diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml new file mode 100644 index 0000000000..fccf6eb36a --- /dev/null +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -0,0 +1,61 @@ +name: AdsiSearcher Account Discovery +id: de7fcadc-04f3-11ec-a241-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a powershell command adsisearcher to do user + enumeration to the active directory. This command can be a normal query of a network + admin but since the output of this is not so much structure and cannot give a concrete + or specific information that admin may look upon this is still a good TTP to alert + some malicious activities. +search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*" + Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime + by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `adsisearcher_account_discovery_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: not commonly seen as a normal command from network admin but + possible noise may exist. +references: +- https://www.blackhillsinfosec.com/red-blue-purple/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml new file mode 100644 index 0000000000..f6cb42ade4 --- /dev/null +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -0,0 +1,71 @@ +name: Domain Account Discovery with Dsquery +id: b1a8ce04-04c2-11ec-bea7-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search is to detect a suspicious process commandline of dsquery + for enumerating users. This technique is commonly in attacker and red team to recon + on users in targetted machine. This command can also be used by network administrator + but not by a normal user. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="dsquery.exe" + AND Processes.process = "*user*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `domain_account_discovery_with_dsquery_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network administrator may use this command but not commonly + seen used by a user. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml new file mode 100644 index 0000000000..957e770258 --- /dev/null +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -0,0 +1,71 @@ +name: Domain Account Discovery With Net App +id: 98f6a534-04c2-11ec-96b2-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a process command line for AD discovery. This + techique is using the windows built in net.exe application to query AD users in + the targetted machine. This techique was seen in several malware as part of there + recon and can be a good pivot of analysis. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" + OR Processes.process_name="net1.exe") AND Processes.process = "* user*" AND Processes.process + = "*/do*" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `domain_account_discovery_with_net_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network operator can execute this command +references: +- https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml new file mode 100644 index 0000000000..bc8df65b34 --- /dev/null +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -0,0 +1,72 @@ +name: Domain Account Discovery with Wmic +id: 383572e0-04c5-11ec-bdcc-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a wmic command for enumerating user in active + directory. This technique was commonly used in pentesting, red-team and also by + some attacker to map all user in the targetted host. This search may also catch + this type of query made by network admin but not common in all the user in the network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" + AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process + = "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `domain_account_discovery_with_wmic_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network admin may execute this command for listing users. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml new file mode 100644 index 0000000000..ee1a676957 --- /dev/null +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -0,0 +1,72 @@ +name: Get ADUser with PowerShell +id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search is to detect a suspicious commandline that commonly uses + for enumerating users in active directory. This technique can be a good indicator + to hunt further TTPs to the machine to check further anomalies. Since this is a + hunt query expect some noise from administrator or some IT within the network that + may use this command. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUser*" + AND Processes.process = "*-filter*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network admin may use this command. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml new file mode 100644 index 0000000000..bec9395557 --- /dev/null +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -0,0 +1,61 @@ +name: Get ADUser with PowerShell Script Block +id: 21432e40-04f4-11ec-b7e6-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search is to detect a powershell command get-aduser function to + do user enumeration to the active directory. This command can be a normal query + of a network admin but since the output of this is not so much structure and cannot + give a concrete or specific information that admin may look upon this is still a + good TTP to alert some malicious activities. +search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_aduser_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: network admin may use this command and other IT operator to + check AD users. +references: +- https://www.blackhillsinfosec.com/red-blue-purple/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml new file mode 100644 index 0000000000..d6f9432887 --- /dev/null +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -0,0 +1,70 @@ +name: Get DomainUser with PowerShell +id: 9a5a41d6-04e7-11ec-923c-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a cmdlet Get-DomainUser that are common on powerview + or powersploit tool. This cmdlet is used to recon on the targetted machine to enumerate + all users in active directory. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainUser*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_domainuser_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml new file mode 100644 index 0000000000..7dced17095 --- /dev/null +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -0,0 +1,60 @@ +name: Get DomainUser with PowerShell Script Block +id: 61994268-04f4-11ec-865c-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: his search is to detect a powershell command Get-DomainUser to do user + enumeration to the active directory. This command is function seen in powerspoit + and powerview tool that are designed to pentest active directory or domain controller + for possible attack. This is a good TTP for alerting SOC if there is a pentest or + recon happening on the system. try to look for lateral movement technique or credential + dumping techniques in the system. +search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: unknown +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml new file mode 100644 index 0000000000..7664fa83e3 --- /dev/null +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -0,0 +1,72 @@ +name: GetWmiObject DS User with PowerShell +id: 22d3b118-04df-11ec-8fa3-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious execution wmi process that enumerate + user in active directory. This technique can be used by attacker and pentester to + mapped all the users as part of its recon to the targetted host. Network Admin may + seen executing this command but not often and also not common to see in user events. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*get-wmiobject*" + AND Processes.process = "*ds_user*" AND Processes.process = "*root\\directory\\ldap*" + AND Processes.process = "*-namespace*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network admin may execute this command. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml new file mode 100644 index 0000000000..26b31ee511 --- /dev/null +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -0,0 +1,62 @@ +name: GetWmiObject DS User with PowerShell Script Block +id: fabd364e-04f3-11ec-b34b-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a powershell command get-wmiobject function + to do user enumeration to the active directory. This command can be a normal query + of a network admin but since the output of this is not so much structure and cannot + give a concrete or specific information that admin may look upon this is still a + good TTP to alert some malicious activities. +search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" + Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`' +how_to_implement: he following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: not commonly seen as a normal command from network admin but + possible noise may exist. +references: +- https://www.blackhillsinfosec.com/red-blue-purple/ +- https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/tests/endpoint/adsisearcher_account_discovery.test.yml b/tests/endpoint/adsisearcher_account_discovery.test.yml new file mode 100644 index 0000000000..b727b66bb5 --- /dev/null +++ b/tests/endpoint/adsisearcher_account_discovery.test.yml @@ -0,0 +1,12 @@ +name: AdsiSearcher Account Discovery Unit Test +tests: +- name: AdsiSearcher Account Discovery + file: endpoint/adsisearcher_account_discovery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/domain_account_discovery_with_dsquery.test.yml b/tests/endpoint/domain_account_discovery_with_dsquery.test.yml new file mode 100644 index 0000000000..998b007966 --- /dev/null +++ b/tests/endpoint/domain_account_discovery_with_dsquery.test.yml @@ -0,0 +1,12 @@ +name: Domain Account Discovery with Dsquery Unit Test +tests: +- name: Domain Account Discovery with Dsquery + file: endpoint/domain_account_discovery_with_dsquery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/domain_account_discovery_with_net_app.test.yml b/tests/endpoint/domain_account_discovery_with_net_app.test.yml new file mode 100644 index 0000000000..4a78b48b43 --- /dev/null +++ b/tests/endpoint/domain_account_discovery_with_net_app.test.yml @@ -0,0 +1,12 @@ +name: Domain Account Discovery With Net App Unit Test +tests: +- name: Domain Account Discovery With Net App + file: endpoint/domain_account_discovery_with_net_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/domain_account_discovery_with_wmic.test.yml b/tests/endpoint/domain_account_discovery_with_wmic.test.yml new file mode 100644 index 0000000000..0cd381fae0 --- /dev/null +++ b/tests/endpoint/domain_account_discovery_with_wmic.test.yml @@ -0,0 +1,12 @@ +name: Domain Account Discovery with Wmic Unit Test +tests: +- name: Domain Account Discovery with Wmic + file: endpoint/domain_account_discovery_with_wmic.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_aduser_with_powershell.test.yml b/tests/endpoint/get_aduser_with_powershell.test.yml new file mode 100644 index 0000000000..461b37924d --- /dev/null +++ b/tests/endpoint/get_aduser_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Get ADUser with PowerShell Unit Test +tests: +- name: Get ADUser with PowerShell + file: endpoint/get_aduser_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_aduser_with_powershell_script_block.test.yml b/tests/endpoint/get_aduser_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..31858a93c2 --- /dev/null +++ b/tests/endpoint/get_aduser_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get ADUser with PowerShell Script Block Unit Test +tests: +- name: Get ADUser with PowerShell Script Block + file: endpoint/get_aduser_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/get_domainuser_with_powershell.test.yml b/tests/endpoint/get_domainuser_with_powershell.test.yml new file mode 100644 index 0000000000..0abe5e6722 --- /dev/null +++ b/tests/endpoint/get_domainuser_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Get DomainUser with PowerShell Unit Test +tests: +- name: Get DomainUser with PowerShell + file: endpoint/get_domainuser_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..bae14d79d5 --- /dev/null +++ b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get DomainUser with PowerShell Script Block Unit Test +tests: +- name: Get DomainUser with PowerShell Script Block + file: endpoint/get_domainuser_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml b/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml new file mode 100644 index 0000000000..6637d3263c --- /dev/null +++ b/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: GetWmiObject DS User with PowerShell Unit Test +tests: +- name: GetWmiObject DS User with PowerShell + file: endpoint/getwmiobject_ds_user_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..ee1809782e --- /dev/null +++ b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: GetWmiObject DS User with PowerShell Script Block Unit Test +tests: +- name: GetWmiObject DS User with PowerShell Script Block + file: endpoint/getwmiobject_ds_user_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file