diff --git a/investigations/all_backup_logs_for_host.yml b/investigations/all_backup_logs_for_host.yml deleted file mode 100644 index bce094b0ca..0000000000 --- a/investigations/all_backup_logs_for_host.yml +++ /dev/null @@ -1,23 +0,0 @@ -name: All backup logs for host -id: bc91a8cf-aaaa-4bb2-8140-e756cc06fd72 -version: 1 -date: '2017-09-12' -author: Rico Valdez, Splunk -type: Investigation -datamodel: [] -description: Retrieve the backup logs for the last 2 weeks for a specific host in - order to investigate why backups are not completing successfully. -search: '| search `netbackup` dest=$dest$' -how_to_implement: The successfully implement this search you must first send your - backup logs to Splunk. -known_false_positives: none -references: [] -tags: - analytic_story: - - Monitor Backup Solution - product: - - Splunk Phantom - required_fields: - - _time - - dest - security_domain: endpoint diff --git a/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml b/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml deleted file mode 100644 index 954ae79109..0000000000 --- a/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: Amazon EKS Kubernetes activity by src ip -id: a636cca4-7434-4a15-a278-c70734938e39 -version: 1 -date: '2020-04-13' -author: Rod Soto, Splunk -type: Investigation -datamodel: [] -description: This search provides investigation data about requests via user agent, - authentication request URI, verb and cluster name data against Kubernetes cluster - from a specific IP address -search: '`aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ - | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) - values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision - src_ip' -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch - EKS inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Kubernetes Scanning Activity - product: - - Splunk Phantom - required_fields: - - _time - - sourceIPs{} - - user.username - - requestURI - - verb - - userAgent - - annotations.authorization.k8s.io/decision - security_domain: network diff --git a/investigations/aws_investigate_security_hub_alerts_by_dest.yml b/investigations/aws_investigate_security_hub_alerts_by_dest.yml deleted file mode 100644 index 131f98115d..0000000000 --- a/investigations/aws_investigate_security_hub_alerts_by_dest.yml +++ /dev/null @@ -1,39 +0,0 @@ -name: AWS Investigate Security Hub alerts by dest -id: b0d2e6a8-75fa-4b1b-9486-3d32acadf822 -version: 1 -date: '2020-06-08' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search retrieves the all the alerts created by AWS Security Hub - for a specific dest(instance_id). -search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | - rex field=findings{}.Resources{}.Id .*instance/(?.*)| rename instance - as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text - as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState - Remediation' -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Cloud Compute Instance - - Cloud Cryptomining - - Suspicious AWS EC2 Activities - - AWS Suspicious Provisioning Activities - product: - - Splunk Phantom - required_fields: - - _time - - findings{}.Resources{}.Type - - findings{}.Resources{}.Id - - instance - - Remediation.Recommendation.Text - - Title - - ProductArn - - Description - - FirstObservedAt - - RecordState - security_domain: network diff --git a/investigations/aws_investigate_user_activities_by_accesskeyid.yml b/investigations/aws_investigate_user_activities_by_accesskeyid.yml deleted file mode 100644 index f9a45e8f8e..0000000000 --- a/investigations/aws_investigate_user_activities_by_accesskeyid.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: AWS Investigate User Activities By AccessKeyId -id: 703b65a4-a0ae-4171-965d-45507506c64f -version: 1 -date: '2018-06-08' -author: David Dorsey, Splunk -type: Investigation -datamodel: [] -description: This search retrieves the times, ARN, source IPs, AWS regions, event - names, and the result of the event for specific credentials. -search: '`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ - | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | - table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage' -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Cross Account Activity - product: - - Splunk Phantom - - Splunk Security Analytics for AWS - required_fields: - - _time - - userIdentity.accessKeyId - - userIdentity.arn - - sourceIPAddress - - awsRegion - - eventName - - errorCode - - errorMessage - security_domain: network diff --git a/investigations/aws_investigate_user_activities_by_arn.yml b/investigations/aws_investigate_user_activities_by_arn.yml deleted file mode 100644 index 4892079b1f..0000000000 --- a/investigations/aws_investigate_user_activities_by_arn.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: AWS Investigate User Activities By ARN -id: bc91a8cd-35e7-4bb2-6140-e756cc46fd72 -version: 2 -date: '2019-04-30' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search lists all the logged CloudTrail activities by a specific - user ARN and will create a table containing the source of the user, the region of - the activity, the name and type of the event, the action taken, and all the user's - identity information. -search: '`cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName - userIdentity.arn aws_account_id src awsRegion eventName eventType' -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Cryptomining - - AWS Network ACL Activity - - Cloud Cryptomining - - Command and Control - - Suspicious AWS EC2 Activities - - Suspicious AWS Login Activities - - Suspicious AWS S3 Activities - - Suspicious AWS Traffic - - Unusual AWS EC2 Modifications - - Suspicious Cloud User Activities - - AWS Suspicious Provisioning Activities - - Suspicious Cloud Instance Activities - - AWS Security Hub Alerts - product: - - Splunk Phantom - required_fields: - - _time - - user - - userIdentity.type - - userIdentity.userName - - userIdentity.arn - - aws_account_id - - src - - awsRegion - - eventName - - eventType - security_domain: network diff --git a/investigations/aws_network_acl_details_from_id.yml b/investigations/aws_network_acl_details_from_id.yml deleted file mode 100644 index 1a0793b2c4..0000000000 --- a/investigations/aws_network_acl_details_from_id.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: AWS Network ACL Details from ID -id: 2e11293f-c795-41bd-b470-fc87adc4e196 -version: 1 -date: '2017-01-22' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search queries AWS description logs and returns all the information - about a specific network ACL via network ACL ID -search: '`aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ - | table id account_id vpc_id network_acl_entries{}.*' -how_to_implement: In order to implement this search, you must install the AWS App - for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) - and configure your AWS description inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Network ACL Activity - - Command and Control - - Suspicious AWS Traffic - product: - - Splunk Phantom - required_fields: - - _time - - id - - account_id - - vpc_id - - network_acl_entries{}.* - security_domain: network diff --git a/investigations/aws_network_interface_details_via_resourceid.yml b/investigations/aws_network_interface_details_via_resourceid.yml deleted file mode 100644 index 98fcaf73cb..0000000000 --- a/investigations/aws_network_interface_details_via_resourceid.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: AWS Network Interface details via resourceId -id: c55b0a17-8fca-4315-81e3-65ceaa176441 -version: 1 -date: '2018-05-07' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search queries AWS configuration logs and returns the information - about a specific network interface via network interface ID. The information will - include the ARN of the network interface, its relationships with other AWS resources, - the public and the private IP associated with the network interface. -search: '`aws_config` resourceId=$resourceId$ | table _time ARN relationships{}.resourceType - relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress - configuration.privateIpAddresses{}.association.publicIp' -how_to_implement: In order to implement this search, you must install the AWS App - for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) - and configure your AWS configuration inputs -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Network ACL Activity - - Command and Control - - Suspicious AWS Traffic - product: - - Splunk Phantom - required_fields: - - _time - - resourceId - - ARN - - relationships{}.resourceType - - relationships{}.name - - relationships{}.resourceId - - configuration.privateIpAddresses{}.privateIpAddress - - configuration.privateIpAddresses{}.association.publicIp - security_domain: network diff --git a/investigations/aws_s3_bucket_details_via_bucketname.yml b/investigations/aws_s3_bucket_details_via_bucketname.yml deleted file mode 100644 index c292a77254..0000000000 --- a/investigations/aws_s3_bucket_details_via_bucketname.yml +++ /dev/null @@ -1,34 +0,0 @@ -name: AWS S3 Bucket details via bucketName -id: 2762d4ed-9266-465e-b966-1c10dc8d91f3 -version: 1 -date: '2018-06-26' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search queries AWS configuration logs and returns the information - about a specific S3 bucket. The information returned includes the time the S3 bucket - was created, the resource ID, the region it belongs to, the value of action performed, - AWS account ID, and configuration values of the access-control lists associated - with the bucket. -search: '`aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ - | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList' -how_to_implement: To implement this search, you must install the AWS App for Splunk - (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later) and - configure your AWS inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Suspicious AWS S3 Activities - product: - - Splunk Phantom - required_fields: - - _time - - resourceId - - bucketName - - resourceCreationTime - - vendor_region - - action - - aws_account_id - - supplementaryConfiguration.AccessControlList - security_domain: network diff --git a/investigations/gcp_kubernetes_activity_by_src_ip.yml b/investigations/gcp_kubernetes_activity_by_src_ip.yml deleted file mode 100644 index cf1f33d2ef..0000000000 --- a/investigations/gcp_kubernetes_activity_by_src_ip.yml +++ /dev/null @@ -1,39 +0,0 @@ -name: GCP Kubernetes activity by src ip -id: c00e7626-92cc-4e06-9a51-b6db0a50bd1f -version: 1 -date: '2020-04-13' -author: Rod Soto, Splunk -type: Investigation -datamodel: [] -description: This search provides investigation data about requests via user agent, - authentication request URI, resource path and cluster name data against Kubernetes - cluster from a specific IP address -search: '`google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata.callerIp - as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time) - as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) - as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) - as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as - user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name - data.resource.type' -how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later), - then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. - You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection - to filter out FPs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Kubernetes Scanning Activity - product: - - Splunk Phantom - required_fields: - - _time - - data.protoPayload.requestMetadata.callerIp - - data.protoPayload.methodName - - data.protoPayload.resourceName - - data.protoPayload.requestMetadata.callerSuppliedUserAgent - - data.protoPayload.authenticationInfo.principalEmail - - data.protoPayload.status.message - - data.resource.labels.cluster_name - - data.resource.type - security_domain: network diff --git a/investigations/get_all_aws_activity_from_city.yml b/investigations/get_all_aws_activity_from_city.yml deleted file mode 100644 index d37d913fd1..0000000000 --- a/investigations/get_all_aws_activity_from_city.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: Get All AWS Activity From City -id: 0abeeb40-1255-4b68-91d1-7a7eb410c4b8 -version: 1 -date: '2018-03-19' -author: David Dorsey, Splunk -type: Investigation -datamodel: [] -description: This search retrieves all the activity from a specific city and will - create a table containing the time, city, ARN, username, the type of user, the source - IP address, the AWS region the activity was in, the API called, and whether or not - the API call was successful. -search: '`cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user - path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath - output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table - _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode' -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Suspicious Provisioning Activities - product: - - Splunk Phantom - required_fields: - - _time - - sourceIPAddress - - userIdentity.arn - - userIdentity.userName - - userIdentity.type - - awsRegion - - eventName - - errorCode - security_domain: network diff --git a/investigations/get_all_aws_activity_from_country.yml b/investigations/get_all_aws_activity_from_country.yml deleted file mode 100644 index 588de58c1a..0000000000 --- a/investigations/get_all_aws_activity_from_country.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: Get All AWS Activity From Country -id: e763cdb9-00da-41e0-9bda-444debc9501a -version: 1 -date: '2018-03-19' -author: David Dorsey, Splunk -type: Investigation -datamodel: [] -description: This search retrieves all the activity from a specific country and will - create a table containing the time, country, ARN, username, the type of user, the - source IP address, the AWS region the activity was in, the API called, and whether - or not the API call was successful. -search: '`cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath - output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName - | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip - | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, - errorCode' -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Suspicious Provisioning Activities - product: - - Splunk Phantom - required_fields: - - _time - - sourceIPAddress - - userIdentity.arn - - userIdentity.userName - - userIdentity.type - - awsRegion - - eventName - - errorCode - security_domain: network diff --git a/investigations/get_all_aws_activity_from_ip_address.yml b/investigations/get_all_aws_activity_from_ip_address.yml deleted file mode 100644 index b52ab44b79..0000000000 --- a/investigations/get_all_aws_activity_from_ip_address.yml +++ /dev/null @@ -1,40 +0,0 @@ -name: Get All AWS Activity From IP Address -id: 446ec87a-85c6-40d4-b060-bea4498281d6 -version: 1 -date: '2018-03-19' -author: David Dorsey, Splunk -type: Investigation -datamodel: [] -description: This search retrieves all the activity from a specific IP address and - will create a table containing the time, ARN, username, the type of user, the IP - address, the AWS region the activity was in, the API called, and whether or not - the API call was successful. -search: '`cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath - output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName - | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip - | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode' -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Network ACL Activity - - AWS Suspicious Provisioning Activities - - Command and Control - - Suspicious AWS S3 Activities - - Suspicious AWS Traffic - - Suspicious Cloud Instance Activities - product: - - Splunk Phantom - required_fields: - - _time - - sourceIPAddress - - userIdentity.arn - - userIdentity.userName - - userIdentity.type - - awsRegion - - eventName - - errorCode - security_domain: network diff --git a/investigations/get_all_aws_activity_from_region.yml b/investigations/get_all_aws_activity_from_region.yml deleted file mode 100644 index 476f3008db..0000000000 --- a/investigations/get_all_aws_activity_from_region.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: Get All AWS Activity From Region -id: 5b794bef-1743-4f6f-804a-43915a2702ff -version: 1 -date: '2018-03-19' -author: David Dorsey, Splunk -type: Investigation -datamodel: [] -description: This search retrieves all the activity from a specific geographic region - and will create a table containing the time, geographic region, ARN, username, the - type of user, the source IP address, the AWS region the activity was in, the API - called, and whether or not the API call was successful. -search: '`cloudtrail` | iplocation sourceIPAddress | search Region=$Region$ | spath - output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName - | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip - | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode' -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Suspicious Provisioning Activities - product: - - Splunk Phantom - required_fields: - - _time - - sourceIPAddress - - userIdentity.arn - - userIdentity.userName - - userIdentity.type - - awsRegion - - eventName - - errorCode - security_domain: network diff --git a/investigations/get_backup_logs_for_endpoint.yml b/investigations/get_backup_logs_for_endpoint.yml deleted file mode 100644 index a381ddc275..0000000000 --- a/investigations/get_backup_logs_for_endpoint.yml +++ /dev/null @@ -1,25 +0,0 @@ -name: Get Backup Logs For Endpoint -id: fdcfb369-1725-4c24-824a-22972d7f0d44 -version: 1 -date: '2017-09-14' -author: David Dorsey, Splunk -type: Investigation -datamodel: [] -description: This search will tell you the backup status from your netbackup_logs - of a specific endpoint for the last week. -search: '`netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as - signature | table _time, dest, signature' -how_to_implement: You must be ingesting your backup logs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Ransomware - - SamSam Ransomware - product: - - Splunk Phantom - required_fields: - - _time - - COMPUTERNAME - - MESSAGE - security_domain: endpoint diff --git a/investigations/get_certificate_logs_for_a_domain.yml b/investigations/get_certificate_logs_for_a_domain.yml deleted file mode 100644 index d6c37bddf6..0000000000 --- a/investigations/get_certificate_logs_for_a_domain.yml +++ /dev/null @@ -1,34 +0,0 @@ -name: Get Certificate logs for a domain -id: bc91a8cf-35e7-4bb2-2240-e756cc06fd73 -version: 2 -date: '2019-04-29' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search queries the Certificates datamodel and give you all the information - for a specific domain. Please note that the certificates issued by "Let's Encrypt" - are widely used by attackers. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by - All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name - All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` - | `drop_dm_object_name(SSL)` | rename ssl_subject_common_name as domain | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' -how_to_implement: You must be ingesting your certificates or SSL logs from your network - traffic into your Certificates datamodel. Please note the wildcard(*) before domain - in the search syntax, we use to match for all domain and subdomain combinations -known_false_positives: '' -references: [] -tags: - analytic_story: - - Common Phishing Frameworks - product: - - Splunk Phantom - required_fields: - - _time - - All_Certificates.SSL.ssl_subject_common_name - - All_Certificates.dest - - All_Certificates.src - - All_Certificates.SSL.ssl_issuer_common_name - - All_Certificates.SSL.ssl_hash - security_domain: network diff --git a/investigations/get_dns_server_history_for_a_host.yml b/investigations/get_dns_server_history_for_a_host.yml deleted file mode 100644 index 68021e5d29..0000000000 --- a/investigations/get_dns_server_history_for_a_host.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: Get DNS Server History for a host -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd72 -version: 1 -date: '2017-11-09' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: While investigating any detections it is important to understand which - and how many DNS servers a host has connected to in the past. This search uses data - that is tagged as DNS and gives you a count and list of DNS servers that a particular - host has connected to the previous 24 hours. -search: '| search tag=dns src_ip=$src_ip$ dest_port=53 | streamstats time_window=1d - count values(dest_ip) as dcip by src_ip | table date_mday src_ip dcip count | sort - -count' -how_to_implement: To successfully implement this search, you must be ingesting your - DNS traffic -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Network ACL Activity - - Command and Control - - DNS Hijacking - - Data Protection - - Dynamic DNS - - Hidden Cobra Malware - - Host Redirection - - Prohibited Traffic Allowed or Protocol Mismatch - - Suspicious AWS Traffic - - Suspicious DNS Traffic - product: - - Splunk Phantom - required_fields: - - _time - - src_ip - - dest_port - - dest_ip - security_domain: network diff --git a/investigations/get_dns_traffic_ratio.yml b/investigations/get_dns_traffic_ratio.yml deleted file mode 100644 index 54eaaaa7bf..0000000000 --- a/investigations/get_dns_traffic_ratio.yml +++ /dev/null @@ -1,40 +0,0 @@ -name: Get DNS traffic ratio -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73 -version: 1 -date: '2017-11-09' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: -- Network_Traffic -description: 'This search calculates the ratio of DNS traffic originating and coming - from a host to a list of DNS servers over the last 24 hours. A high value of this - ratio could be very useful to quickly understand if a src_ip (host) is sending a - high volume of data out via port 53, could be an indicator of data exfiltration - via DNS. ' -search: '| tstats allow_old_summaries=true sum(All_Traffic.bytes_out) as "bytes_out" - sum(All_Traffic.bytes_in) as "bytes_in" from datamodel=Network_Traffic where nodename=All_Traffic - All_Traffic.dest_port=53 by All_Traffic.src All_Traffic.dest| `drop_dm_object_name(All_Traffic)` - | rename src as src_ip | rename dest as dest_ip | search src_ip=$src_ip$ | search - dest_ip = $dest_ip | eval ratio = (bytes_out/bytes_in) | table ratio' -how_to_implement: You must be ingesting your network traffic -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Network ACL Activity - - Command and Control - - Data Protection - - Dynamic DNS - - Hidden Cobra Malware - - Suspicious AWS Traffic - - Suspicious DNS Traffic - product: - - Splunk Phantom - required_fields: - - _time - - All_Traffic.bytes_out - - All_Traffic.bytes_in - - All_Traffic.dest_port - - All_Traffic.src - - All_Traffic.dest - security_domain: network diff --git a/investigations/get_ec2_instance_details_by_instanceid.yml b/investigations/get_ec2_instance_details_by_instanceid.yml deleted file mode 100644 index 60aa981fa8..0000000000 --- a/investigations/get_ec2_instance_details_by_instanceid.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: Get EC2 Instance Details by instanceId -id: de4aed1d-f13a-4d2f-a97a-73c60e2e6b56 -version: 1 -date: '2018-02-12' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search queries AWS description logs and returns all the information - about a specific instance via the instanceId field -search: '`aws_description` | dedup id sortby -_time |rename id as instanceId| search - instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," - = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table - id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, - state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, - instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time - as "Launch Time", placement as "Availability Zone", state as State, subnet_id as - Subnet, "tags.Name" as Name, vpc_id as VPC' -how_to_implement: In order to implement this search, you must install the AWS App - for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) - and configure your AWS description inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Cryptomining - - Cloud Cryptomining - - Suspicious AWS EC2 Activities - - Unusual AWS EC2 Modifications - - AWS Security Hub Alerts - product: - - Splunk Phantom - required_fields: - - _time - - id - - ip_address - - tags - - aws_account_id - - placement - - instance_type - - key_name - - launch_time - - state - - vpc_id - - subnet_id - security_domain: network diff --git a/investigations/get_ec2_launch_details.yml b/investigations/get_ec2_launch_details.yml deleted file mode 100644 index b5092ffd05..0000000000 --- a/investigations/get_ec2_launch_details.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: Get EC2 Launch Details -id: 0e40fe83-3edb-4d86-8206-8fed36529ca6 -version: 1 -date: '2018-03-12' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search returns some of the launch details for a EC2 instance. -search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId - as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, - responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture - as architecture, responseElements.instancesSet.items{}.keyName as keyName | table - arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName' -how_to_implement: In order to implement this search, you must install the AWS App - for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) - and configure your AWS description inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Cryptomining - - Cloud Cryptomining - - Suspicious AWS EC2 Activities - - AWS Security Hub Alerts - product: - - Splunk Phantom - required_fields: - - _time - - dest - - userIdentity.arn - - responseElements.instancesSet.items{}.instanceId - - responseElements.instancesSet.items{}.privateIpAddress - - responseElements.instancesSet.items{}.imageId - - responseElements.instancesSet.items{}.architecture - - responseElements.instancesSet.items{}.keyName - security_domain: network diff --git a/investigations/get_email_info.yml b/investigations/get_email_info.yml deleted file mode 100644 index 322bead4ff..0000000000 --- a/investigations/get_email_info.yml +++ /dev/null @@ -1,24 +0,0 @@ -name: Get Email Info -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd75 -version: 1 -date: '2017-11-09' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search returns all the information Splunk might have collected a - specific email message over the last 2 hours. -search: '| from datamodel Email.All_Email | search message_id=$message_id$' -how_to_implement: To successfully implement this search you must be ingesting your - email logs or capturing unencrypted network traffic which contains email communications. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Brand Monitoring - - Suspicious Emails - product: - - Splunk Phantom - required_fields: - - _time - - message - security_domain: network diff --git a/investigations/get_emails_from_specific_sender.yml b/investigations/get_emails_from_specific_sender.yml deleted file mode 100644 index 2eabcd7819..0000000000 --- a/investigations/get_emails_from_specific_sender.yml +++ /dev/null @@ -1,26 +0,0 @@ -name: Get Emails From Specific Sender -id: 5df39b3f-447d-4869-b673-8f45ad4616fe -version: 1 -date: '2017-11-09' -author: David Dorsey, Splunk -type: Investigation -datamodel: [] -description: This search returns all the emails from a specific sender over the last - 24 and next hours. -search: '| from datamodel Email.All_Email | search src_user=$src_user$' -how_to_implement: To successfully implement this search you must ingest your email - logs or capture unencrypted email communications within network traffic, and populate - the Email data model. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Brand Monitoring - - Suspicious Emails - - Web Fraud Detection - product: - - Splunk Phantom - required_fields: - - _time - - src_user - security_domain: networks diff --git a/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml b/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml deleted file mode 100644 index 52285d92ac..0000000000 --- a/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: Get First Occurrence and Last Occurrence of a MAC Address -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd33 -version: 1 -date: '2017-09-13' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: -- Network_Sessions -description: This search allows you to gather more context around a notable which - has detected a new device connecting to your network. Use this search to determine - the first and last occurrences of the suspicious device attempting to connect with - your network. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST - All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)`' -how_to_implement: To successfully implement this search, you must be ingesting the - logs from your DHCP server. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Asset Tracking - product: - - Splunk Phantom - required_fields: - - _time - - All_Sessions.DHCP - - All_Sessions.signature - - All_Sessions.src_mac - - All_Sessions.src_ip - - All_Sessions.user - security_domain: network diff --git a/investigations/get_history_of_email_sources.yml b/investigations/get_history_of_email_sources.yml deleted file mode 100644 index 9c1f92b44a..0000000000 --- a/investigations/get_history_of_email_sources.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: Get History Of Email Sources -id: ddc7af28-c34d-4392-af93-7f29a4e8806c -version: 1 -date: '2019-02-21' -author: Rico Valdez, Splunk -type: Investigation -datamodel: -- Email -description: This search returns a list of all email sources seen in the 48 hours - prior to the notable event to 24 hours after, and the number of emails from each - source. -search: '|tstats `security_content_summariesonly` values(All_Email.dest) as dest values(All_Email.recipient) - as recepient min(_time) as firstTime max(_time) as lastTime count from datamodel=Email.All_Email - by All_Email.src |`drop_dm_object_name(All_Email)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | search src=$src$' -how_to_implement: To successfully implement this search you must ingest your email - logs or capture unencrypted email communications within network traffic, and populate - the Email data model. -known_false_positives: '' -references: [] -tags: - analytic_story: - - 'Emotet Malware DHS Report TA18-201A ' - - Hidden Cobra Malware - - Lateral Movement - - Malicious PowerShell - - Orangeworm Attack Group - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - Ransomware - - SamSam Ransomware - product: - - Splunk Phantom - required_fields: - - _time - - All_Email.dest - - All_Email.recipient - - All_Email.src - security_domain: network diff --git a/investigations/get_logon_rights_modifications_for_endpoint.yml b/investigations/get_logon_rights_modifications_for_endpoint.yml deleted file mode 100644 index 31f0e153f6..0000000000 --- a/investigations/get_logon_rights_modifications_for_endpoint.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: Get Logon Rights Modifications For Endpoint -id: 03bffe94-ec7a-4cbe-b677-6af40d1c4505 -version: 2 -date: '2017-09-12' -author: David Dorsey, Splunk -type: Investigation -datamodel: [] -description: This search allows you to retrieve any modifications to logon rights - associated with a specific host. -search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$ - | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, - signature' -how_to_implement: To successfully implement this search you must be ingesting your - Windows event logs -known_false_positives: '' -references: [] -tags: - analytic_story: - - Account Monitoring and Controls - product: - - Splunk Phantom - required_fields: - - _time - - signature_id - - dest - - user - security_domain: endpoint diff --git a/investigations/get_logon_rights_modifications_for_user.yml b/investigations/get_logon_rights_modifications_for_user.yml deleted file mode 100644 index fb21d50d2e..0000000000 --- a/investigations/get_logon_rights_modifications_for_user.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: Get Logon Rights Modifications For User -id: 552bc86c-f72c-4d44-b3f2-06ede13af7bb -version: 2 -date: '2019-02-27' -author: David Dorsey, Splunk -type: Investigation -datamodel: [] -description: This search allows you to retrieve any modifications to logon rights - for a specific user account. -search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$ - | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, - signature' -how_to_implement: To successfully implement this search you must be ingesting your - Windows event logs -known_false_positives: '' -references: [] -tags: - analytic_story: - - Account Monitoring and Controls - product: - - Splunk Phantom - required_fields: - - _time - - signature_id - - dest - - user - security_domain: endpoint diff --git a/investigations/get_notable_history.yml b/investigations/get_notable_history.yml deleted file mode 100644 index 0972806b8a..0000000000 --- a/investigations/get_notable_history.yml +++ /dev/null @@ -1,92 +0,0 @@ -name: Get Notable History -id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 -version: 2 -date: '2017-09-20' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search queries the notable index and returns all the Notable Events - for the particular destination host, giving the analyst an overview of the incidents - that may have occurred with the host under investigation. -search: '| search `notable` | search dest=$dest$ | table _time, dest, rule_name, owner, - priority, severity, status_description' -how_to_implement: If you are using Enterprise Security you are likely already creating - notable events with your correlation rules. No additional configuration is necessary. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Cross Account Activity - - AWS Cryptomining - - AWS Network ACL Activity - - AWS User Monitoring - - Account Monitoring and Controls - - Apache Struts Vulnerability - - Asset Tracking - - Brand Monitoring - - Cloud Cryptomining - - ColdRoot MacOS RAT - - Collection and Staging - - Command and Control - - DHS Report TA18-074A - - DNS Amplification Attacks - - Data Protection - - Disabling Security Tools - - Dynamic DNS - - 'Emotet Malware DHS Report TA18-201A ' - - Hidden Cobra Malware - - Host Redirection - - JBoss Vulnerability - - Kubernetes Scanning Activity - - Lateral Movement - - Malicious PowerShell - - Monitor Backup Solution - - Monitor for Unauthorized Software - - Monitor for Updates - - Netsh Abuse - - Orangeworm Attack Group - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - Prohibited Traffic Allowed or Protocol Mismatch - - Ransomware - - Router and Infrastructure Security - - SQL Injection - - SamSam Ransomware - - Spectre And Meltdown Vulnerabilities - - Splunk Enterprise Vulnerability - - Splunk Enterprise Vulnerability CVE-2018-11409 - - Suspicious AWS EC2 Activities - - Suspicious AWS S3 Activities - - Suspicious AWS Traffic - - Suspicious Cloud Authentication Activities - - Suspicious Command-Line Executions - - Suspicious DNS Traffic - - Suspicious Emails - - Suspicious MSHTA Activity - - Suspicious WMI Use - - Suspicious Windows Registry Activities - - Unusual AWS EC2 Modifications - - Unusual Processes - - Use of Cleartext Protocols - - Web Fraud Detection - - Windows Defense Evasion Tactics - - Windows File Extension and Association Abuse - - Windows Log Manipulation - - Windows Persistence Techniques - - Windows Privilege Escalation - - Windows Service Abuse - - Data Exfiltration - - F5 TMUI RCE CVE-2020-5902 - - Detect Zerologon Attack - - GCP Cross Account Activity - - Kubernetes Sensitive Object Access Activity - - Kubernetes Sensitive Role Activity - - Ransomware Cloud - - Ryuk Ransomware - - Suspicious Cloud Provisioning Activities - - Suspicious GCP Storage Activities - - Windows DNS SIGRed CVE-2020-1350 - product: - - Splunk Phantom - required_fields: - - _time - security_domain: endpoint diff --git a/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml b/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml deleted file mode 100644 index ee1a69683d..0000000000 --- a/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml +++ /dev/null @@ -1,32 +0,0 @@ -name: Get Outbound Emails to Hidden Cobra Threat Actors -id: 80bac352-e089-46b9-a6a4-8a8467d4d8cf -version: 1 -date: '2018-06-14' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: -- Email -description: 'This search returns the information of the users that sent emails to - the accounts controlled by the Hidden Cobra Threat Actors: specifically to `misswang8107@gmail.com`, - and from `redhat@gmail.com`.' -search: '| from datamodel Email.All_Email | search recipient=misswang8107@gmail.com - OR src_user=redhat@gmail.com | stats count earliest(_time) as firstTime, latest(_time) - as lastTime values(dest) values(src) by src_user recipient | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' -how_to_implement: To successfully implement this search you must ingest your email - logs or capture unencrypted email communications within network traffic, and populate - the Email data model. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Hidden Cobra Malware - product: - - Splunk Phantom - required_fields: - - _time - - recipient - - src_user - - dest - - sec - security_domain: network diff --git a/investigations/get_parent_process_info.yml b/investigations/get_parent_process_info.yml deleted file mode 100644 index f8226abb02..0000000000 --- a/investigations/get_parent_process_info.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Get Parent Process Info -id: fecf2918-670d-4f1c-872b-3d7317a41bf9 -version: 2 -date: '2019-02-28' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: -- Endpoint -description: This search queries the Endpoint data model to give you details about - the parent process of a process running on a host which is under investigation. - Enter the values of the process name in question and the dest -search: '| tstats `security_content_summariesonly` count values(Processes.process) - as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - by Processes.user Processes.parent_process_name Processes.process_name Processes.dest - | `drop_dm_object_name("Processes")` | search parent_process_name= $parent_process_name$ - |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Collection and Staging - - Command and Control - - DHS Report TA18-074A - - Disabling Security Tools - - 'Emotet Malware DHS Report TA18-201A ' - - Hidden Cobra Malware - - Lateral Movement - - Malicious PowerShell - - Monitor for Unauthorized Software - - Netsh Abuse - - Orangeworm Attack Group - - Phishing Payloads - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - Prohibited Traffic Allowed or Protocol Mismatch - - Ransomware - - SamSam Ransomware - - Suspicious Command-Line Executions - - Suspicious DNS Traffic - - Suspicious MSHTA Activity - - Suspicious WMI Use - - Suspicious Windows Registry Activities - - Unusual Processes - - Windows Defense Evasion Tactics - - Windows File Extension and Association Abuse - - Windows Log Manipulation - - Windows Persistence Techniques - - Windows Privilege Escalation - - Windows Service Abuse - product: - - Splunk Phantom - required_fields: - - _time - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.dest - security_domain: endpoint diff --git a/investigations/get_process_file_activity.yml b/investigations/get_process_file_activity.yml deleted file mode 100644 index 574c0690d1..0000000000 --- a/investigations/get_process_file_activity.yml +++ /dev/null @@ -1,34 +0,0 @@ -name: Get Process File Activity -id: 6a9ad4d9-6ef2-4b85-953f-a37ab256acd5 -version: 2 -date: '2019-11-06' -author: David Dorsey, Splunk -type: Investigation -datamodel: -- Endpoint -description: This search returns the file activity for a specific process on a specific - endpoint -search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as - file_name values(Filesystem.dest) as dest, values(Filesystem.process_name) as process_name - from datamodel=Endpoint.Filesystem by Filesystem.dest Filesystem.process_name Filesystem.file_path, - Filesystem.action, _time | `drop_dm_object_name(Filesystem)` | search dest=$dest$ | - search process_name=$process_name$ | table _time, process_name, dest, action, file_name, - file_path' -how_to_implement: To successfully implement this search you must be ingesting endpoint - data and populating the Endpoint data model. -known_false_positives: '' -references: [] -tags: - analytic_story: - - DHS Report TA18-074A - - Suspicious Zoom Child Processes - product: - - Splunk Phantom - required_fields: - - _time - - Filesystem.file_name - - Filesystem.dest - - Filesystem.process_name - - Filesystem.file_path - - Filesystem.action - security_domain: endpoint diff --git a/investigations/get_process_info.yml b/investigations/get_process_info.yml deleted file mode 100644 index 42769a54f2..0000000000 --- a/investigations/get_process_info.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Get Process Info -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71 -version: 2 -date: '2019-04-01' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: -- Endpoint -description: This search queries the Endpoint data model to give you details about - the process running on a host which is under investigation. To gather the process - info, enter the values for the process name in question and the destination IP address. -search: '| tstats `security_content_summariesonly` count values(Processes.process) - as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - by Processes.user Processes.parent_process_name Processes.process_name Processes.dest - | `drop_dm_object_name("Processes")` | search process_name= $process_name$ | search - dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' -how_to_implement: To successfully implement this search you must be ingesting endpoint - data and populating the Endpoint data model. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Network ACL Activity - - Collection and Staging - - Command and Control - - DHS Report TA18-074A - - Data Protection - - Disabling Security Tools - - 'Emotet Malware DHS Report TA18-201A ' - - Hidden Cobra Malware - - Lateral Movement - - Malicious PowerShell - - Monitor for Unauthorized Software - - Netsh Abuse - - Orangeworm Attack Group - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - Prohibited Traffic Allowed or Protocol Mismatch - - Ransomware - - SamSam Ransomware - - Suspicious AWS Traffic - - Suspicious Command-Line Executions - - Suspicious DNS Traffic - - Suspicious MSHTA Activity - - Suspicious WMI Use - - Suspicious Windows Registry Activities - - Unusual Processes - - Windows Defense Evasion Tactics - - Windows File Extension and Association Abuse - - Windows Log Manipulation - - Windows Persistence Techniques - - Windows Privilege Escalation - - Windows Service Abuse - product: - - Splunk Phantom - required_fields: - - _time - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.dest - security_domain: endpoint diff --git a/investigations/get_process_information_for_port_activity.yml b/investigations/get_process_information_for_port_activity.yml deleted file mode 100644 index c76eb864ad..0000000000 --- a/investigations/get_process_information_for_port_activity.yml +++ /dev/null @@ -1,46 +0,0 @@ -name: Get Process Information For Port Activity -id: 9925d08f-561e-4faa-8912-e3888a842341 -version: 2 -date: '2019-04-01' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: -- Endpoint -description: This search will return information about the process associated with - observed network traffic to a specific destination port from a specific host. -search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as - lastTime from datamodel=Endpoint.Processes by Processes.process_name Processes.user - Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | search dest=$dest$ | join dest type=inner - [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports by - Ports.process_id Ports.src Ports.dest_port | `drop_dm_object_name(Ports)` | search - dest_port=$dest_port$ | rename src as dest]' -how_to_implement: To successfully implement this search you must be ingesting endpoint - data that associates processes with network events and populate the Endpoint Datamodel -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Network ACL Activity - - Command and Control - - DHS Report TA18-074A - - 'Emotet Malware DHS Report TA18-201A ' - - Hidden Cobra Malware - - Lateral Movement - - Prohibited Traffic Allowed or Protocol Mismatch - - Ransomware - - SamSam Ransomware - - Suspicious AWS Traffic - - Use of Cleartext Protocols - product: - - Splunk Phantom - required_fields: - - _time - - Processes.user - - Processes.process_id - - Processes.process_name - - Processes.dest - - Ports.process_id - - Ports.src - - Ports.dest_port - security_domain: endpoint diff --git a/investigations/get_process_responsible_for_the_dns_traffic.yml b/investigations/get_process_responsible_for_the_dns_traffic.yml deleted file mode 100644 index 9521720e06..0000000000 --- a/investigations/get_process_responsible_for_the_dns_traffic.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: Get Process Responsible For The DNS Traffic -id: 910e6512-edc9-4f93-ba24-5b786f47a672 -version: 2 -date: '2019-04-01' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: -- Endpoint -description: While investigating, an analyst will want to know what process and parent_process - is responsible for generating suspicious DNS traffic. Use the following search and - enter the value of `dest` in the search to get specific details on the process responsible - for creating the DNS traffic. -search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as - lastTime from datamodel=Endpoint.Processes by Processes.parent_process Processes.process_name - Processes.user Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search - dest = $dest$ | join dest type=inner [| tstats `security_content_summariesonly` - count from datamodel=Endpoint.Ports where Ports.dest_port=53 by Ports.process_id - Ports.src | `drop_dm_object_name(Ports)` | rename src as dest]' -how_to_implement: You must be ingesting endpoint data that associates processes with - network events into the Endpoint datamodel. This can come from endpoint protection - products such as carbon black, or endpoint data sources such as Sysmon. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Network ACL Activity - - Brand Monitoring - - Command and Control - - Data Protection - - Dynamic DNS - - Hidden Cobra Malware - - Suspicious AWS Traffic - - Suspicious DNS Traffic - product: - - Splunk Phantom - required_fields: - - _time - - Processes.user - - Processes.process_id - - Processes.process_name - - Processes.dest - - Processes.parent_process - - Ports.process_id - - Ports.src - - Ports.dest_port - security_domain: endpoint diff --git a/investigations/get_sysmon_wmi_activity_for_host.yml b/investigations/get_sysmon_wmi_activity_for_host.yml deleted file mode 100644 index 6d03d1aaa2..0000000000 --- a/investigations/get_sysmon_wmi_activity_for_host.yml +++ /dev/null @@ -1,34 +0,0 @@ -name: Get Sysmon WMI Activity for Host -id: 155e0571-7db6-42f2-aa62-9a3a4cf35c94 -version: 1 -date: '2018-10-23' -author: Rico Valdez, Splunk -type: Investigation -datamodel: [] -description: This search queries Sysmon WMI events for the host of interest. -search: '`sysmon` EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| - table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter' -how_to_implement: To successfully implement this search, you must be collecting Sysmon - data using Sysmon version 6.1 or greater and have Sysmon configured to generate - events for WMI activity. In addition, you must have at least version 6.0.4 of the - Sysmon TA installed to properly parse the fields. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Ransomware - - Suspicious WMI Use - product: - - Splunk Phantom - required_fields: - - _time - - EventCode - - user - - Name - - Operation - - EventType - - Type - - Query - - Consumer - - Filter - security_domain: endpoint diff --git a/investigations/get_web_session_information_via_session_id.yml b/investigations/get_web_session_information_via_session_id.yml deleted file mode 100644 index 890e160435..0000000000 --- a/investigations/get_web_session_information_via_session_id.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: Get Web Session Information via session id -id: bc91a8cf-35e7-4bb2-1120-e756cc06fd89 -version: 1 -date: '2018-10-08' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search helps an analyst investigate a notable event to find out - more about a specific web session. The search looks for a specific web session ID - in the HTTP web traffic and outputs the URL and user agents, grouped by source IP - address and HTTP status code. -search: '`stream_http` session_id = $session_id$ | stats values(url) values(http_user_agent) - by src_ip status' -how_to_implement: This search leverages data extracted from Stream:HTTP. You must - configure the HTTP stream using the Splunk Stream App on your Splunk Stream deployment - server. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Web Fraud Detection - product: - - Splunk Phantom - required_fields: - - _time - - session_id - - http_user_agent - - src_ip - - status - security_domain: network diff --git a/investigations/investigate_aws_activities_via_region_name.yml b/investigations/investigate_aws_activities_via_region_name.yml deleted file mode 100644 index 5a29ff6bae..0000000000 --- a/investigations/investigate_aws_activities_via_region_name.yml +++ /dev/null @@ -1,32 +0,0 @@ -name: Investigate AWS activities via region name -id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11 -version: 1 -date: '2018-02-09' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search lists all the user activities logged by CloudTrail for a - specific region in question and will create a table of the values of parameters - requested, the type of the event and the response from the AWS API by each user -search: '`cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId - as instanceId | stats values(eventName) by user instanceId vendor_region' -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS Cryptomining - - Cloud Cryptomining - - Suspicious AWS EC2 Activities - - Suspicious AWS S3 Activities - product: - - Splunk Phantom - required_fields: - - _time - - vendor_region - - requestParameters.instancesSet.items{}.instanceId - - eventName - - user - security_domain: network diff --git a/investigations/investigate_aws_user_activities_by_user_field.yml b/investigations/investigate_aws_user_activities_by_user_field.yml deleted file mode 100644 index 8b8f3a6091..0000000000 --- a/investigations/investigate_aws_user_activities_by_user_field.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: Investigate AWS User Activities by user field -id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76 -version: 1 -date: '2018-03-12' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search lists all the logged CloudTrail activities by a specific - user and will create a table containing the source of the user, the region of the - activity, the name and type of the event, the action taken, and the user's identity - information. -search: '`cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName - userIdentity.arn aws_account_id src awsRegion eventName eventType ' -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - AWS User Monitoring - - Suspicious Cloud Authentication Activities - product: - - Splunk Phantom - required_fields: - - _time - - user - - userIdentity.type - - userIdentity.userName - - userIdentity.arn - - aws_account_id - - src - - awsRegion - - eventName - - eventType - security_domain: network diff --git a/investigations/investigate_failed_logins_for_multiple_destinations.yml b/investigations/investigate_failed_logins_for_multiple_destinations.yml deleted file mode 100644 index e236f84925..0000000000 --- a/investigations/investigate_failed_logins_for_multiple_destinations.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: Investigate Failed Logins for Multiple Destinations -id: 097e8030-8662-4254-a735-bf0bdda696e3 -version: 1 -date: '2019-12-10' -author: Patrick Bareiss, Splunk -type: Investigation -datamodel: -- Authentication -description: This search returns failed logins to multiple destinations by user. -search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login - latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) - AS Authentication.dest values(Authentication.app) AS Authentication.app from datamodel=Authentication - where Authentication.action=failure by Authentication.user | where distinct_count_dest - > 1 | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` - | `drop_dm_object_name("Authentication")` | search user=$user$' -how_to_implement: To successfully implement this search you need to be ingesting authentication - logs from your various systems and populating the Authentication data model. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Credential Dumping - product: - - Splunk Phantom - required_fields: - - _time - - Authentication.dest - - Authentication.app - - Authentication.action - - Authentication.user - security_domain: endpoint diff --git a/investigations/investigate_network_traffic_from_src_ip.yml b/investigations/investigate_network_traffic_from_src_ip.yml deleted file mode 100644 index 9564dfbb5a..0000000000 --- a/investigations/investigate_network_traffic_from_src_ip.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: Investigate Network Traffic From src ip -id: 9df9ca9c-a02b-4f48-9eba-0bac55179050 -version: 1 -date: '2018-06-15' -author: David Dorsey, Splunk -type: Investigation -datamodel: -- Network_Traffic -description: This search allows you to find all the network traffic from a specific - IP address. -search: '| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$' -how_to_implement: To successfully implement this search, you must be ingesting your - web-traffic logs and populating the web data model. -known_false_positives: '' -references: [] -tags: - analytic_story: - - ColdRoot MacOS RAT - - Splunk Enterprise Vulnerability CVE-2018-11409 - cve: - - CVE-2018-11409 - product: - - Splunk Phantom - required_fields: - - _time - - src_ip - security_domain: network diff --git a/investigations/investigate_okta_activity_by_app.yml b/investigations/investigate_okta_activity_by_app.yml deleted file mode 100644 index c598aeb420..0000000000 --- a/investigations/investigate_okta_activity_by_app.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: Investigate Okta Activity by app -id: 420eb1b8-2992-45d1-80cf-0b1b2759524d -version: 1 -date: '2020-04-02' -author: Rico Valdez, Splunk -type: Investigation -datamodel: [] -description: This search returns all okta events associated with a specific app -search: '`okta` app=$app$ | rename client.geographicalContext.country as country, - client.geographicalContext.state as state, client.geographicalContext.city as city - | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' -how_to_implement: You must be ingesting Okta logs -known_false_positives: '' -references: [] -tags: - analytic_story: - - Suspicious Okta Activity - product: - - Splunk Phantom - required_fields: - - _time - - app - - client.geographicalContext.country - - client.geographicalContext.state - - client.geographicalContext.city - - user - - displayMessage - - src_ip - - result - - outcome.reason - security_domain: network diff --git a/investigations/investigate_okta_activity_by_ip_address.yml b/investigations/investigate_okta_activity_by_ip_address.yml deleted file mode 100644 index db8f5fb1a2..0000000000 --- a/investigations/investigate_okta_activity_by_ip_address.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: Investigate Okta Activity by IP Address -id: 56aae066-d619-477c-93e3-3fb83b2d23c3 -version: 1 -date: '2020-04-02' -author: Rico Valdez, Splunk -type: Investigation -datamodel: [] -description: This search returns all okta events from a specific IP address. -search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country as country, - client.geographicalContext.state as state, client.geographicalContext.city as city - | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' -how_to_implement: You must be ingesting Okta logs -known_false_positives: '' -references: [] -tags: - analytic_story: - - Suspicious Okta Activity - product: - - Splunk Phantom - required_fields: - - _time - - app - - client.geographicalContext.country - - client.geographicalContext.state - - client.geographicalContext.city - - user - - displayMessage - - src_ip - - result - - outcome.reason - security_domain: network diff --git a/investigations/investigate_pass_the_hash_attempts.yml b/investigations/investigate_pass_the_hash_attempts.yml deleted file mode 100644 index 46c86fb11f..0000000000 --- a/investigations/investigate_pass_the_hash_attempts.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: Investigate Pass the Hash Attempts -id: ed3fff45-cba6-4990-983f-6fac72bee659 -version: 1 -date: '2019-12-10' -author: Patrick Bareiss, Splunk -type: Investigation -datamodel: [] -description: This search hunts for dumped NTLM hashes used for pass the hash. -search: '`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate - | stats count earliest(_time) as first_login latest(_time) as last_login by src_user - dest | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` - | search dest=$dest$' -how_to_implement: To successfully implement this search you need be ingesting windows - security logs. This search uses an input macro named `wineventlog_security`. We - strongly recommend that you specify your environment-specific configurations (index, - source, sourcetype, etc.) for Windows Security logs. Replace the macro definition - with configurations for your Splunk environment. The search also uses a post-filter - macro designed to filter out known false positives. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Credential Dumping - product: - - Splunk Phantom - required_fields: - - _time - - EventCode - - Logon_Type - - AuthenticationPackageName - - src_user - - dest - security_domain: endpoint diff --git a/investigations/investigate_pass_the_ticket_attempts.yml b/investigations/investigate_pass_the_ticket_attempts.yml deleted file mode 100644 index 095a1e471c..0000000000 --- a/investigations/investigate_pass_the_ticket_attempts.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: Investigate Pass the Ticket Attempts -id: 990007ad-d798-4b29-ab2f-f0034144c937 -version: 1 -date: '2019-12-10' -author: Patrick Bareiss, Splunk -type: Investigation -datamodel: [] -description: This search hunts for dumped kerberos ticket from LSASS memory. -search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user - "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) - AS max_count sum(count) AS sum_count BY new_user, dest| search dest=$dest$ | where - sum_count/max_count!=2 | rename new_user AS user ' -how_to_implement: To successfully implement this search you need to be ingesting windows - security logs. This search uses an input macro named `wineventlog_security`. We - strongly recommend that you specify your environment-specific configurations (index, - source, sourcetype, etc.) for Windows Security logs. Replace the macro definition - with configurations for your Splunk environment. The search also uses a post-filter - macro designed to filter out known false positives. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Credential Dumping - product: - - Splunk Phantom - required_fields: - - _time - - EventCode - - user - - dest - security_domain: endpoint diff --git a/investigations/investigate_previous_unseen_user.yml b/investigations/investigate_previous_unseen_user.yml deleted file mode 100644 index 1553a8c28f..0000000000 --- a/investigations/investigate_previous_unseen_user.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: Investigate Previous Unseen User -id: ad114d5c-8079-4a84-a646-2fd00dfc07cc -version: 1 -date: '2019-12-10' -author: Patrick Bareiss, Splunk -type: Investigation -datamodel: -- Authentication -description: This search returns previous unseen user, which didn't log in for 30 - days. -search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login - latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app) - AS Authentication.app values(Authentication.action) AS Authentication.action from - datamodel=Authentication where Authentication.action=success by _time, Authentication.user - | bucket _time span=30d | stats count min(first_login) as first_login max(last_login) - as last_login values(Authentication.dest) AS Authentication.dest by Authentication.user - | where count=1 | where first_login >= relative_time(now(), "-30d") | `security_content_ctime(first_login)` - | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")` - | search dest=$dest$' -how_to_implement: To successfully implement this search you need to be ingesting authentication - logs from your various systems and populating the Authentication data model. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Credential Dumping - product: - - Splunk Phantom - required_fields: - - _time - - Authentication.dest - - Authentication.app - - Authentication.action - - Authentication.user - security_domain: endpoint diff --git a/investigations/investigate_successful_remote_desktop_authentications.yml b/investigations/investigate_successful_remote_desktop_authentications.yml deleted file mode 100644 index 0ef0b02006..0000000000 --- a/investigations/investigate_successful_remote_desktop_authentications.yml +++ /dev/null @@ -1,39 +0,0 @@ -name: Investigate Successful Remote Desktop Authentications -id: b6618e8e-be04-40a0-a0b9-f0bd4b6c81bc -version: 1 -date: '2018-12-14' -author: Jose Hernandez, Splunk -type: Investigation -datamodel: -- Authentication -description: 'This search returns the source, destination, and user for all successful - remote-desktop authentications. A successful authentication after a brute-force - attack on a destination machine is suspicious behavior. ' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Authentication where Authentication.signature_id=4624 - Authentication.app=win:remote by Authentication.src Authentication.dest Authentication.app - Authentication.user Authentication.signature Authentication.src_nt_domain | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `drop_dm_object_name("Authentication")` - | search dest=$dest$ | table firstTime lastTime src src_nt_domain dest user app - count | sort count' -how_to_implement: You must be populating the Authentication data model with security - events from your Windows event logs. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Hidden Cobra Malware - - Active Directory Lateral Movement - - SamSam Ransomware - product: - - Splunk Phantom - required_fields: - - _time - - Authentication.signature_id - - Authentication.app - - Authentication.src - - Authentication.dest - - Authentication.user - - Authentication.signature - - Authentication.src_nt_domain - security_domain: endpoint diff --git a/investigations/investigate_suspicious_strings_in_http_header.yml b/investigations/investigate_suspicious_strings_in_http_header.yml deleted file mode 100644 index 806f8da3ae..0000000000 --- a/investigations/investigate_suspicious_strings_in_http_header.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: Investigate Suspicious Strings in HTTP Header -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd89 -version: 1 -date: '2017-10-20' -author: Bhavin Patel, Splunk -type: Investigation -datamodel: [] -description: This search helps an analyst investigate a notable event related to a - potential Apache Struts exploitation. To investigate, we will want to isolate and - analyze the "payload" or the commands that were passed to the vulnerable hosts by - creating a few regular expressions to carve out the commands focusing on common - keywords from the payload, such as cmd.exe, /bin/bash and whois. The search returns - these suspicious strings found in the HTTP logs of the system of interest. -search: '`stream_http` | search src_ip=$src_ip$ | search dest_ip=$dest_ip$ | eval - cs_content_type_length = len(cs_content_type) | search cs_content_type_length > - 100 | rex field="cs_content_type" (?cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, - "application"), "True", "False") | rename suspicious_strings_found AS "Suspicious - Content-Type Found" | fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, - cs_content_type, cs_content_type_length, url' -how_to_implement: This particular search leverages data extracted from Stream:HTTP. - You must configure the http stream using the Splunk Stream App on your Splunk Stream - deployment server to extract the cs_content_type field. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Apache Struts Vulnerability - product: - - Splunk Phantom - required_fields: - - _time - - src_ip - - dest_ip - - cs_content_type - - url - security_domain: network diff --git a/investigations/investigate_user_activities_in_okta.yml b/investigations/investigate_user_activities_in_okta.yml deleted file mode 100644 index 57ac515d5e..0000000000 --- a/investigations/investigate_user_activities_in_okta.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: Investigate User Activities In Okta -id: 24ff145d-4d16-420a-b047-480f2a51c403 -version: 1 -date: '2020-04-02' -author: Rico Valdez, Splunk -type: Investigation -datamodel: [] -description: This search returns all okta events by a specific user -search: '`okta` user=$user$ | rename client.geographicalContext.country as country, - client.geographicalContext.state as state, client.geographicalContext.city as city - | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' -how_to_implement: You must be ingesting Okta logs -known_false_positives: '' -references: [] -tags: - analytic_story: - - Suspicious Okta Activity - product: - - Splunk Phantom - required_fields: - - _time - - client.geographicalContext.country - - client.geographicalContext.state - - client.geographicalContext.city - - user - - displayMessage - - src_ip - - result - - outcome.reason - security_domain: network diff --git a/investigations/investigate_web_posts_from_src.yml b/investigations/investigate_web_posts_from_src.yml deleted file mode 100644 index 4a5cfe9dc2..0000000000 --- a/investigations/investigate_web_posts_from_src.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: Investigate Web POSTs From src -id: f5c39fac-205c-4e07-9004-8fd61ea3431a -version: 1 -date: '2018-12-06' -author: Jose Hernandez, Splunk -type: Investigation -datamodel: -- Web -description: 'This investigative search retrieves POST requests from a specified source - IP or hostname. Identifying the POST requests, as well as their associated destination - URLs and user agent(s), may help you scope and characterize the suspicious traffic. ' -search: '| tstats `security_content_summariesonly` values(Web.url) as url from datamodel=Web - by Web.src,Web.http_user_agent,Web.http_method | `drop_dm_object_name("Web")`| search - http_method, "POST" | search src=$src$' -how_to_implement: To successfully implement this search, you must be ingesting your - web-traffic logs and populating the web data model. -known_false_positives: '' -references: [] -tags: - analytic_story: - - Apache Struts Vulnerability - product: - - Splunk Phantom - required_fields: - - _time - - Web.url - - Web.src - - Web.http_user_agent - - Web.http_method - security_domain: network diff --git a/investigations/rundll32_lockworkstation.yml b/investigations/rundll32_lockworkstation.yml deleted file mode 100644 index f20d95d919..0000000000 --- a/investigations/rundll32_lockworkstation.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Rundll32 LockWorkStation -id: fa90f372-f91d-11eb-816c-acde48001122 -version: 1 -date: '2021-08-09' -author: Teoderick Contreras, Splunk -type: Investigation -datamodel: -- Endpoint -description: This search is to detect a suspicious rundll32 commandline to lock the - workstation through command line. This technique was seen in CONTI leak tooling - and script as part of its defense evasion. This technique is not a common practice - to lock a screen and maybe a good indicator of compromise. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process= "*user32.dll,LockWorkStation*" by Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_lockworkstation_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: unknown -references: -- https://threadreaderapp.com/thread/1423361119926816776.html -tags: - analytic_story: - - Ransomware - automated_detection_testing: passed - confidence: 50 - context: - - Source:Endpoint - - Stage:Execution - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log - impact: 50 - kill_chain_phases: - - Exploitation - message: process $process_name$ with cmdline $process$ in host $dest$ - mitre_attack_id: - - T1218 - - T1218.011 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: SourceImage - type: process name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - risk_score: 25 - security_domain: endpoint