event, "From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", " "), " ", ucast(map_get(input_event, "Content"), "string", " "), " "), _time=map_get(input_event, "_time")
| where eventLine IS NOT NULL
| eval mapC={" ": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40, ")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49, "2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58, ";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67, "D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76, "M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85, "V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94, "_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g": 103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o": 111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w": 119, "x": 120, "y": 121, "z": 122, "{": 123, "|": 124, "}": 125, "~": 126},
ml_in = for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i, 1)), "float") )
diff --git a/detections/network/detect_arp_poisoning.yml b/detections/network/detect_arp_poisoning.yml
index 2a447af268..6ae72d7a99 100644
--- a/detections/network/detect_arp_poisoning.yml
+++ b/detections/network/detect_arp_poisoning.yml
@@ -35,7 +35,7 @@ tags:
mitre_attack_id:
- T1200
- T1498
- - T1557
+ - T1557.002
cis20:
- CIS 1
- CIS 11
diff --git a/detections/network/detect_ipv6_network_infrastructure_threats.yml b/detections/network/detect_ipv6_network_infrastructure_threats.yml
new file mode 100644
index 0000000000..7429341313
--- /dev/null
+++ b/detections/network/detect_ipv6_network_infrastructure_threats.yml
@@ -0,0 +1,53 @@
+name: Detect IPv6 Network Infrastructure Threats
+id: c3be767e-7959-44c5-8976-0e9c12a91ad2
+version: 1
+date: '2020-10-28'
+description: By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's
+ network devices, we will be able to detect various attacks such as packet forging in the Infrastructure.
+how_to_implement: This search uses a standard SPL query on logs from Cisco Network
+ devices. The network devices must be configured with one or more First Hop Security measures such as
+ RA Guard, DHCP Guard and/or device tracking. See References for more information.
+ The search also requires that the Cisco Networks Add-on for Splunk
+ (https://splunkbase.splunk.com/app/1467) is used to
+ parse the logs from the Cisco network devices.
+type: ESCU
+references:
+- https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf
+- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-ra-guard.html
+- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-snooping.html
+- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-dad-proxy.html
+- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-nd-mcast-supp.html
+- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-dhcpv6-guard.html
+- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-src-guard.html
+- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ipv6-dest-guard.html
+author: Mikael Bjerkeland, Splunk
+search: '`cisco_networks` facility="SISF" mnemonic IN ("IP_THEFT","MAC_THEFT","MAC_AND_IP_THEFT","PAK_DROP") | eval src_interface=src_int_prefix_long+src_int_suffix
+| eval dest_interface=dest_int_prefix_long+dest_int_suffix
+| stats min(_time) AS firstTime max(_time) AS lastTime values(src_mac) AS src_mac values(src_vlan) AS src_vlan
+values(mnemonic) AS mnemonic values(vendor_explanation) AS vendor_explanation values(src_ip) AS src_ip values(dest_ip) AS dest_ip
+values(dest_interface) AS dest_interface values(action) AS action count BY host src_interface
+| table host src_interface dest_interface src_mac src_ip dest_ip src_vlan mnemonic vendor_explanation action count
+| `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
+| `detect_ipv6_network_infrastructure_threats_filter`'
+known_false_positives: None currently known
+tags:
+ analytics_story:
+ - Router and Infrastructure Security
+ kill_chain_phases:
+ - Reconnaissance
+ - Delivery
+ - Actions on Objectives
+ mitre_attack_id:
+ - T1200
+ - T1498
+ - T1557.002
+ cis20:
+ - CIS 1
+ - CIS 11
+ nist:
+ - ID.AM
+ - PR.DS
+ detection_name: Detect IPv6 Network Infrastructure Threats
+ security_domain: network
+ asset_type: Infrastructure
+
diff --git a/detections/network/detect_port_security_violation.yml b/detections/network/detect_port_security_violation.yml
new file mode 100644
index 0000000000..0628b422df
--- /dev/null
+++ b/detections/network/detect_port_security_violation.yml
@@ -0,0 +1,47 @@
+name: Detect Port Security Violation
+id: 2de3d5b8-a4fa-45c5-8540-6d071c194d24
+version: 1
+date: '2020-10-28'
+description: By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs.
+how_to_implement: This search uses a standard SPL query on logs from Cisco Network
+ devices. The network devices must be configured with Port Security and Error Disable for this to work
+ (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html)
+ and log with a severity level of minimum "5 - notification".
+ The search also requires that the Cisco Networks Add-on for Splunk
+ (https://splunkbase.splunk.com/app/1467) is used to
+ parse the logs from the Cisco network devices.
+type: ESCU
+references: []
+author: Mikael Bjerkeland, Splunk
+search: '`cisco_networks` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="psecure-violation")
+OR (facility="PORT_SECURITY" mnemonic="PSECURE_VIOLATION" OR mnemonic="PSECURE_VIOLATION_VLAN")
+| eval src_interface=src_int_prefix_long+src_int_suffix
+| stats min(_time) AS firstTime max(_time) AS lastTime values(disable_cause) AS disable_cause values(src_mac) AS src_mac
+values(src_vlan) AS src_vlan values(action) AS action count by host src_interface
+| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+| `detect_port_security_violation_filter`'
+known_false_positives: This search might be prone to high false positives if
+ you have malfunctioning devices connected to your ethernet ports or if end
+ users periodically connect physical devices to the network.
+tags:
+ analytics_story:
+ - Router and Infrastructure Security
+ kill_chain_phases:
+ - Reconnaissance
+ - Delivery
+ - Exploitation
+ - Actions on Objectives
+ mitre_attack_id:
+ - T1200
+ - T1498
+ - T1557.002
+ cis20:
+ - CIS 1
+ - CIS 11
+ nist:
+ - ID.AM
+ - PR.DS
+ detection_name: Detect Port Security Violation
+ security_domain: network
+ asset_type: Infrastructure
+
diff --git a/detections/network/detect_software_download_to_network_device.yml b/detections/network/detect_software_download_to_network_device.yml
new file mode 100644
index 0000000000..66f19a7867
--- /dev/null
+++ b/detections/network/detect_software_download_to_network_device.yml
@@ -0,0 +1,35 @@
+name: Detect Software Download To Network Device
+id: cc590c66-f65f-48f2-986a-4797244762f8
+version: 1
+date: '2020-10-28'
+description: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.
+how_to_implement: This search looks for Network Traffic events to TFTP, FTP or SSH/SCP ports from network devices. Make sure to tag any network devices as network, router or switch in order for this detection to work. If the TFTP traffic doesn't traverse a firewall nor packet inspection, these events will not be logged. This is typically an issue if the TFTP server is on the same subnet as the network device. There is also a chance of the network device loading software using a DHCP assigned IP address (netboot) which is not in the Asset inventory.
+type: ESCU
+references: []
+author: Mikael Bjerkeland, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+as lastTime from datamodel=Network_Traffic where
+(All_Traffic.transport=udp AND All_Traffic.dest_port=69)
+OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=21)
+OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=22) AND
+ All_Traffic.dest_category!=common_software_repo_destination AND All_Traffic.src_category=network OR All_Traffic.src_category=router OR All_Traffic.src_category=switch
+ by All_Traffic.src All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")`
+ | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_software_download_to_network_device_filter`'
+known_false_positives: This search will also report any legitimate attempts of software downloads to network devices as well as outbound SSH sessions from network devices.
+tags:
+ analytics_story:
+ - Router and Infrastructure Security
+ kill_chain_phases:
+ - Delivery
+ mitre_attack_id:
+ - T1542.005
+ cis20:
+ - CIS 1
+ - CIS 11
+ nist:
+ - ID.AM
+ - PR.DS
+ detection_name: Detect Software Download To Network Device
+ security_domain: network
+ asset_type: Infrastructure
+
diff --git a/detections/network/detect_traffic_mirroring.yml b/detections/network/detect_traffic_mirroring.yml
new file mode 100644
index 0000000000..c35150a815
--- /dev/null
+++ b/detections/network/detect_traffic_mirroring.yml
@@ -0,0 +1,43 @@
+name: Detect Traffic Mirroring
+id: 42b3b753-5925-49c5-9742-36fa40a73990
+version: 1
+date: '2020-10-28'
+description: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device.
+how_to_implement: This search uses a standard SPL query on logs from Cisco Network
+ devices. The network devices must log with a severity level of minimum "5 - notification".
+ The search also requires that the Cisco Networks Add-on for Splunk
+ (https://splunkbase.splunk.com/app/1467) is used to
+ parse the logs from the Cisco network devices and that the devices have been configured according to the documentation of the Cisco Networks Add-on.
+ Also note that an attacker may disable logging from the device prior to enabling traffic mirroring.
+type: ESCU
+references: []
+author: Mikael Bjerkeland, Splunk
+search: '`cisco_networks` (facility="MIRROR" mnemonic="ETH_SPAN_SESSION_UP")
+OR (facility="SPAN" mnemonic="SESSION_UP")
+OR (facility="SPAN" mnemonic="PKTCAP_START")
+OR (mnemonic="CFGLOG_LOGGEDCMD" command="monitor session*")
+ | stats min(_time) AS firstTime max(_time) AS lastTime count
+ BY host facility mnemonic
+ | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` |
+ `detect_traffic_mirroring_filter`'
+known_false_positives: This search will return false positives for any legitimate traffic captures by network administrators.
+tags:
+ analytics_story:
+ - Router and Infrastructure Security
+ kill_chain_phases:
+ - Delivery
+ - Actions on Objectives
+ mitre_attack_id:
+ - T1200
+ - T1498
+ - T1020.001
+ cis20:
+ - CIS 1
+ - CIS 11
+ nist:
+ - ID.AM
+ - PR.DS
+ detection_name: Detect Traffic Mirroring
+ security_domain: network
+ asset_type: Infrastructure
+
diff --git a/macros/detect_ipv6_network_infrastructure_threats_filter.yml b/macros/detect_ipv6_network_infrastructure_threats_filter.yml
new file mode 100644
index 0000000000..93706055bb
--- /dev/null
+++ b/macros/detect_ipv6_network_infrastructure_threats_filter.yml
@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters to prevent i.e. false positives
+name: detect_arp_poisoning_filter
diff --git a/macros/detect_port_security_violation_filter.yml b/macros/detect_port_security_violation_filter.yml
new file mode 100644
index 0000000000..22785bcbb6
--- /dev/null
+++ b/macros/detect_port_security_violation_filter.yml
@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters to prevent i.e. false positives
+name: detect_port_security_violation_filter
diff --git a/macros/detect_software_download_to_network_device_filter.yml b/macros/detect_software_download_to_network_device_filter.yml
new file mode 100644
index 0000000000..2ac587765f
--- /dev/null
+++ b/macros/detect_software_download_to_network_device_filter.yml
@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters to prevent i.e. false positives
+name: detect_software_download_to_network_device_filter
diff --git a/macros/detect_traffic_mirroring_filter.yml b/macros/detect_traffic_mirroring_filter.yml
new file mode 100644
index 0000000000..3749765044
--- /dev/null
+++ b/macros/detect_traffic_mirroring_filter.yml
@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters to prevent i.e. false positives
+name: detect_traffic_mirroring_filter
diff --git a/notebooks/detect_kerberoasting__ssa.ipynb b/notebooks/detect_kerberoasting__ssa.ipynb
new file mode 100644
index 0000000000..1c905de653
--- /dev/null
+++ b/notebooks/detect_kerberoasting__ssa.ipynb
@@ -0,0 +1,143 @@
+{
+ "cells": [
+ {
+ "cell_type": "markdown",
+ "metadata": {},
+ "source": [
+ "# Detect Kerberoasting\n",
+ "### This is the SPL2 to test content: detections/endpoint/detect_kerberoasting__ssa.yml"
+ ]
+ },
+ {
+ "cell_type": "code",
+ "execution_count": 1,
+ "metadata": {
+ "execution": {
+ "iopub.execute_input": "2020-10-28T22:35:40.972663Z",
+ "iopub.status.busy": "2020-10-28T22:35:40.972286Z",
+ "iopub.status.idle": "2020-10-28T22:35:42.632374Z",
+ "shell.execute_reply": "2020-10-28T22:35:42.631440Z",
+ "shell.execute_reply.started": "2020-10-28T22:35:40.972629Z"
+ }
+ },
+ "outputs": [
+ {
+ "data": {
+ "application/vnd.jupyter.widget-view+json": {
+ "model_id": "2ea98fa914f748d487beaf1b4b188a4d",
+ "version_major": 2,
+ "version_minor": 0
+ },
+ "text/plain": [
+ "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
+ ]
+ },
+ "metadata": {},
+ "output_type": "display_data"
+ },
+ {
+ "name": "stdout",
+ "output_type": "stream",
+ "text": [
+ " Finished. "
+ ]
+ },
+ {
+ "data": {
+ "text/html": [
+ "\n",
+ "\n",
+ "
\n",
+ " \n",
+ " \n",
+ " | \n",
+ " end_time | \n",
+ " start_time | \n",
+ " body | \n",
+ " entities | \n",
+ "
\n",
+ " \n",
+ " \n",
+ " \n",
+ " | 0 | \n",
+ " 1119 | \n",
+ " 1119 | \n",
+ " TBD | \n",
+ " TBD | \n",
+ "
\n",
+ " \n",
+ "
\n",
+ "
\n",
+ "\n",
+ "
\n",
+ " \n",
+ " \n",
+ " | \n",
+ " end_time | \n",
+ " start_time | \n",
+ " body | \n",
+ " entities | \n",
+ "
\n",
+ " \n",
+ " \n",
+ " \n",
+ " | 0 | \n",
+ " 6 | \n",
+ " 6 | \n",
+ " TBD | \n",
+ " TBD | \n",
+ "
\n",
+ " \n",
+ " | 1 | \n",
+ " 8 | \n",
+ " 8 | \n",
+ " TBD | \n",
+ " TBD | \n",
+ "
\n",
+ " \n",
+ "
\n",
+ "