From 54d12d03c10105221ff68fff61c64216d1716875 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Thu, 22 Oct 2020 09:03:21 +0000 Subject: [PATCH 01/30] add two lateral movement detections --- .../detect_kerberoasting_T1558.003__ssa.yml | 31 ++++++++++++++++ .../detect_pass_hash_T1550.002__ssa.yml | 36 +++++++++++++++++++ 2 files changed, 67 insertions(+) create mode 100644 detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml create mode 100644 detections/endpoint/detect_pass_hash_T1550.002__ssa.yml diff --git a/detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml b/detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml new file mode 100644 index 0000000000..59ff4e6256 --- /dev/null +++ b/detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml @@ -0,0 +1,31 @@ +name: Detect Kerberoasting - SSA +id: dabdd6d7-3e10-42be-8711-4e124f7a3850 +version: 1 +date: '2020-10-21' +description: This search detects a potential kerberoasting attack via service principal + name requests +how_to_implement: The test data is converted from Windows Security Event logs generated + from Attach Range simulation and used in SPL search and extended to SPL2 +type: SSA +references: [Initial ESCU implementation by Jose Hernandez and Patrick Bareiss] +author: Xiao Lin, Splunk +search: ' | from read_ssa_enriched_events() +| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), eval _time=map_get(jsonMap, "_time"), EventCode=map_get(jsonMap, "EventCode"), TicketOptions=map_get(jsonMap, "TicketOptions"), TicketEncryptionType=map_get(jsonMap, "TicketEncryptionType"), ServiceName=map_get(jsonMap, "ServiceName"), ServiceID=map_get(jsonMap, "ServiceID") +| first_time_event cache_partitions=1 input_columns="EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID" +| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" +| select start_time, end_time, entities, body +| into write_ssa_detected_events(); ' +known_false_positives: Older systems that support kerberos RC4 by default NetApp may + generate false positives +tags: + mitre_attack_id: + - T1558.003 + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 8 + - CIS 16 + nist: + - DE.CM + security_domain: endpoint + risk_severity: low diff --git a/detections/endpoint/detect_pass_hash_T1550.002__ssa.yml b/detections/endpoint/detect_pass_hash_T1550.002__ssa.yml new file mode 100644 index 0000000000..ab68b96096 --- /dev/null +++ b/detections/endpoint/detect_pass_hash_T1550.002__ssa.yml @@ -0,0 +1,36 @@ +name: Detect Pass the Hash - SSA +id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f +version: 1 +date: '2020-10-21' +description: This search looks for specific authentication events from the Windows + Security Event logs to detect potential attempts using Pass-the-Hash technique. +how_to_implement: The test data is converted from Windows Security Event logs generated + from Attach Range simulation and used in SPL search and extended to SPL2 +type: SSA +references: [Initial ESCU implementation by Bhavin Patel and Patrick Bareiss] +author: Xiao Lin, Splunk +search: ' | from read_ssa_enriched_events() +| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), _time=map_get(jsonMap, "_time"), EventCode=map_get(jsonMap, "EventCode"), LogonType=map_get(jsonMap, "LogonType"), LogonProcess=map_get(jsonMap, "LogonProcess"), ComputerName=map_get(jsonMap, "ComputerName"), AccountName=map_get(jsonMap, "AccountName") +| where (LogonType="3" AND LogonProcess="NtLmSsp" AND AccountName IS NOT NULL) OR (LogonType="9" AND LogonProcess="seclogo") +| first_time_event cache_partitions=1 input_columns="EventCode,LogonProcess,ComputerName" +| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" +| select start_time, end_time, entities, body +| into write_ssa_detected_events(); ' +known_false_positives: Legitimate logon activity by authorized NTLM systems may be + detected by this search. Please investigate as appropriate. +tags: + mitre_attack_id: + - T1550.002 + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + security_domain: endpoint + risk_severity: low From 1f513170374b950269a45fa75cd19eaa1f5f772c Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Thu, 22 Oct 2020 10:22:33 +0000 Subject: [PATCH 02/30] update --- detections/endpoint/detect_pass_hash_T1550.002__ssa.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/detect_pass_hash_T1550.002__ssa.yml b/detections/endpoint/detect_pass_hash_T1550.002__ssa.yml index ab68b96096..e9ec32bae0 100644 --- a/detections/endpoint/detect_pass_hash_T1550.002__ssa.yml +++ b/detections/endpoint/detect_pass_hash_T1550.002__ssa.yml @@ -13,6 +13,7 @@ search: ' | from read_ssa_enriched_events() | eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), _time=map_get(jsonMap, "_time"), EventCode=map_get(jsonMap, "EventCode"), LogonType=map_get(jsonMap, "LogonType"), LogonProcess=map_get(jsonMap, "LogonProcess"), ComputerName=map_get(jsonMap, "ComputerName"), AccountName=map_get(jsonMap, "AccountName") | where (LogonType="3" AND LogonProcess="NtLmSsp" AND AccountName IS NOT NULL) OR (LogonType="9" AND LogonProcess="seclogo") | first_time_event cache_partitions=1 input_columns="EventCode,LogonProcess,ComputerName" +| where first_time_EventCode_LogonProcess_ComputerName | eval start_time=_time, end_time=_time, body="TBD", entities="TBD" | select start_time, end_time, entities, body | into write_ssa_detected_events(); ' From 022ead83ffd34adb810d1deff2d3368452fbe4a0 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Thu, 22 Oct 2020 11:07:58 +0000 Subject: [PATCH 03/30] update --- detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml b/detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml index 59ff4e6256..9d28a35613 100644 --- a/detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml +++ b/detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml @@ -11,7 +11,9 @@ references: [Initial ESCU implementation by Jose Hernandez and Patrick Bareiss] author: Xiao Lin, Splunk search: ' | from read_ssa_enriched_events() | eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), eval _time=map_get(jsonMap, "_time"), EventCode=map_get(jsonMap, "EventCode"), TicketOptions=map_get(jsonMap, "TicketOptions"), TicketEncryptionType=map_get(jsonMap, "TicketEncryptionType"), ServiceName=map_get(jsonMap, "ServiceName"), ServiceID=map_get(jsonMap, "ServiceID") +| where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event cache_partitions=1 input_columns="EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID" +| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID | eval start_time=_time, end_time=_time, body="TBD", entities="TBD" | select start_time, end_time, entities, body | into write_ssa_detected_events(); ' From 112bf977c2395e8bb799926a5db2ed3a8af952ae Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Thu, 22 Oct 2020 19:41:56 +0000 Subject: [PATCH 04/30] remove mitre id from filename --- .../endpoint/detect_kerberoasting__ssa.yml | 33 +++++++++++++++++ detections/endpoint/detect_pass_hash__ssa.yml | 37 +++++++++++++++++++ 2 files changed, 70 insertions(+) create mode 100644 detections/endpoint/detect_kerberoasting__ssa.yml create mode 100644 detections/endpoint/detect_pass_hash__ssa.yml diff --git a/detections/endpoint/detect_kerberoasting__ssa.yml b/detections/endpoint/detect_kerberoasting__ssa.yml new file mode 100644 index 0000000000..496e4924ac --- /dev/null +++ b/detections/endpoint/detect_kerberoasting__ssa.yml @@ -0,0 +1,33 @@ +name: Detect Kerberoasting +id: dabdd6d7-3e10-42be-8711-4e124f7a3850 +version: 1 +date: '2020-10-21' +description: This search detects a potential kerberoasting attack via service principal + name requests +how_to_implement: The test data is converted from Windows Security Event logs generated + from Attach Range simulation and used in SPL search and extended to SPL2 +type: SSA +references: [Initial ESCU implementation by Jose Hernandez and Patrick Bareiss] +author: Xiao Lin, Splunk +search: ' | from read_ssa_enriched_events() +| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), eval _time=map_get(jsonMap, "_time"), EventCode=map_get(jsonMap, "EventCode"), TicketOptions=map_get(jsonMap, "TicketOptions"), TicketEncryptionType=map_get(jsonMap, "TicketEncryptionType"), ServiceName=map_get(jsonMap, "ServiceName"), ServiceID=map_get(jsonMap, "ServiceID") +| where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" +| first_time_event cache_partitions=1 input_columns="EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID" +| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID +| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" +| select start_time, end_time, entities, body +| into write_ssa_detected_events(); ' +known_false_positives: Older systems that support kerberos RC4 by default NetApp may + generate false positives +tags: + mitre_attack_id: + - T1558.003 + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 8 + - CIS 16 + nist: + - DE.CM + security_domain: endpoint + risk_severity: low diff --git a/detections/endpoint/detect_pass_hash__ssa.yml b/detections/endpoint/detect_pass_hash__ssa.yml new file mode 100644 index 0000000000..f26c2b5c1c --- /dev/null +++ b/detections/endpoint/detect_pass_hash__ssa.yml @@ -0,0 +1,37 @@ +name: Detect Pass the Hash +id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f +version: 1 +date: '2020-10-21' +description: This search looks for specific authentication events from the Windows + Security Event logs to detect potential attempts using Pass-the-Hash technique. +how_to_implement: The test data is converted from Windows Security Event logs generated + from Attach Range simulation and used in SPL search and extended to SPL2 +type: SSA +references: [Initial ESCU implementation by Bhavin Patel and Patrick Bareiss] +author: Xiao Lin, Splunk +search: ' | from read_ssa_enriched_events() +| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), _time=map_get(jsonMap, "_time"), EventCode=map_get(jsonMap, "EventCode"), LogonType=map_get(jsonMap, "LogonType"), LogonProcess=map_get(jsonMap, "LogonProcess"), ComputerName=map_get(jsonMap, "ComputerName"), AccountName=map_get(jsonMap, "AccountName") +| where (LogonType="3" AND LogonProcess="NtLmSsp" AND AccountName IS NOT NULL) OR (LogonType="9" AND LogonProcess="seclogo") +| first_time_event cache_partitions=1 input_columns="EventCode,LogonProcess,ComputerName" +| where first_time_EventCode_LogonProcess_ComputerName +| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" +| select start_time, end_time, entities, body +| into write_ssa_detected_events(); ' +known_false_positives: Legitimate logon activity by authorized NTLM systems may be + detected by this search. Please investigate as appropriate. +tags: + mitre_attack_id: + - T1550.002 + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + security_domain: endpoint + risk_severity: low From 4cabe9af56e831dc093afb923e3c7b9dfe1481b8 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Thu, 22 Oct 2020 19:43:06 +0000 Subject: [PATCH 05/30] remove mitre id from filename --- .../detect_kerberoasting_T1558.003__ssa.yml | 33 ----------------- .../detect_pass_hash_T1550.002__ssa.yml | 37 ------------------- 2 files changed, 70 deletions(-) delete mode 100644 detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml delete mode 100644 detections/endpoint/detect_pass_hash_T1550.002__ssa.yml diff --git a/detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml b/detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml deleted file mode 100644 index 9d28a35613..0000000000 --- a/detections/endpoint/detect_kerberoasting_T1558.003__ssa.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: Detect Kerberoasting - SSA -id: dabdd6d7-3e10-42be-8711-4e124f7a3850 -version: 1 -date: '2020-10-21' -description: This search detects a potential kerberoasting attack via service principal - name requests -how_to_implement: The test data is converted from Windows Security Event logs generated - from Attach Range simulation and used in SPL search and extended to SPL2 -type: SSA -references: [Initial ESCU implementation by Jose Hernandez and Patrick Bareiss] -author: Xiao Lin, Splunk -search: ' | from read_ssa_enriched_events() -| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), eval _time=map_get(jsonMap, "_time"), EventCode=map_get(jsonMap, "EventCode"), TicketOptions=map_get(jsonMap, "TicketOptions"), TicketEncryptionType=map_get(jsonMap, "TicketEncryptionType"), ServiceName=map_get(jsonMap, "ServiceName"), ServiceID=map_get(jsonMap, "ServiceID") -| where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" -| first_time_event cache_partitions=1 input_columns="EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID" -| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID -| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" -| select start_time, end_time, entities, body -| into write_ssa_detected_events(); ' -known_false_positives: Older systems that support kerberos RC4 by default NetApp may - generate false positives -tags: - mitre_attack_id: - - T1558.003 - kill_chain_phases: - - Actions on Objectives - cis20: - - CIS 8 - - CIS 16 - nist: - - DE.CM - security_domain: endpoint - risk_severity: low diff --git a/detections/endpoint/detect_pass_hash_T1550.002__ssa.yml b/detections/endpoint/detect_pass_hash_T1550.002__ssa.yml deleted file mode 100644 index e9ec32bae0..0000000000 --- a/detections/endpoint/detect_pass_hash_T1550.002__ssa.yml +++ /dev/null @@ -1,37 +0,0 @@ -name: Detect Pass the Hash - SSA -id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f -version: 1 -date: '2020-10-21' -description: This search looks for specific authentication events from the Windows - Security Event logs to detect potential attempts using Pass-the-Hash technique. -how_to_implement: The test data is converted from Windows Security Event logs generated - from Attach Range simulation and used in SPL search and extended to SPL2 -type: SSA -references: [Initial ESCU implementation by Bhavin Patel and Patrick Bareiss] -author: Xiao Lin, Splunk -search: ' | from read_ssa_enriched_events() -| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), _time=map_get(jsonMap, "_time"), EventCode=map_get(jsonMap, "EventCode"), LogonType=map_get(jsonMap, "LogonType"), LogonProcess=map_get(jsonMap, "LogonProcess"), ComputerName=map_get(jsonMap, "ComputerName"), AccountName=map_get(jsonMap, "AccountName") -| where (LogonType="3" AND LogonProcess="NtLmSsp" AND AccountName IS NOT NULL) OR (LogonType="9" AND LogonProcess="seclogo") -| first_time_event cache_partitions=1 input_columns="EventCode,LogonProcess,ComputerName" -| where first_time_EventCode_LogonProcess_ComputerName -| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" -| select start_time, end_time, entities, body -| into write_ssa_detected_events(); ' -known_false_positives: Legitimate logon activity by authorized NTLM systems may be - detected by this search. Please investigate as appropriate. -tags: - mitre_attack_id: - - T1550.002 - kill_chain_phases: - - Actions on Objectives - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - nist: - - PR.PT - - PR.AT - - PR.AC - - PR.IP - security_domain: endpoint - risk_severity: low From 4b933ff9ef72b5d373b1259e78424d37a08a897f Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Thu, 22 Oct 2020 20:54:31 +0000 Subject: [PATCH 06/30] add test notebooks --- .../endpoint/detect_kerberoasting__ssa.yml | 2 +- detections/endpoint/detect_pass_hash__ssa.yml | 2 +- notebooks/detect_kerberoasting__ssa.ipynb | 141 ++++++++++++++++ notebooks/detect_pass_hash__ssa.ipynb | 150 ++++++++++++++++++ 4 files changed, 293 insertions(+), 2 deletions(-) create mode 100644 notebooks/detect_kerberoasting__ssa.ipynb create mode 100644 notebooks/detect_pass_hash__ssa.ipynb diff --git a/detections/endpoint/detect_kerberoasting__ssa.yml b/detections/endpoint/detect_kerberoasting__ssa.yml index 496e4924ac..9d28a35613 100644 --- a/detections/endpoint/detect_kerberoasting__ssa.yml +++ b/detections/endpoint/detect_kerberoasting__ssa.yml @@ -1,4 +1,4 @@ -name: Detect Kerberoasting +name: Detect Kerberoasting - SSA id: dabdd6d7-3e10-42be-8711-4e124f7a3850 version: 1 date: '2020-10-21' diff --git a/detections/endpoint/detect_pass_hash__ssa.yml b/detections/endpoint/detect_pass_hash__ssa.yml index f26c2b5c1c..e9ec32bae0 100644 --- a/detections/endpoint/detect_pass_hash__ssa.yml +++ b/detections/endpoint/detect_pass_hash__ssa.yml @@ -1,4 +1,4 @@ -name: Detect Pass the Hash +name: Detect Pass the Hash - SSA id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f version: 1 date: '2020-10-21' diff --git a/notebooks/detect_kerberoasting__ssa.ipynb b/notebooks/detect_kerberoasting__ssa.ipynb new file mode 100644 index 0000000000..a3d20c72e2 --- /dev/null +++ b/notebooks/detect_kerberoasting__ssa.ipynb @@ -0,0 +1,141 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# Detect Kerberoasting\n", + "### This is the SPL2 to test content: detections/endpoint/detect_kerberoasting__ssa.yml" + ] + }, + { + "cell_type": "code", + "execution_count": 1, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-22T20:44:38.964037Z", + "iopub.status.busy": "2020-10-22T20:44:38.963628Z", + "iopub.status.idle": "2020-10-22T20:44:40.567454Z", + "shell.execute_reply": "2020-10-22T20:44:40.566775Z", + "shell.execute_reply.started": "2020-10-22T20:44:38.963999Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "702e0bb319bd4d7aa68aae0d02dc504c", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
end_timestart_timebodyentities
011191119TBDTBD
\n", + "
" + ], + "text/plain": [ + " end_time start_time body entities\n", + "0 1119 1119 TBD TBD" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 1, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_json(\"s3://smle-experiments/datasets/ssa/T1558.003.json\")\n", + "| where EventCode=\"4769\" AND TicketOptions=\"0x40810000\" AND TicketEncryptionType=\"0x17\"\n", + "| first_time_event cache_partitions=1 input_columns=\"EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID\"\n", + "| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID\n", + "| eval start_time=_time, end_time=_time, body=\"TBD\", entities=\"TBD\"\n", + "| select start_time, end_time, entities, body \n", + ";" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "SPL2", + "language": "SPL", + "name": "spl2" + }, + "language_info": { + "mimetype": "text/spl", + "name": "SPL" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +} diff --git a/notebooks/detect_pass_hash__ssa.ipynb b/notebooks/detect_pass_hash__ssa.ipynb new file mode 100644 index 0000000000..861cb1108a --- /dev/null +++ b/notebooks/detect_pass_hash__ssa.ipynb @@ -0,0 +1,150 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-14T00:24:08.027638Z", + "iopub.status.busy": "2020-10-14T00:24:08.027292Z", + "iopub.status.idle": "2020-10-14T00:24:08.030791Z", + "shell.execute_reply": "2020-10-14T00:24:08.030084Z", + "shell.execute_reply.started": "2020-10-14T00:24:08.027607Z" + } + }, + "source": [ + "# Detect Pass the Hash\n", + "### This is the SPL2 to test content: detections/endpoint/detect_pass_hash__ssa.yml" + ] + }, + { + "cell_type": "code", + "execution_count": 1, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-22T20:41:47.358214Z", + "iopub.status.busy": "2020-10-22T20:41:47.357931Z", + "iopub.status.idle": "2020-10-22T20:41:48.842814Z", + "shell.execute_reply": "2020-10-22T20:41:48.842108Z", + "shell.execute_reply.started": "2020-10-22T20:41:47.358186Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "ed51709702334ed885ff69d0751cd6a5", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
end_timestart_timebodyentities
066TBDTBD
188TBDTBD
\n", + "
" + ], + "text/plain": [ + " end_time start_time body entities\n", + "0 6 6 TBD TBD\n", + "1 8 8 TBD TBD" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 1, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_json(\"s3://smle-experiments/datasets/ssa/T1550.002.json\")\n", + "| where (LogonType=\"3\" AND LogonProcess=\"NtLmSsp\" AND AccountName IS NOT NULL) OR (LogonType=\"9\" AND LogonProcess=\"seclogo\")\n", + "| first_time_event cache_partitions=1 input_columns=\"EventCode,LogonProcess,ComputerName\"\n", + "| where first_time_EventCode_LogonProcess_ComputerName\n", + "| eval start_time=_time, end_time=_time, body=\"TBD\", entities=\"TBD\"\n", + "| select start_time, end_time, entities, body \n", + ";" + ] + } + ], + "metadata": { + "kernelspec": { + "display_name": "SPL2", + "language": "SPL", + "name": "spl2" + }, + "language_info": { + "mimetype": "text/spl", + "name": "SPL" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +} From 45f67bc365a255a45dbbb45793e373cf11e446d9 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Thu, 22 Oct 2020 21:09:27 +0000 Subject: [PATCH 07/30] add test data --- tests/endpoint/detect_kerberoasting__ssa.test.yml | 10 ++++++++++ tests/endpoint/detect_pass_hash__ssa.test.yml | 10 ++++++++++ 2 files changed, 20 insertions(+) create mode 100644 tests/endpoint/detect_kerberoasting__ssa.test.yml create mode 100644 tests/endpoint/detect_pass_hash__ssa.test.yml diff --git a/tests/endpoint/detect_kerberoasting__ssa.test.yml b/tests/endpoint/detect_kerberoasting__ssa.test.yml new file mode 100644 index 0000000000..8fe47735c1 --- /dev/null +++ b/tests/endpoint/detect_kerberoasting__ssa.test.yml @@ -0,0 +1,10 @@ +name: Detect Kerberoasting - SSA Unit test +detections: + - name: Detect kerberoasting + file: endpoint/detect_kerberoasting__ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test detection of kerberoasting +attack_data: + - file_name: T1558.003.json + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1558.003/T1558.003.json + diff --git a/tests/endpoint/detect_pass_hash__ssa.test.yml b/tests/endpoint/detect_pass_hash__ssa.test.yml new file mode 100644 index 0000000000..eec8867003 --- /dev/null +++ b/tests/endpoint/detect_pass_hash__ssa.test.yml @@ -0,0 +1,10 @@ +name: Detect Pass the Hash - SSA Unit test +detections: + - name: Detect Pass the Hash + file: endpoint/detect_pass_hash__ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test detection of pass-the-hash +attack_data: + - file_name: T1550.002.json + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1550.002/T1550.002.json + From daea9d419274849067b3c75282f843bdfb2997d7 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Tue, 27 Oct 2020 22:30:00 +0000 Subject: [PATCH 08/30] change to use SSA input_event --- detections/application/detect_phishing_content___ssa.yml | 3 +-- detections/endpoint/detect_kerberoasting__ssa.yml | 2 +- detections/endpoint/detect_pass_hash__ssa.yml | 2 +- tests/endpoint/detect_kerberoasting__ssa.test.yml | 2 +- tests/endpoint/detect_pass_hash__ssa.test.yml | 2 +- 5 files changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/application/detect_phishing_content___ssa.yml b/detections/application/detect_phishing_content___ssa.yml index b0853c6f12..9aa9b1f21d 100644 --- a/detections/application/detect_phishing_content___ssa.yml +++ b/detections/application/detect_phishing_content___ssa.yml @@ -20,8 +20,7 @@ references: [ ] type: SSA author: Xiao Lin, Splunk search: '| from read_ssa_enriched_events() -| where source_type="email" -| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), eventLine=concat(ucast(map_get(jsonMap, "From"), "string", " "), " ", ucast(map_get(jsonMap, "Subject"), "string", " "), " ", ucast(map_get(jsonMap, "Content"), "string", " "), " "), _time=map_get(jsonMap, "_time") +| eval eventLine=concat(ucast(map_get(input_event, "From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", " "), " ", ucast(map_get(input_event, "Content"), "string", " "), " "), _time=map_get(input_event, "_time") | where eventLine IS NOT NULL | eval mapC={" ": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40, ")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49, "2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58, ";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67, "D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76, "M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85, "V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94, "_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g": 103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o": 111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w": 119, "x": 120, "y": 121, "z": 122, "{": 123, "|": 124, "}": 125, "~": 126}, ml_in = for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i, 1)), "float") ) diff --git a/detections/endpoint/detect_kerberoasting__ssa.yml b/detections/endpoint/detect_kerberoasting__ssa.yml index 9d28a35613..782efb9647 100644 --- a/detections/endpoint/detect_kerberoasting__ssa.yml +++ b/detections/endpoint/detect_kerberoasting__ssa.yml @@ -10,7 +10,7 @@ type: SSA references: [Initial ESCU implementation by Jose Hernandez and Patrick Bareiss] author: Xiao Lin, Splunk search: ' | from read_ssa_enriched_events() -| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), eval _time=map_get(jsonMap, "_time"), EventCode=map_get(jsonMap, "EventCode"), TicketOptions=map_get(jsonMap, "TicketOptions"), TicketEncryptionType=map_get(jsonMap, "TicketEncryptionType"), ServiceName=map_get(jsonMap, "ServiceName"), ServiceID=map_get(jsonMap, "ServiceID") +| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "EventCode"), TicketOptions=map_get(input_event, "TicketOptions"), TicketEncryptionType=map_get(input_event, "TicketEncryptionType"), ServiceName=map_get(input_event, "ServiceName"), ServiceID=map_get(input_event, "ServiceID") | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event cache_partitions=1 input_columns="EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID" | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID diff --git a/detections/endpoint/detect_pass_hash__ssa.yml b/detections/endpoint/detect_pass_hash__ssa.yml index e9ec32bae0..b7249ec417 100644 --- a/detections/endpoint/detect_pass_hash__ssa.yml +++ b/detections/endpoint/detect_pass_hash__ssa.yml @@ -10,7 +10,7 @@ type: SSA references: [Initial ESCU implementation by Bhavin Patel and Patrick Bareiss] author: Xiao Lin, Splunk search: ' | from read_ssa_enriched_events() -| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), _time=map_get(jsonMap, "_time"), EventCode=map_get(jsonMap, "EventCode"), LogonType=map_get(jsonMap, "LogonType"), LogonProcess=map_get(jsonMap, "LogonProcess"), ComputerName=map_get(jsonMap, "ComputerName"), AccountName=map_get(jsonMap, "AccountName") +| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "EventCode"), LogonType=map_get(input_event, "LogonType"), LogonProcess=map_get(input_event, "LogonProcess"), ComputerName=map_get(input_event, "ComputerName"), AccountName=map_get(input_event, "AccountName") | where (LogonType="3" AND LogonProcess="NtLmSsp" AND AccountName IS NOT NULL) OR (LogonType="9" AND LogonProcess="seclogo") | first_time_event cache_partitions=1 input_columns="EventCode,LogonProcess,ComputerName" | where first_time_EventCode_LogonProcess_ComputerName diff --git a/tests/endpoint/detect_kerberoasting__ssa.test.yml b/tests/endpoint/detect_kerberoasting__ssa.test.yml index 8fe47735c1..5e2c74bb38 100644 --- a/tests/endpoint/detect_kerberoasting__ssa.test.yml +++ b/tests/endpoint/detect_kerberoasting__ssa.test.yml @@ -2,7 +2,7 @@ name: Detect Kerberoasting - SSA Unit test detections: - name: Detect kerberoasting file: endpoint/detect_kerberoasting__ssa.yml - pass_condition: '| stats count | where count > 0' + pass_condition: '' description: Test detection of kerberoasting attack_data: - file_name: T1558.003.json diff --git a/tests/endpoint/detect_pass_hash__ssa.test.yml b/tests/endpoint/detect_pass_hash__ssa.test.yml index eec8867003..dc427027ce 100644 --- a/tests/endpoint/detect_pass_hash__ssa.test.yml +++ b/tests/endpoint/detect_pass_hash__ssa.test.yml @@ -2,7 +2,7 @@ name: Detect Pass the Hash - SSA Unit test detections: - name: Detect Pass the Hash file: endpoint/detect_pass_hash__ssa.yml - pass_condition: '| stats count | where count > 0' + pass_condition: '' description: Test detection of pass-the-hash attack_data: - file_name: T1550.002.json From d5c6d723618cbc8fe7f9dcfef1eddcf51232c7dc Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Wed, 28 Oct 2020 21:14:40 +0100 Subject: [PATCH 09/30] . --- detections/network/detect_arp_poisoning.yml | 2 +- ...ct_software_download_to_network_device.yml | 35 +++++++++++++++++++ ...ware_download_to_network_device_filter.yml | 3 ++ 3 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 detections/network/detect_software_download_to_network_device.yml create mode 100644 macros/detect_software_download_to_network_device_filter.yml diff --git a/detections/network/detect_arp_poisoning.yml b/detections/network/detect_arp_poisoning.yml index 2a447af268..6ae72d7a99 100644 --- a/detections/network/detect_arp_poisoning.yml +++ b/detections/network/detect_arp_poisoning.yml @@ -35,7 +35,7 @@ tags: mitre_attack_id: - T1200 - T1498 - - T1557 + - T1557.002 cis20: - CIS 1 - CIS 11 diff --git a/detections/network/detect_software_download_to_network_device.yml b/detections/network/detect_software_download_to_network_device.yml new file mode 100644 index 0000000000..790af182af --- /dev/null +++ b/detections/network/detect_software_download_to_network_device.yml @@ -0,0 +1,35 @@ +name: Detect Software Download To Network Device +id: cc590c66-f65f-48f2-986a-4797244762f8 +version: 1 +date: '2020-10-28' +description: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. +how_to_implement: This search looks for Network Traffic events to TFTP, FTP or SSH/SCP ports from network devices. Make sure to tag any network devices as network, router or switch in order for this detection to work. If the TFTP traffic doesn't traverse a firewall nor packet inspection, these events will not be logged. This is typically an issue if the TFTP server is on the same subnet as the network device. There is also a chance of the network device loading software using a DHCP assigned IP address (netboot) which is not in the Asset inventory. +type: ESCU +references: [] +author: Mikael Bjerkeland, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +as lastTime from datamodel=Network_Traffic where +(All_Traffic.transport=udp AND All_Traffic.dest_port=69) +OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=21) +OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=22) AND + All_Traffic.dest_category!=common_software_repo_destination AND All_Traffic.src_category=network OR All_Traffic.src_category=router OR All_Traffic.src_category=switch + by All_Traffic.src All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_software_download_to_network_device_filter`' +known_false_positives: This search will also report any legitimate software updates of network devices as well as outbound SSH sessions. +tags: + analytics_story: + - Router and Infrastructure Security + kill_chain_phases: + - Delivery + mitre_attack_id: + - T1542.005 + cis20: + - CIS 1 + - CIS 11 + nist: + - ID.AM + - PR.DS + detection_name: Detect Software Download To Network Device + security_domain: network + asset_type: Infrastructure + diff --git a/macros/detect_software_download_to_network_device_filter.yml b/macros/detect_software_download_to_network_device_filter.yml new file mode 100644 index 0000000000..2ac587765f --- /dev/null +++ b/macros/detect_software_download_to_network_device_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters to prevent i.e. false positives +name: detect_software_download_to_network_device_filter From bb626c1466aa1d93652acf0ef8c0c1303e1df65a Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Wed, 28 Oct 2020 21:20:36 +0100 Subject: [PATCH 10/30] . --- .../network/detect_software_download_to_network_device.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/detect_software_download_to_network_device.yml b/detections/network/detect_software_download_to_network_device.yml index 790af182af..66f19a7867 100644 --- a/detections/network/detect_software_download_to_network_device.yml +++ b/detections/network/detect_software_download_to_network_device.yml @@ -15,7 +15,7 @@ OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=22) AND All_Traffic.dest_category!=common_software_repo_destination AND All_Traffic.src_category=network OR All_Traffic.src_category=router OR All_Traffic.src_category=switch by All_Traffic.src All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_software_download_to_network_device_filter`' -known_false_positives: This search will also report any legitimate software updates of network devices as well as outbound SSH sessions. +known_false_positives: This search will also report any legitimate attempts of software downloads to network devices as well as outbound SSH sessions from network devices. tags: analytics_story: - Router and Infrastructure Security From 7e068a52674ffb6077eac47bc4a31570a0772ad6 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Wed, 28 Oct 2020 21:51:33 +0100 Subject: [PATCH 11/30] Added detection for T1020.001, Traffic Duplication --- .../network/detect_traffic_mirroring.yml | 42 +++++++++++++++++++ macros/detect_traffic_mirroring_filter.yml | 3 ++ 2 files changed, 45 insertions(+) create mode 100644 detections/network/detect_traffic_mirroring.yml create mode 100644 macros/detect_traffic_mirroring_filter.yml diff --git a/detections/network/detect_traffic_mirroring.yml b/detections/network/detect_traffic_mirroring.yml new file mode 100644 index 0000000000..5c809b245b --- /dev/null +++ b/detections/network/detect_traffic_mirroring.yml @@ -0,0 +1,42 @@ +name: Detect Traffic Mirroring +id: 42b3b753-5925-49c5-9742-36fa40a73990 +version: 1 +date: '2020-10-28' +description: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device. +how_to_implement: This search uses a standard SPL query on logs from Cisco Network + devices. The network devices must log with a severity level of minimum "5 - notification". + The search also requires that the Cisco Networks Add-on for Splunk + (https://splunkbase.splunk.com/app/1467) is used to + parse the logs from the Cisco network devices and that the devices have been configured according to the documentation of the Cisco Networks Add-on. +type: ESCU +references: [] +author: Mikael Bjerkeland, Splunk +search: '`cisco_networks` (facility="MIRROR" mnemonic="ETH_SPAN_SESSION_UP") +OR (facility="SPAN" mnemonic="SESSION_UP") +OR (facility="SPAN" mnemonic="PKTCAP_START") +OR (mnemonic="CFGLOG_LOGGEDCMD" command="monitor session*") + | stats min(_time) AS firstTime max(_time) AS lastTime count + BY host + | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | + `detect_traffic_mirroring_filter`' +known_false_positives: This search will return false positives for any legitimate traffic captures by network administrators. +tags: + analytics_story: + - Router and Infrastructure Security + kill_chain_phases: + - Delivery + - Actions on Objectives + mitre_attack_id: + - T1200 + - T1498 + - T1020.001 + cis20: + - CIS 1 + - CIS 11 + nist: + - ID.AM + - PR.DS + detection_name: Detect Traffic Mirroring + security_domain: network + asset_type: Infrastructure + diff --git a/macros/detect_traffic_mirroring_filter.yml b/macros/detect_traffic_mirroring_filter.yml new file mode 100644 index 0000000000..3749765044 --- /dev/null +++ b/macros/detect_traffic_mirroring_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters to prevent i.e. false positives +name: detect_traffic_mirroring_filter From 17502e47220290aa89fb8ef34c6559d1deeaa1a9 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Wed, 28 Oct 2020 23:14:06 +0100 Subject: [PATCH 12/30] Added various Network Infrastructure detections based on the MITRE Network Matrix --- ...ct_ipv6_network_infrastructure_threats.yml | 45 ++++++++++++++++++ .../detect_port_security_violation.yml | 47 +++++++++++++++++++ ..._network_infrastructure_threats_filter.yml | 3 ++ .../detect_port_security_violation_filter.yml | 3 ++ 4 files changed, 98 insertions(+) create mode 100644 detections/network/detect_ipv6_network_infrastructure_threats.yml create mode 100644 detections/network/detect_port_security_violation.yml create mode 100644 macros/detect_ipv6_network_infrastructure_threats_filter.yml create mode 100644 macros/detect_port_security_violation_filter.yml diff --git a/detections/network/detect_ipv6_network_infrastructure_threats.yml b/detections/network/detect_ipv6_network_infrastructure_threats.yml new file mode 100644 index 0000000000..dfb449f1bf --- /dev/null +++ b/detections/network/detect_ipv6_network_infrastructure_threats.yml @@ -0,0 +1,45 @@ +name: Detect IPv6 Network Infrastructure Threats +id: c3be767e-7959-44c5-8976-0e9c12a91ad2 +version: 1 +date: '2020-10-28' +description: By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's + network devices, we will be able to detect various attacks such as packet forging in the Infrastructure. +how_to_implement: This search uses a standard SPL query on logs from Cisco Network + devices. The network devices must be configured with one or more First Hop Security measures such as + RA Guard, DHCP Guard and/or device tracking. See References for more information. + The search also requires that the Cisco Networks Add-on for Splunk + (https://splunkbase.splunk.com/app/1467) is used to + parse the logs from the Cisco network devices. +type: ESCU +references: ['https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-ra-guard.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-snooping.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-dad-proxy.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-nd-mcast-supp.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-dhcpv6-guard.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-src-guard.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ipv6-dest-guard.html'] +author: Mikael Bjerkeland, Splunk +search: '`cisco_networks` (facility="SISF") | eval src_interface=src_int_prefix_long+src_int_suffix +| eval dest_interface=dest_int_prefix_long+dest_int_suffix +| stats min(_time) AS firstTime max(_time) AS lastTime values(src_mac) AS src_mac values(src_vlan) AS src_vlan +values(mnemonic) AS mnemonic values(vendor_explanation) AS vendor_explanation values(src_ip) AS src_ip values(dest_ip) AS dest_ip +values(dest_interface) AS dest_interface values(action) AS action count BY host src_interface +| table host src_interface dest_interface src_mac src_ip dest_ip src_vlan mnemonic vendor_explanation action count +| `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | +| `detect_ipv6_network_infrastructure_threats_filter`' +known_false_positives: None currently known +tags: + analytics_story: + - Router and Infrastructure Security + kill_chain_phases: + - Reconnaissance + - Delivery + - Actions on Objectives + mitre_attack_id: + - T1200 + - T1498 + - T1557.002 + cis20: + - CIS 1 + - CIS 11 + nist: + - ID.AM + - PR.DS + detection_name: Detect IPv6 Network Infrastructure Threats + security_domain: network + asset_type: Infrastructure + diff --git a/detections/network/detect_port_security_violation.yml b/detections/network/detect_port_security_violation.yml new file mode 100644 index 0000000000..0628b422df --- /dev/null +++ b/detections/network/detect_port_security_violation.yml @@ -0,0 +1,47 @@ +name: Detect Port Security Violation +id: 2de3d5b8-a4fa-45c5-8540-6d071c194d24 +version: 1 +date: '2020-10-28' +description: By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs. +how_to_implement: This search uses a standard SPL query on logs from Cisco Network + devices. The network devices must be configured with Port Security and Error Disable for this to work + (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html) + and log with a severity level of minimum "5 - notification". + The search also requires that the Cisco Networks Add-on for Splunk + (https://splunkbase.splunk.com/app/1467) is used to + parse the logs from the Cisco network devices. +type: ESCU +references: [] +author: Mikael Bjerkeland, Splunk +search: '`cisco_networks` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="psecure-violation") +OR (facility="PORT_SECURITY" mnemonic="PSECURE_VIOLATION" OR mnemonic="PSECURE_VIOLATION_VLAN") +| eval src_interface=src_int_prefix_long+src_int_suffix +| stats min(_time) AS firstTime max(_time) AS lastTime values(disable_cause) AS disable_cause values(src_mac) AS src_mac +values(src_vlan) AS src_vlan values(action) AS action count by host src_interface +| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +| `detect_port_security_violation_filter`' +known_false_positives: This search might be prone to high false positives if + you have malfunctioning devices connected to your ethernet ports or if end + users periodically connect physical devices to the network. +tags: + analytics_story: + - Router and Infrastructure Security + kill_chain_phases: + - Reconnaissance + - Delivery + - Exploitation + - Actions on Objectives + mitre_attack_id: + - T1200 + - T1498 + - T1557.002 + cis20: + - CIS 1 + - CIS 11 + nist: + - ID.AM + - PR.DS + detection_name: Detect Port Security Violation + security_domain: network + asset_type: Infrastructure + diff --git a/macros/detect_ipv6_network_infrastructure_threats_filter.yml b/macros/detect_ipv6_network_infrastructure_threats_filter.yml new file mode 100644 index 0000000000..93706055bb --- /dev/null +++ b/macros/detect_ipv6_network_infrastructure_threats_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters to prevent i.e. false positives +name: detect_arp_poisoning_filter diff --git a/macros/detect_port_security_violation_filter.yml b/macros/detect_port_security_violation_filter.yml new file mode 100644 index 0000000000..22785bcbb6 --- /dev/null +++ b/macros/detect_port_security_violation_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters to prevent i.e. false positives +name: detect_port_security_violation_filter From f9fa28dd18e9e94c9e16a355ce7156009d8e9a54 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Wed, 28 Oct 2020 23:26:56 +0100 Subject: [PATCH 13/30] Doc fix --- detections/network/detect_traffic_mirroring.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/network/detect_traffic_mirroring.yml b/detections/network/detect_traffic_mirroring.yml index 5c809b245b..42e100da1f 100644 --- a/detections/network/detect_traffic_mirroring.yml +++ b/detections/network/detect_traffic_mirroring.yml @@ -8,6 +8,7 @@ how_to_implement: This search uses a standard SPL query on logs from Cisco Netwo The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices and that the devices have been configured according to the documentation of the Cisco Networks Add-on. + Also note that an attacker may disable logging from the device prior to enabling traffic mirroring. type: ESCU references: [] author: Mikael Bjerkeland, Splunk From da26faa9d9d9225f978aa7cd181b8e5268f453d2 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Wed, 28 Oct 2020 22:57:25 +0000 Subject: [PATCH 14/30] change input field names --- .../endpoint/detect_kerberoasting__ssa.yml | 2 +- detections/endpoint/detect_pass_hash__ssa.yml | 2 +- notebooks/detect_kerberoasting__ssa.ipynb | 18 +++++++------ notebooks/detect_pass_hash__ssa.ipynb | 25 +++++++++++++------ 4 files changed, 29 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/detect_kerberoasting__ssa.yml b/detections/endpoint/detect_kerberoasting__ssa.yml index 782efb9647..351f156c92 100644 --- a/detections/endpoint/detect_kerberoasting__ssa.yml +++ b/detections/endpoint/detect_kerberoasting__ssa.yml @@ -10,7 +10,7 @@ type: SSA references: [Initial ESCU implementation by Jose Hernandez and Patrick Bareiss] author: Xiao Lin, Splunk search: ' | from read_ssa_enriched_events() -| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "EventCode"), TicketOptions=map_get(input_event, "TicketOptions"), TicketEncryptionType=map_get(input_event, "TicketEncryptionType"), ServiceName=map_get(input_event, "ServiceName"), ServiceID=map_get(input_event, "ServiceID") +| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, "service_id") | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event cache_partitions=1 input_columns="EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID" | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID diff --git a/detections/endpoint/detect_pass_hash__ssa.yml b/detections/endpoint/detect_pass_hash__ssa.yml index b7249ec417..1a93dfe51a 100644 --- a/detections/endpoint/detect_pass_hash__ssa.yml +++ b/detections/endpoint/detect_pass_hash__ssa.yml @@ -10,7 +10,7 @@ type: SSA references: [Initial ESCU implementation by Bhavin Patel and Patrick Bareiss] author: Xiao Lin, Splunk search: ' | from read_ssa_enriched_events() -| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "EventCode"), LogonType=map_get(input_event, "LogonType"), LogonProcess=map_get(input_event, "LogonProcess"), ComputerName=map_get(input_event, "ComputerName"), AccountName=map_get(input_event, "AccountName") +| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), LogonType=map_get(input_event, "logon_type"), LogonProcess=map_get(input_event, "logon_process"), ComputerName=map_get(input_event, "dest_ip_primary_artifact"), AccountName=map_get(input_event, "dest_user_primary_artifact") | where (LogonType="3" AND LogonProcess="NtLmSsp" AND AccountName IS NOT NULL) OR (LogonType="9" AND LogonProcess="seclogo") | first_time_event cache_partitions=1 input_columns="EventCode,LogonProcess,ComputerName" | where first_time_EventCode_LogonProcess_ComputerName diff --git a/notebooks/detect_kerberoasting__ssa.ipynb b/notebooks/detect_kerberoasting__ssa.ipynb index a3d20c72e2..1c905de653 100644 --- a/notebooks/detect_kerberoasting__ssa.ipynb +++ b/notebooks/detect_kerberoasting__ssa.ipynb @@ -13,18 +13,18 @@ "execution_count": 1, "metadata": { "execution": { - "iopub.execute_input": "2020-10-22T20:44:38.964037Z", - "iopub.status.busy": "2020-10-22T20:44:38.963628Z", - "iopub.status.idle": "2020-10-22T20:44:40.567454Z", - "shell.execute_reply": "2020-10-22T20:44:40.566775Z", - "shell.execute_reply.started": "2020-10-22T20:44:38.963999Z" + "iopub.execute_input": "2020-10-28T22:35:40.972663Z", + "iopub.status.busy": "2020-10-28T22:35:40.972286Z", + "iopub.status.idle": "2020-10-28T22:35:42.632374Z", + "shell.execute_reply": "2020-10-28T22:35:42.631440Z", + "shell.execute_reply.started": "2020-10-28T22:35:40.972629Z" } }, "outputs": [ { "data": { "application/vnd.jupyter.widget-view+json": { - "model_id": "702e0bb319bd4d7aa68aae0d02dc504c", + "model_id": "2ea98fa914f748d487beaf1b4b188a4d", "version_major": 2, "version_minor": 0 }, @@ -99,7 +99,7 @@ { "data": { "text/plain": [ - "" + "" ] }, "execution_count": 1, @@ -108,7 +108,9 @@ } ], "source": [ - "| from read_json(\"s3://smle-experiments/datasets/ssa/T1558.003.json\")\n", + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1558.003.json\")\n", + "| eval input_event=from_json_object(value)\n", + "| eval _time=map_get(input_event, \"_time\"), EventCode=map_get(input_event, \"event_code\"), TicketOptions=map_get(input_event, \"ticket_options\"), TicketEncryptionType=map_get(input_event, \"ticket_encryption_type\"), ServiceName=map_get(input_event, \"service_name\"), ServiceID=map_get(input_event, \"service_id\")\n", "| where EventCode=\"4769\" AND TicketOptions=\"0x40810000\" AND TicketEncryptionType=\"0x17\"\n", "| first_time_event cache_partitions=1 input_columns=\"EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID\"\n", "| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID\n", diff --git a/notebooks/detect_pass_hash__ssa.ipynb b/notebooks/detect_pass_hash__ssa.ipynb index 861cb1108a..e62bda7465 100644 --- a/notebooks/detect_pass_hash__ssa.ipynb +++ b/notebooks/detect_pass_hash__ssa.ipynb @@ -21,18 +21,18 @@ "execution_count": 1, "metadata": { "execution": { - "iopub.execute_input": "2020-10-22T20:41:47.358214Z", - "iopub.status.busy": "2020-10-22T20:41:47.357931Z", - "iopub.status.idle": "2020-10-22T20:41:48.842814Z", - "shell.execute_reply": "2020-10-22T20:41:48.842108Z", - "shell.execute_reply.started": "2020-10-22T20:41:47.358186Z" + "iopub.execute_input": "2020-10-28T22:35:49.966691Z", + "iopub.status.busy": "2020-10-28T22:35:49.966422Z", + "iopub.status.idle": "2020-10-28T22:35:51.544851Z", + "shell.execute_reply": "2020-10-28T22:35:51.543629Z", + "shell.execute_reply.started": "2020-10-28T22:35:49.966620Z" } }, "outputs": [ { "data": { "application/vnd.jupyter.widget-view+json": { - "model_id": "ed51709702334ed885ff69d0751cd6a5", + "model_id": "bc96630916c54e68bc29ac51a679c08e", "version_major": 2, "version_minor": 0 }, @@ -115,7 +115,7 @@ { "data": { "text/plain": [ - "" + "" ] }, "execution_count": 1, @@ -124,7 +124,9 @@ } ], "source": [ - "| from read_json(\"s3://smle-experiments/datasets/ssa/T1550.002.json\")\n", + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1550.002.json\")\n", + "| eval input_event=from_json_object(value)\n", + "| eval _time=map_get(input_event, \"_time\"), EventCode=map_get(input_event, \"event_code\"), LogonType=map_get(input_event, \"logon_type\"), LogonProcess=map_get(input_event, \"logon_process\"), ComputerName=map_get(input_event, \"dest_ip_primary_artifact\"), AccountName=map_get(input_event, \"dest_user_primary_artifact\")\n", "| where (LogonType=\"3\" AND LogonProcess=\"NtLmSsp\" AND AccountName IS NOT NULL) OR (LogonType=\"9\" AND LogonProcess=\"seclogo\")\n", "| first_time_event cache_partitions=1 input_columns=\"EventCode,LogonProcess,ComputerName\"\n", "| where first_time_EventCode_LogonProcess_ComputerName\n", @@ -132,6 +134,13 @@ "| select start_time, end_time, entities, body \n", ";" ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] } ], "metadata": { From 7d0ddb28e974eb5d19aceb939c3ef6417b43d128 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Thu, 5 Nov 2020 12:40:19 +0100 Subject: [PATCH 15/30] Reduce FP --- .../network/detect_ipv6_network_infrastructure_threats.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/detect_ipv6_network_infrastructure_threats.yml b/detections/network/detect_ipv6_network_infrastructure_threats.yml index dfb449f1bf..5f93ce7eb3 100644 --- a/detections/network/detect_ipv6_network_infrastructure_threats.yml +++ b/detections/network/detect_ipv6_network_infrastructure_threats.yml @@ -13,7 +13,7 @@ how_to_implement: This search uses a standard SPL query on logs from Cisco Netwo type: ESCU references: ['https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-ra-guard.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-snooping.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-dad-proxy.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-nd-mcast-supp.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-dhcpv6-guard.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-src-guard.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ipv6-dest-guard.html'] author: Mikael Bjerkeland, Splunk -search: '`cisco_networks` (facility="SISF") | eval src_interface=src_int_prefix_long+src_int_suffix +search: '`cisco_networks` facility="SISF" mnemonic IN ("IP_THEFT","MAC_THEFT","MAC_AND_IP_THEFT","PAK_DROP") | eval src_interface=src_int_prefix_long+src_int_suffix | eval dest_interface=dest_int_prefix_long+dest_int_suffix | stats min(_time) AS firstTime max(_time) AS lastTime values(src_mac) AS src_mac values(src_vlan) AS src_vlan values(mnemonic) AS mnemonic values(vendor_explanation) AS vendor_explanation values(src_ip) AS src_ip values(dest_ip) AS dest_ip From 640cadef7c75fa26d4509dc2443fa5f9fc6704a9 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Thu, 5 Nov 2020 16:59:13 +0000 Subject: [PATCH 16/30] use ssa as prefix --- ...etect_kerberoasting__ssa.yml => ssa__detect_kerberoasting.yml} | 0 .../{detect_pass_hash__ssa.yml => ssa__detect_pass_hash.yml} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename detections/endpoint/{detect_kerberoasting__ssa.yml => ssa__detect_kerberoasting.yml} (100%) rename detections/endpoint/{detect_pass_hash__ssa.yml => ssa__detect_pass_hash.yml} (100%) diff --git a/detections/endpoint/detect_kerberoasting__ssa.yml b/detections/endpoint/ssa__detect_kerberoasting.yml similarity index 100% rename from detections/endpoint/detect_kerberoasting__ssa.yml rename to detections/endpoint/ssa__detect_kerberoasting.yml diff --git a/detections/endpoint/detect_pass_hash__ssa.yml b/detections/endpoint/ssa__detect_pass_hash.yml similarity index 100% rename from detections/endpoint/detect_pass_hash__ssa.yml rename to detections/endpoint/ssa__detect_pass_hash.yml From 4f581f419d050b824b35846b448ca8732d810862 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Thu, 5 Nov 2020 17:01:20 +0000 Subject: [PATCH 17/30] add 3 underscore --- ...a__detect_kerberoasting.yml => ssa___detect_kerberoasting.yml} | 0 .../{ssa__detect_pass_hash.yml => ssa___detect_pass_hash.yml} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename detections/endpoint/{ssa__detect_kerberoasting.yml => ssa___detect_kerberoasting.yml} (100%) rename detections/endpoint/{ssa__detect_pass_hash.yml => ssa___detect_pass_hash.yml} (100%) diff --git a/detections/endpoint/ssa__detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml similarity index 100% rename from detections/endpoint/ssa__detect_kerberoasting.yml rename to detections/endpoint/ssa___detect_kerberoasting.yml diff --git a/detections/endpoint/ssa__detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml similarity index 100% rename from detections/endpoint/ssa__detect_pass_hash.yml rename to detections/endpoint/ssa___detect_pass_hash.yml From fa2ca47546a26906378c136ac6c359d585a18751 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Thu, 5 Nov 2020 17:03:54 +0000 Subject: [PATCH 18/30] test yml --- ...roasting__ssa.test.yml => ssa___detect_kerberoasting.test.yml} | 0 ...ct_pass_hash__ssa.test.yml => ssa___detect_pass_hash.test.yml} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename tests/endpoint/{detect_kerberoasting__ssa.test.yml => ssa___detect_kerberoasting.test.yml} (100%) rename tests/endpoint/{detect_pass_hash__ssa.test.yml => ssa___detect_pass_hash.test.yml} (100%) diff --git a/tests/endpoint/detect_kerberoasting__ssa.test.yml b/tests/endpoint/ssa___detect_kerberoasting.test.yml similarity index 100% rename from tests/endpoint/detect_kerberoasting__ssa.test.yml rename to tests/endpoint/ssa___detect_kerberoasting.test.yml diff --git a/tests/endpoint/detect_pass_hash__ssa.test.yml b/tests/endpoint/ssa___detect_pass_hash.test.yml similarity index 100% rename from tests/endpoint/detect_pass_hash__ssa.test.yml rename to tests/endpoint/ssa___detect_pass_hash.test.yml From 811ba865fa25d2abe7f643b8a2643121b5020ee6 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Thu, 5 Nov 2020 17:36:30 +0000 Subject: [PATCH 19/30] change test files to use ssa prefix --- tests/endpoint/ssa___detect_kerberoasting.test.yml | 2 +- tests/endpoint/ssa___detect_pass_hash.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/ssa___detect_kerberoasting.test.yml b/tests/endpoint/ssa___detect_kerberoasting.test.yml index 5e2c74bb38..2d4307a420 100644 --- a/tests/endpoint/ssa___detect_kerberoasting.test.yml +++ b/tests/endpoint/ssa___detect_kerberoasting.test.yml @@ -1,7 +1,7 @@ name: Detect Kerberoasting - SSA Unit test detections: - name: Detect kerberoasting - file: endpoint/detect_kerberoasting__ssa.yml + file: endpoint/ssa___detect_kerberoasting.yml pass_condition: '' description: Test detection of kerberoasting attack_data: diff --git a/tests/endpoint/ssa___detect_pass_hash.test.yml b/tests/endpoint/ssa___detect_pass_hash.test.yml index dc427027ce..a1c0d73384 100644 --- a/tests/endpoint/ssa___detect_pass_hash.test.yml +++ b/tests/endpoint/ssa___detect_pass_hash.test.yml @@ -1,7 +1,7 @@ name: Detect Pass the Hash - SSA Unit test detections: - name: Detect Pass the Hash - file: endpoint/detect_pass_hash__ssa.yml + file: endpoint/ssa___detect_pass_hash.yml pass_condition: '' description: Test detection of pass-the-hash attack_data: From ee80e0c09d537c74eadf9095efd5b1ea167b989c Mon Sep 17 00:00:00 2001 From: Ignacio Bermudez Corrales Date: Wed, 4 Nov 2020 15:16:04 -0800 Subject: [PATCH 20/30] added timeout --- bin/validate_ssa.py | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/bin/validate_ssa.py b/bin/validate_ssa.py index 4709b1d4f2..3ddc2af541 100644 --- a/bin/validate_ssa.py +++ b/bin/validate_ssa.py @@ -12,7 +12,7 @@ import json SSML_CWD = ".humvee" HUMVEE_ARTIFACT_SEARCH = "https://repo.splunk.com/artifactory/api/search/artifact?name=humvee&repos=maven-splunk-local" - +TEST_TIMEOUT = 600 logger = logging.getLogger(__name__) logger.setLevel(logging.INFO) @@ -101,7 +101,6 @@ def build_humvee(): urllib.request.urlretrieve(latest_humvee_object['downloadUri'], "%s/humvee.jar" % get_path(SSML_CWD)) - def activate_detection(detection, data, pass_condition): with open(detection, 'r') as fh: parsed_detection = yaml.safe_load(fh) @@ -146,12 +145,17 @@ def test_detection(test, args): spl2_fh.write(spl2) # Execute SPL2 log(logging.INFO, "Humvee test %s" % detection['name']) - subprocess.run(["/usr/bin/java", - "-jar", get_path("%s/humvee.jar" % SSML_CWD), - 'cli', - '-i', spl2_file, - '-o', test_out], - stderr=subprocess.DEVNULL) + try: + subprocess.run(["/usr/bin/java", + "-jar", get_path("%s/humvee.jar" % SSML_CWD), + 'cli', + '-i', spl2_file, + '-o', test_out], + stderr=subprocess.DEVNULL, + timeout=TEST_TIMEOUT) + except TimeoutError: + log(logging.ERROR, "%s test timeout" % detection['name']) + return False # Validate that it can run with open(test_status, "r") as test_status_fh: status = '\n'.join(test_status_fh.readlines()) From fb0398fafbfe444916e2cda63657343a9e6fd407 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Mon, 9 Nov 2020 10:12:52 +0100 Subject: [PATCH 21/30] Added test --- tests/network/T1557.002.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 tests/network/T1557.002.yml diff --git a/tests/network/T1557.002.yml b/tests/network/T1557.002.yml new file mode 100644 index 0000000000..1957b7f1b0 --- /dev/null +++ b/tests/network/T1557.002.yml @@ -0,0 +1,12 @@ +name: IPv6 Network Infrastructure Threats +detections: + - name: Detect IPv6 Network Infrastructure Threats + file: network/detect_ipv6_network_infrastructure_threats.yml + pass_condition: '| stats count | where count > 0' +description: Test IPv6 Network Infrastructure Threats detection +simulation_technique: 'T1557.002' +attack_data: + - file_name: cisco_ios.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1557.002/cisco_ios.log + source: udp:514 + sourcetype: cisco:ios From 4a29a71009687798b4da64404685be789e17105f Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Tue, 10 Nov 2020 09:30:50 +0100 Subject: [PATCH 22/30] Dashes in references --- .../detect_ipv6_network_infrastructure_threats.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/detections/network/detect_ipv6_network_infrastructure_threats.yml b/detections/network/detect_ipv6_network_infrastructure_threats.yml index 5f93ce7eb3..8c782d3cdd 100644 --- a/detections/network/detect_ipv6_network_infrastructure_threats.yml +++ b/detections/network/detect_ipv6_network_infrastructure_threats.yml @@ -11,7 +11,15 @@ how_to_implement: This search uses a standard SPL query on logs from Cisco Netwo (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices. type: ESCU -references: ['https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-ra-guard.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-snooping.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-dad-proxy.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-nd-mcast-supp.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-dhcpv6-guard.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-src-guard.html', 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ipv6-dest-guard.html'] +references: +- https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf +- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-ra-guard.html +- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-snooping.html +- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-dad-proxy.html +- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-nd-mcast-supp.html +- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-dhcpv6-guard.html +- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-src-guard.html +- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ipv6-dest-guard.html author: Mikael Bjerkeland, Splunk search: '`cisco_networks` facility="SISF" mnemonic IN ("IP_THEFT","MAC_THEFT","MAC_AND_IP_THEFT","PAK_DROP") | eval src_interface=src_int_prefix_long+src_int_suffix | eval dest_interface=dest_int_prefix_long+dest_int_suffix From 3675fa80ad229ebe03bd940e233c45a0c9d02a03 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Tue, 10 Nov 2020 09:37:33 +0100 Subject: [PATCH 23/30] Rename --- ...02.yml => detect_ipv6_network_infrastructure_threats.test.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/network/{T1557.002.yml => detect_ipv6_network_infrastructure_threats.test.yml} (100%) diff --git a/tests/network/T1557.002.yml b/tests/network/detect_ipv6_network_infrastructure_threats.test.yml similarity index 100% rename from tests/network/T1557.002.yml rename to tests/network/detect_ipv6_network_infrastructure_threats.test.yml From 077de7769a64f520396402dc7c4eda1888524337 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 12 Nov 2020 11:50:34 +0100 Subject: [PATCH 24/30] Update detect_ipv6_network_infrastructure_threats.yml --- .../network/detect_ipv6_network_infrastructure_threats.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/detect_ipv6_network_infrastructure_threats.yml b/detections/network/detect_ipv6_network_infrastructure_threats.yml index 8c782d3cdd..7429341313 100644 --- a/detections/network/detect_ipv6_network_infrastructure_threats.yml +++ b/detections/network/detect_ipv6_network_infrastructure_threats.yml @@ -27,7 +27,7 @@ search: '`cisco_networks` facility="SISF" mnemonic IN ("IP_THEFT","MAC_THEFT","M values(mnemonic) AS mnemonic values(vendor_explanation) AS vendor_explanation values(src_ip) AS src_ip values(dest_ip) AS dest_ip values(dest_interface) AS dest_interface values(action) AS action count BY host src_interface | table host src_interface dest_interface src_mac src_ip dest_ip src_vlan mnemonic vendor_explanation action count -| `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | +| `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `detect_ipv6_network_infrastructure_threats_filter`' known_false_positives: None currently known tags: From 3e1b445765acb174d9f97ec04eac4e7205f7ae1b Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 12 Nov 2020 11:58:04 +0100 Subject: [PATCH 25/30] Update detect_traffic_mirroring.yml --- detections/network/detect_traffic_mirroring.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/detect_traffic_mirroring.yml b/detections/network/detect_traffic_mirroring.yml index 42e100da1f..c35150a815 100644 --- a/detections/network/detect_traffic_mirroring.yml +++ b/detections/network/detect_traffic_mirroring.yml @@ -17,7 +17,7 @@ OR (facility="SPAN" mnemonic="SESSION_UP") OR (facility="SPAN" mnemonic="PKTCAP_START") OR (mnemonic="CFGLOG_LOGGEDCMD" command="monitor session*") | stats min(_time) AS firstTime max(_time) AS lastTime count - BY host + BY host facility mnemonic | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `detect_traffic_mirroring_filter`' known_false_positives: This search will return false positives for any legitimate traffic captures by network administrators. From 4d12fae7c0feff6ff0f6364a080aebd3c00520ad Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 12 Nov 2020 14:02:33 +0000 Subject: [PATCH 26/30] Bump urllib3 from 1.26.0 to 1.26.1 Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.0 to 1.26.1. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/master/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/1.26.0...1.26.1) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 6cf387b1f1..c58bc0fc21 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -65,7 +65,7 @@ splunk-sdk==1.6.14 tabulate==0.8.7 termcolor==1.1.0 toml==0.10.2 -urllib3==1.26.0 +urllib3==1.26.1 virtualenv==20.1.0 wcwidth==0.2.5 wget==3.2 diff --git a/requirements.txt b/requirements.txt index 3501c5e999..42c62db698 100644 --- a/requirements.txt +++ b/requirements.txt @@ -37,7 +37,7 @@ stix2-patterns==1.3.1 taxii2-client==2.2.2 toml==0.10.2 typing==3.7.4.3 -urllib3==1.26.0 +urllib3==1.26.1 virtualenv==20.1.0 zipp==3.4.0 coloredlogs==14.0 From 7ba9a7d3d4f042ff223e320eafa45c52bd8a3aaf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 12 Nov 2020 14:33:55 +0000 Subject: [PATCH 27/30] Bump boto3 from 1.16.15 to 1.16.16 Bumps [boto3](https://github.com/boto/boto3) from 1.16.15 to 1.16.16. - [Release notes](https://github.com/boto/boto3/releases) - [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/boto3/compare/1.16.15...1.16.16) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index c58bc0fc21..038e2623e2 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -8,7 +8,7 @@ attrs==20.3.0 bcrypt==3.2.0 botocore==1.19.15 certifi==2019.11.28 -boto3==1.16.15 +boto3==1.16.16 cffi==1.14.3 cfgv==2.0.1 chardet==3.0.4 From 908350584afab9586edeab50fa2ce173042f419f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 12 Nov 2020 15:01:28 +0000 Subject: [PATCH 28/30] Bump botocore from 1.19.15 to 1.19.16 Bumps [botocore](https://github.com/boto/botocore) from 1.19.15 to 1.19.16. - [Release notes](https://github.com/boto/botocore/releases) - [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/botocore/compare/1.19.15...1.19.16) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 038e2623e2..7d879860dc 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -6,7 +6,7 @@ atomicwrites==1.4.0 attackcti==0.3.3 attrs==20.3.0 bcrypt==3.2.0 -botocore==1.19.15 +botocore==1.19.16 certifi==2019.11.28 boto3==1.16.16 cffi==1.14.3 From 2c36edb66f6ba3abe4b2e34a25c938b171e8c9a8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 12 Nov 2020 15:18:24 +0000 Subject: [PATCH 29/30] Bump requests from 2.24.0 to 2.25.0 Bumps [requests](https://github.com/psf/requests) from 2.24.0 to 2.25.0. - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/master/HISTORY.md) - [Commits](https://github.com/psf/requests/compare/v2.24.0...v2.25.0) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 7d879860dc..d111301c41 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -56,7 +56,7 @@ python-dateutil==2.8.1 python-terraform==0.10.1 pywinrm==0.4.1 PyYAML==5.3.1 -requests==2.22.0 +requests==2.25.0 requests-ntlm==1.1.0 s3transfer==0.3.3 six==1.13.0 diff --git a/requirements.txt b/requirements.txt index 42c62db698..c8925249e6 100644 --- a/requirements.txt +++ b/requirements.txt @@ -26,7 +26,7 @@ pyrsistent==0.17.3 python-dateutil==2.8.1 pytz==2020.4 PyYAML==5.3.1 -requests==2.24.0 +requests==2.25.0 scandir==1.10.0 semantic-version==2.8.5 simplejson==3.17.2 From c79a1b06c6ee4ea211ee89fddd3a373a15c1f33a Mon Sep 17 00:00:00 2001 From: Ignacio Bermudez Corrales Date: Thu, 12 Nov 2020 11:29:47 -0800 Subject: [PATCH 30/30] Dowloads Humvee fat jar only if local checksum doesnt match repository latest --- bin/validate_ssa.py | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/bin/validate_ssa.py b/bin/validate_ssa.py index 9e6594d1d8..289297045b 100644 --- a/bin/validate_ssa.py +++ b/bin/validate_ssa.py @@ -9,6 +9,7 @@ import sys import coloredlogs import logging import json +import hashlib SSML_CWD = ".humvee" HUMVEE_ARTIFACT_SEARCH = "https://repo.splunk.com/artifactory/api/search/artifact?name=humvee&repos=maven-splunk-local" @@ -98,9 +99,18 @@ def build_humvee(): if not os.path.exists(get_path(SSML_CWD)): os.mkdir(get_path(SSML_CWD)) latest_humvee_object = get_latest_humvee_object() - log(logging.INFO, "Downloading Latest Humvee") - log(logging.DEBUG, "Humvee details", detail=latest_humvee_object) - urllib.request.urlretrieve(latest_humvee_object['downloadUri'], "%s/humvee.jar" % get_path(SSML_CWD)) + humvee_path = "%s/humvee.jar" % get_path(SSML_CWD) + humvee_md5 = "" + if os.path.exists(humvee_path): + with open(humvee_path, 'rb') as jar_fh: + humvee_md5 = hashlib.md5(jar_fh.read()).hexdigest() + log(logging.DEBUG, "Current local checksum of Humvee", detail=humvee_md5) + if humvee_md5 != latest_humvee_object['checksums']['md5']: + log(logging.INFO, "Downloading Latest Humvee") + log(logging.DEBUG, "Humvee details", detail=latest_humvee_object) + urllib.request.urlretrieve(latest_humvee_object['downloadUri'], humvee_path) + else: + log(logging.DEBUG, "Already latest checksum %s" % humvee_md5, detail=latest_humvee_object) def activate_detection(detection, data, pass_condition):