From 7ccc45422e5708419179821ebfe08ce7a9ee85ad Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 16 Mar 2023 15:46:57 -0400 Subject: [PATCH 01/29] adding detection --- .../windows_powershell_gpp_discovery.yml | 65 +++++++++++++++++++ .../windows_powershell_gpp_discovery.test.yml | 12 ++++ 2 files changed, 77 insertions(+) create mode 100644 detections/endpoint/windows_powershell_gpp_discovery.yml create mode 100644 tests/endpoint/windows_powershell_gpp_discovery.test.yml diff --git a/detections/endpoint/windows_powershell_gpp_discovery.yml b/detections/endpoint/windows_powershell_gpp_discovery.yml new file mode 100644 index 0000000000..44c4d1151d --- /dev/null +++ b/detections/endpoint/windows_powershell_gpp_discovery.yml @@ -0,0 +1,65 @@ +name: Windows PowerShell GPP Discovery +id: 0130a0df-83a1-4647-9011-841e950ff302 +version: 1 +date: '2023-03-16' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' EventCode=4104 (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword) + | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer + UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_powershell_gpp_discovery_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Unknown +references: +- https://pentestlab.blog/2017/03/20/group-policy-preferences/ +- https://adsecurity.org/?p=2288 +- https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/ +tags: + analytic_story: + - Active Directory Privilege Escalation + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Commandlets leveraged to discover GPP credentials were executed on $Computer$ + mitre_attack_id: + - T1552 + - T1552.006 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: UserID + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ScriptBlockText + - Opcode + - Computer + - UserID + risk_score: 56 + security_domain: endpoint diff --git a/tests/endpoint/windows_powershell_gpp_discovery.test.yml b/tests/endpoint/windows_powershell_gpp_discovery.test.yml new file mode 100644 index 0000000000..d3235611f6 --- /dev/null +++ b/tests/endpoint/windows_powershell_gpp_discovery.test.yml @@ -0,0 +1,12 @@ +name: Windows PowerShell GPP Discovery Unit Test +tests: +- name: Windows PowerShell GPP Discovery + file: endpoint/windows_powershell_gpp_discovery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: win-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog From 2a32bc9694a3949cffbf9e3c856f2bf1a8a10781 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 17 Mar 2023 14:17:07 -0400 Subject: [PATCH 02/29] adding new detection --- .../windows_findstr_gpp_discovery.yml | 75 +++++++++++++++++++ .../windows_powershell_gpp_discovery.yml | 1 + .../windows_findstr_gpp_discovery.test.yml | 12 +++ 3 files changed, 88 insertions(+) create mode 100644 detections/endpoint/windows_findstr_gpp_discovery.yml create mode 100644 tests/endpoint/windows_findstr_gpp_discovery.test.yml diff --git a/detections/endpoint/windows_findstr_gpp_discovery.yml b/detections/endpoint/windows_findstr_gpp_discovery.yml new file mode 100644 index 0000000000..32b06dfee3 --- /dev/null +++ b/detections/endpoint/windows_findstr_gpp_discovery.yml @@ -0,0 +1,75 @@ +name: Windows Findstr GPP Discovery +id: 1631ac2d-f2a9-42fa-8a59-d6e210d472f5 +version: 1 +date: '2023-03-16' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=findstr.exe AND Processes.process=*sysvol* AND Processes.process=*cpassword*) + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_findstr_gpp_discovery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrators may leverage findstr to find passwords in GPO to validate exposure. Filter as needed. +references: +- https://pentestlab.blog/2017/03/20/group-policy-preferences/ +- https://adsecurity.org/?p=2288 +- https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/ +- https://attack.mitre.org/techniques/T1552/006/ +tags: + analytic_story: + - Active Directory Privilege Escalation + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Findstr was executed to discover GPP credentials on $dest$ + mitre_attack_id: + - T1552 + - T1552.006 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.user + - Processes.dest + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process_id + - Processes.parent_process_id + - Processes.original_file_name + risk_score: 56 + security_domain: endpoint diff --git a/detections/endpoint/windows_powershell_gpp_discovery.yml b/detections/endpoint/windows_powershell_gpp_discovery.yml index 44c4d1151d..dba0d3d7a6 100644 --- a/detections/endpoint/windows_powershell_gpp_discovery.yml +++ b/detections/endpoint/windows_powershell_gpp_discovery.yml @@ -18,6 +18,7 @@ references: - https://pentestlab.blog/2017/03/20/group-policy-preferences/ - https://adsecurity.org/?p=2288 - https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/ +- https://attack.mitre.org/techniques/T1552/006/ tags: analytic_story: - Active Directory Privilege Escalation diff --git a/tests/endpoint/windows_findstr_gpp_discovery.test.yml b/tests/endpoint/windows_findstr_gpp_discovery.test.yml new file mode 100644 index 0000000000..3805dee99c --- /dev/null +++ b/tests/endpoint/windows_findstr_gpp_discovery.test.yml @@ -0,0 +1,12 @@ +name: Windows Findstr GPP Discovery Unit Test +tests: +- name: Windows Findstr GPP Discovery + file: endpoint/windows_findstr_gpp_discovery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-security.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From 2c866381b56434f862ac25262427756c1e3c7544 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 17 Mar 2023 15:14:09 -0400 Subject: [PATCH 03/29] adding datamodel tag --- detections/endpoint/windows_findstr_gpp_discovery.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_findstr_gpp_discovery.yml b/detections/endpoint/windows_findstr_gpp_discovery.yml index 32b06dfee3..a24f210daf 100644 --- a/detections/endpoint/windows_findstr_gpp_discovery.yml +++ b/detections/endpoint/windows_findstr_gpp_discovery.yml @@ -4,7 +4,8 @@ version: 1 date: '2023-03-16' author: Mauricio Velazco, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: UPDATE_DESCRIPTION search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=findstr.exe AND Processes.process=*sysvol* AND Processes.process=*cpassword*) From 759eaaf39f716a3e729792e62ef34c6cc6ac7788 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 20 Mar 2023 13:15:58 -0400 Subject: [PATCH 04/29] added descriptions --- .../endpoint/windows_findstr_gpp_discovery.yml | 8 ++++++-- .../windows_powershell_gpp_discovery.yml | 9 +++++++-- .../active_directory_privilege_escalation.yml | 16 ++++++++++++++++ ...ure_active_directory_privilege_escalation.yml | 16 ++++++++++++++++ 4 files changed, 45 insertions(+), 4 deletions(-) create mode 100644 stories/active_directory_privilege_escalation.yml create mode 100644 stories/azure_active_directory_privilege_escalation.yml diff --git a/detections/endpoint/windows_findstr_gpp_discovery.yml b/detections/endpoint/windows_findstr_gpp_discovery.yml index a24f210daf..86fd6aeca6 100644 --- a/detections/endpoint/windows_findstr_gpp_discovery.yml +++ b/detections/endpoint/windows_findstr_gpp_discovery.yml @@ -6,7 +6,10 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: UPDATE_DESCRIPTION +description: The following analytic identifies the use of the findstr command employed to search for unsecured credentials Group Policy Preferences (GPP). + GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. + These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). + While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL. search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=findstr.exe AND Processes.process=*sysvol* AND Processes.process=*cpassword*) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name @@ -19,10 +22,11 @@ how_to_implement: To successfully implement this search you need to be ingesting endpoint product. known_false_positives: Administrators may leverage findstr to find passwords in GPO to validate exposure. Filter as needed. references: +- https://attack.mitre.org/techniques/T1552/006/ - https://pentestlab.blog/2017/03/20/group-policy-preferences/ - https://adsecurity.org/?p=2288 - https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/ -- https://attack.mitre.org/techniques/T1552/006/ +- https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30 tags: analytic_story: - Active Directory Privilege Escalation diff --git a/detections/endpoint/windows_powershell_gpp_discovery.yml b/detections/endpoint/windows_powershell_gpp_discovery.yml index dba0d3d7a6..0b769acef5 100644 --- a/detections/endpoint/windows_powershell_gpp_discovery.yml +++ b/detections/endpoint/windows_powershell_gpp_discovery.yml @@ -5,7 +5,10 @@ date: '2023-03-16' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION +description: The following analytic identifies the use of the Get-GPPPassword PowerShell commandlet employed to search for unsecured credentials Group Policy Preferences (GPP). + GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. + These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). + While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL. search: ' EventCode=4104 (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -15,10 +18,12 @@ how_to_implement: To successfully implement this analytic, you will need to enab https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: Unknown references: +- https://attack.mitre.org/techniques/T1552/006/ - https://pentestlab.blog/2017/03/20/group-policy-preferences/ - https://adsecurity.org/?p=2288 - https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/ -- https://attack.mitre.org/techniques/T1552/006/ +- https://adsecurity.org/?p=2288 +- https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30 tags: analytic_story: - Active Directory Privilege Escalation diff --git a/stories/active_directory_privilege_escalation.yml b/stories/active_directory_privilege_escalation.yml new file mode 100644 index 0000000000..8d24cc30d4 --- /dev/null +++ b/stories/active_directory_privilege_escalation.yml @@ -0,0 +1,16 @@ +name: Active Directory Privilege Escalation +id: fa34a5d8-df0a-404c-8237-11f99cba1d5f +version: 1 +date: '2023-03-20' +author: Mauricio Velazco, Splunk +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: [] +tags: + analytic_story: Active Directory Privilege Escalation + category: [] + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/stories/azure_active_directory_privilege_escalation.yml b/stories/azure_active_directory_privilege_escalation.yml new file mode 100644 index 0000000000..93b97c570b --- /dev/null +++ b/stories/azure_active_directory_privilege_escalation.yml @@ -0,0 +1,16 @@ +name: Azure Active Directory Privilege Escalation +id: 49e54dd3-ed8b-478e-aac6-3c827fc73a93 +version: 1 +date: '2023-03-20' +author: Mauricio Velazco, Splunk +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: [] +tags: + analytic_story: Azure Active Directory Privilege Escalation + category: [] + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 7774a9bc229873182dd9c59a34912984e9732bce Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 21 Mar 2023 15:03:07 -0400 Subject: [PATCH 05/29] adding two detections --- ...ws_file_share_discovery_with_powerview.yml | 69 +++++++++++++++++++ ..._of_computer_service_tickets_requested.yml | 68 ++++++++++++++++++ .../windows_powershell_gpp_discovery.yml | 6 +- ..._of_computer_service_tickets_requested.yml | 1 + ...le_share_discovery_with_powerview.test.yml | 13 ++++ ...omputer_service_tickets_requested.test.yml | 13 ++++ 6 files changed, 167 insertions(+), 3 deletions(-) create mode 100644 detections/endpoint/windows_file_share_discovery_with_powerview.yml create mode 100644 detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml create mode 100644 tests/endpoint/windows_file_share_discovery_with_powerview.test.yml create mode 100644 tests/endpoint/windows_large_number_of_computer_service_tickets_requested.test.yml diff --git a/detections/endpoint/windows_file_share_discovery_with_powerview.yml b/detections/endpoint/windows_file_share_discovery_with_powerview.yml new file mode 100644 index 0000000000..fa5b91a722 --- /dev/null +++ b/detections/endpoint/windows_file_share_discovery_with_powerview.yml @@ -0,0 +1,69 @@ +name: Windows File Share Discovery With Powerview +id: a44c0be1-d7ab-41e4-92fd-aa9af4fe232c +version: 1 +date: '2023-03-20' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the use of the Invoke-ShareFinder PowerShell commandlet part of PowerView. This module obtains the list of all + active domain computers and lists the active shares on each computer. Network file shares in Active Directory environments may contain sensitive information + like backups, scripts, credentials, etc. Adversaries who have obtained a foothold in an AD network may leverage PowerView to identify secrets and leverage them + for Privilege Escalation or Lateral Movement. +search: ' `powershell` EventCode=4104 (ScriptBlockText=Invoke-ShareFinder*) + | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + `windows_file_share_discovery_with_powerview_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.= +known_false_positives: Security teams may leverage PowerView proactively to identify and remediate sensitive file shares. Filter as needed. +references: +- https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerView/powerview.ps1 +- https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ +- https://attack.mitre.org/techniques/T1135/ +tags: + analytic_story: + - Active Directory Privilege Escalation + - Active Directory Discovery + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell.log + impact: 60 + kill_chain_phases: + - Exploitation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1135 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: UserID + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ScriptBlockText + - Opcode + - Computer + - UserID + risk_score: 48 + security_domain: endpoint diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml new file mode 100644 index 0000000000..2f8dc28fc6 --- /dev/null +++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml @@ -0,0 +1,68 @@ +name: Windows Large Number of Computer Service Tickets Requested +id: 386ad394-c9a7-4b4f-b66f-586252de20f0 +version: 1 +date: '2023-03-20' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: The following analytic leverages Event ID 4769, `A Kerberos + service ticket was requested`, to identify a large number of computer service + ticket requests from one source. When a domain joined endpoint connects to other remote + endpoint, it first will request a Kerberos Ticket with the computer name as the + Service Name. A user requesting a large number of computer service tickets + for different endpoints could represent malicious behavior like lateral movement, + malware staging, reconnaissance, etc.\ + + Active Directory environments can be very different depending on the organization. Users should test this detection and customize + the arbitrary threshold when needed. + +search: ' `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$" + | bucket span=2m _time + | stats dc(ServiceName) AS unique_targets values(ServiceName) as host_targets by _time, IpAddress, TargetUserName + | where unique_targets > 4 + | `windows_large_number_of_computer_service_tickets_requested_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ +tags: + analytic_story: + - Active Directory Privilege Escalation + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/large_number_computer_service_tickets/windows-security.log + impact: 60 + kill_chain_phases: + - Reconnaissance + message: UPDATE message + mitre_attack_id: + - T1135 + - T1078 + nist: + - DE.CM + observable: + - name: IpAddress + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ServiceName + - TargetUserName + - IpAddress + risk_score: 30 + security_domain: endpoint diff --git a/detections/endpoint/windows_powershell_gpp_discovery.yml b/detections/endpoint/windows_powershell_gpp_discovery.yml index 0b769acef5..80ead31c17 100644 --- a/detections/endpoint/windows_powershell_gpp_discovery.yml +++ b/detections/endpoint/windows_powershell_gpp_discovery.yml @@ -9,9 +9,9 @@ description: The following analytic identifies the use of the Get-GPPPassword Po GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL. -search: ' EventCode=4104 (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword) - | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer - UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword) + | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_gpp_discovery_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here diff --git a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml index a3e1830e4c..6893389ed8 100644 --- a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml +++ b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml @@ -37,6 +37,7 @@ tags: analytic_story: - Active Directory Lateral Movement - Active Directory Kerberos Attacks + - Active Directory Privilege Escalation asset_type: Endpoint confidence: 60 context: diff --git a/tests/endpoint/windows_file_share_discovery_with_powerview.test.yml b/tests/endpoint/windows_file_share_discovery_with_powerview.test.yml new file mode 100644 index 0000000000..51ae22039c --- /dev/null +++ b/tests/endpoint/windows_file_share_discovery_with_powerview.test.yml @@ -0,0 +1,13 @@ +name: Windows File Share Discovery With Powerview Unit Test +tests: +- name: Windows File Share Discovery With Powerview + file: endpoint/windows_file_share_discovery_with_powerview.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/tests/endpoint/windows_large_number_of_computer_service_tickets_requested.test.yml b/tests/endpoint/windows_large_number_of_computer_service_tickets_requested.test.yml new file mode 100644 index 0000000000..4d5bf43048 --- /dev/null +++ b/tests/endpoint/windows_large_number_of_computer_service_tickets_requested.test.yml @@ -0,0 +1,13 @@ +name: Windows Large Number of Computer Service Tickets Requested Unit Test +tests: +- name: Windows Large Number of Computer Service Tickets Requested + file: endpoint/windows_large_number_of_computer_service_tickets_requested.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/large_number_computer_service_tickets/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + update_timestamp: true From 2fea55527dbd3fe0073999759e36744ed8bb7474 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 21 Mar 2023 17:37:13 -0400 Subject: [PATCH 06/29] adding message --- .../windows_file_share_discovery_with_powerview.yml | 6 +++--- detections/endpoint/windows_findstr_gpp_discovery.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_file_share_discovery_with_powerview.yml b/detections/endpoint/windows_file_share_discovery_with_powerview.yml index fa5b91a722..cf523acec6 100644 --- a/detections/endpoint/windows_file_share_discovery_with_powerview.yml +++ b/detections/endpoint/windows_file_share_discovery_with_powerview.yml @@ -9,10 +9,10 @@ description: The following analytic identifies the use of the Invoke-ShareFinder active domain computers and lists the active shares on each computer. Network file shares in Active Directory environments may contain sensitive information like backups, scripts, credentials, etc. Adversaries who have obtained a foothold in an AD network may leverage PowerView to identify secrets and leverage them for Privilege Escalation or Lateral Movement. -search: ' `powershell` EventCode=4104 (ScriptBlockText=Invoke-ShareFinder*) +search: '`powershell` EventCode=4104 (ScriptBlockText=Invoke-ShareFinder*) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - `windows_file_share_discovery_with_powerview_filter`' + | `windows_file_share_discovery_with_powerview_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.= @@ -40,7 +40,7 @@ tags: kill_chain_phases: - Exploitation - Actions on Objectives - message: UPDATE message + message: Invoke-ShareFinder commandlet was executed on $Computer$ mitre_attack_id: - T1135 nist: diff --git a/detections/endpoint/windows_findstr_gpp_discovery.yml b/detections/endpoint/windows_findstr_gpp_discovery.yml index 86fd6aeca6..97d3a090a7 100644 --- a/detections/endpoint/windows_findstr_gpp_discovery.yml +++ b/detections/endpoint/windows_findstr_gpp_discovery.yml @@ -10,7 +10,7 @@ description: The following analytic identifies the use of the findstr command em GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL. -search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=findstr.exe AND Processes.process=*sysvol* AND Processes.process=*cpassword*) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 9c1de0400e7c50e3a39d6564a2631dda4ba6c669 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 22 Mar 2023 17:37:08 -0400 Subject: [PATCH 07/29] new detection --- ...ocal_administrator_credential_stuffing.yml | 68 +++++++++++++++++++ ..._remote_endpoint_authentication_events.yml | 2 +- ...administrator_credential_stuffing.test.yml | 12 ++++ 3 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/windows_local_administrator_credential_stuffing.yml create mode 100644 tests/endpoint/windows_local_administrator_credential_stuffing.test.yml diff --git a/detections/endpoint/windows_local_administrator_credential_stuffing.yml b/detections/endpoint/windows_local_administrator_credential_stuffing.yml new file mode 100644 index 0000000000..e9c092d69c --- /dev/null +++ b/detections/endpoint/windows_local_administrator_credential_stuffing.yml @@ -0,0 +1,68 @@ +name: Windows Local Administrator Credential Stuffing +id: 09555511-aca6-484a-b6ab-72cd03d73c34 +version: 1 +date: '2023-03-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic +search: ' `wineventlog_security` EventCode=4625 OR EventCode=4624 Logon_Type=3 TargetUserName=Administrator + | bucket span=2m _time + | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName, EventCode + | where unique_targets > 30 + | `windows_local_administrator_credential_stuffing_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers as well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://attack.mitre.org/techniques/T1110/004/ +- https://attack.mitre.org/techniques/T1110/ +tags: + analytic_story: + - Active Directory Privilege Escalation + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.004/local_administrator_cred_stuffing/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Local Administrator credential stuffing attack coming from $IpAddress$ + mitre_attack_id: + - T1110 + - T1110.004 + nist: + - DE.CM + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + - name: IpAddress + type: Endpoint + role: + - Attacker + + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Logon_Type + - TargetUserName + - Computer + - IpAddress + risk_score: 56 + security_domain: endpoint diff --git a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml index 24ffd72893..dedec965db 100644 --- a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml +++ b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml @@ -25,7 +25,7 @@ search: ' `wineventlog_security` EventCode=4624 Logon_Type=3 Account_Name!="*$" | eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0) | `unusual_number_of_remote_endpoint_authentication_events_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - Windows Event Logs from domain controllers aas well as member servers and workstations. + Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. known_false_positives: An single endpoint authenticating to a large number of hosts diff --git a/tests/endpoint/windows_local_administrator_credential_stuffing.test.yml b/tests/endpoint/windows_local_administrator_credential_stuffing.test.yml new file mode 100644 index 0000000000..dbd64440f3 --- /dev/null +++ b/tests/endpoint/windows_local_administrator_credential_stuffing.test.yml @@ -0,0 +1,12 @@ +name: Windows Local Administrator Credential Stuffing Unit Test +tests: +- name: Windows Local Administrator Credential Stuffing + file: endpoint/windows_local_administrator_credential_stuffing.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.004/local_administrator_cred_stuffing/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file From e40298c2fdc5b8b67624946a86f40cbdebf759aa Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 23 Mar 2023 13:33:32 -0400 Subject: [PATCH 08/29] adding new detection --- ...s_ipc_share_accessed_on_multiple_hosts.yml | 62 +++++++++++++++++++ ...ocal_administrator_credential_stuffing.yml | 14 +++-- .../windows_powershell_gpp_discovery.yml | 2 +- ..._share_accessed_on_multiple_hosts.test.yml | 12 ++++ 4 files changed, 85 insertions(+), 5 deletions(-) create mode 100644 detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml create mode 100644 tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml diff --git a/detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml b/detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml new file mode 100644 index 0000000000..2b62c07a0e --- /dev/null +++ b/detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml @@ -0,0 +1,62 @@ +name: Windows IPC Share Accessed On Multiple Hosts +id: d92f2d95-05fb-48a7-910f-4d3d61ab8655 +version: 1 +date: '2023-03-23' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' `wineventlog_security` EventCode=5140 ShareName="\\\\*\\IPC$" + | bucket span=5m _time + | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, SubjectUserName, ShareName + | where unique_targets > 40 + | `windows_ipc_share_accessed_on_multiple_hosts_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://attack.mitre.org/techniques/T1135/ +tags: + analytic_story: + - Active Directory Privilege Escalation + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/ipc_share_accessed/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: $IpAddress$ accessed the IPC share on more than 40 endpoints in a timespan of 5 minutes. + mitre_attack_id: + - T1135 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + - name: IpAddress + type: Endpoint + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ShareName + - Computer + - IpAddress + - SubjectUserName + risk_score: 56 + security_domain: endpoint diff --git a/detections/endpoint/windows_local_administrator_credential_stuffing.yml b/detections/endpoint/windows_local_administrator_credential_stuffing.yml index e9c092d69c..c0c7a5c991 100644 --- a/detections/endpoint/windows_local_administrator_credential_stuffing.yml +++ b/detections/endpoint/windows_local_administrator_credential_stuffing.yml @@ -5,9 +5,12 @@ date: '2023-03-22' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic +description: The following analytic leverages events 4625 and 4624 to identify an endpoint using the builtin local Administrator account to authenticate to a large numbers of endpoints. Specifically, + the logic will trigger when an endpoints attempts to authenticate to more than 30 target computers within a 5 minute timespan. This behavior could + represent an adversary who has obtained access to credentials and is trying to validate if these credentials work on other hosts to escalate their privileges. + As environments differ across organizations, security teams should customize the thresholds of this detection. search: ' `wineventlog_security` EventCode=4625 OR EventCode=4624 Logon_Type=3 TargetUserName=Administrator - | bucket span=2m _time + | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName, EventCode | where unique_targets > 30 | `windows_local_administrator_credential_stuffing_filter`' @@ -15,10 +18,14 @@ how_to_implement: To successfully implement this search, you need to be ingestin Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +known_false_positives: Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed. references: - https://attack.mitre.org/techniques/T1110/004/ - https://attack.mitre.org/techniques/T1110/ +- https://www.blackhillsinfosec.com/wide-spread-local-admin-testing/ +- https://www.pentestpartners.com/security-blog/admin-password-re-use-dont-do-it/ +- https://www.praetorian.com/blog/microsofts-local-administrator-password-solution-laps/ +- https://wiki.porchetta.industries/smb-protocol/password-spraying tags: analytic_story: - Active Directory Privilege Escalation @@ -52,7 +59,6 @@ tags: type: Endpoint role: - Attacker - product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_powershell_gpp_discovery.yml b/detections/endpoint/windows_powershell_gpp_discovery.yml index 80ead31c17..757300a686 100644 --- a/detections/endpoint/windows_powershell_gpp_discovery.yml +++ b/detections/endpoint/windows_powershell_gpp_discovery.yml @@ -9,7 +9,7 @@ description: The following analytic identifies the use of the Get-GPPPassword Po GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL. -search: '`powershell` EventCode=4104 (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword) +search: ' `powershell` EventCode=4104 (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_gpp_discovery_filter`' diff --git a/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml b/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml new file mode 100644 index 0000000000..03f543afa5 --- /dev/null +++ b/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml @@ -0,0 +1,12 @@ +name: Windows IPC Share Accessed On Multiple Hosts Unit Test +tests: +- name: Windows IPC Share Accessed On Multiple Hosts + file: endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/ipc_share_accessed/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog From 6ca09dcfa2f8b1dc065363c6c97a7f2219f91f44 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 23 Mar 2023 15:59:50 -0400 Subject: [PATCH 09/29] adding another dataset for T1135 --- ...rapid_authentication_on_multiple_hosts.yml | 56 +++++++++++++++++++ ..._authentication_on_multiple_hosts.test.yml | 13 +++++ 2 files changed, 69 insertions(+) create mode 100644 detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml create mode 100644 tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml diff --git a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml new file mode 100644 index 0000000000..fb0693846c --- /dev/null +++ b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml @@ -0,0 +1,56 @@ +name: Windows Rapid Authentication on Multiple Hosts +id: 62606c77-d53d-4182-9371-b02cdbbbcef7 +version: 1 +date: '2023-03-23' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' EventCode=4624 LogonType=3 TargetUserName!="ANONYMOUS LOGON" TargetUserName!="*$" + | bucket span=5m _time + | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName, EventCode + | `windows_rapid_authentication_on_multiple_hosts_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- REFERENCE +tags: + analytic_story: + - Active Directory Privilege Escalation + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Update context + dataset: + - UPDATE_DATASET_URL + impact: 60 + kill_chain_phases: + - Exploitation + message: UPDATE message + mitre_attack_id: + - T1003.002 + nist: + - DE.CM + observable: + - name: UPDATE + type: UPDATE + role: + - UPDATE + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - + - + - + - + - + - + risk_score: 48 + security_domain: endpoint diff --git a/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml b/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml new file mode 100644 index 0000000000..64db2eb794 --- /dev/null +++ b/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml @@ -0,0 +1,13 @@ +name: Windows Rapid Authentication on Multiple Hosts Unit Test +tests: +- name: Windows Rapid Authentication on Multiple Hosts + file: endpoint/windows_rapid_authentication_on_multiple_hosts.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true From babff48e2d8615059d8abd9f254eed018bd1fdea Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 23 Mar 2023 16:10:22 -0400 Subject: [PATCH 10/29] updating detection --- ...rapid_authentication_on_multiple_hosts.yml | 39 ++++++++++++------- ..._authentication_on_multiple_hosts.test.yml | 9 ++--- 2 files changed, 28 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml index fb0693846c..59e80a14d8 100644 --- a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml +++ b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml @@ -8,12 +8,16 @@ datamodel: [] description: UPDATE_DESCRIPTION search: ' EventCode=4624 LogonType=3 TargetUserName!="ANONYMOUS LOGON" TargetUserName!="*$" | bucket span=5m _time - | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName, EventCode + | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName + | where unique_targets > 40 | `windows_rapid_authentication_on_multiple_hosts_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers as well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed. references: -- REFERENCE +- https://attack.mitre.org/techniques/T1135/ tags: analytic_story: - Active Directory Privilege Escalation @@ -24,9 +28,11 @@ tags: - CIS 16 confidence: 80 context: - - Update context + - Source:Endpoint + - Stage:Discovery + - Stage:Privilege Escalation dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/rapid_authentication_multiple_hosts/windows-security.log impact: 60 kill_chain_phases: - Exploitation @@ -36,21 +42,24 @@ tags: nist: - DE.CM observable: - - name: UPDATE - type: UPDATE + - name: ComputerName + type: Endpoint role: - - UPDATE + - Victim + - name: IpAddress + type: Endpoint + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - _time - - - - - - - - - - - - + - EventCode + - Logon_Type + - TargetUserName + - Computer + - IpAddress risk_score: 48 security_domain: endpoint diff --git a/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml b/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml index 64db2eb794..75ad70d461 100644 --- a/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml +++ b/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml @@ -6,8 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE - update_timestamp: true + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/rapid_authentication_multiple_hosts/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog From 557800a070489bd1c537d90267e59b77d11bd01d Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 27 Mar 2023 12:31:02 -0400 Subject: [PATCH 11/29] updating names --- ...ws_administrative_shares_accessed_on_multiple_hosts.yml} | 6 +++--- ...s_large_number_of_computer_service_tickets_requested.yml | 1 + .../windows_local_administrator_credential_stuffing.yml | 1 + ..._discovery.yml => windows_powersploit_gpp_discovery.yml} | 4 ++-- .../windows_rapid_authentication_on_multiple_hosts.yml | 3 ++- .../windows_ipc_share_accessed_on_multiple_hosts.test.yml | 6 +++--- ....test.yml => windows_powersploit_gpp_discovery.test.yml} | 6 +++--- .../windows_rapid_authentication_on_multiple_hosts.test.yml | 4 ++-- 8 files changed, 17 insertions(+), 14 deletions(-) rename detections/endpoint/{windows_ipc_share_accessed_on_multiple_hosts.yml => windows_administrative_shares_accessed_on_multiple_hosts.yml} (84%) rename detections/endpoint/{windows_powershell_gpp_discovery.yml => windows_powersploit_gpp_discovery.yml} (96%) rename tests/endpoint/{windows_powershell_gpp_discovery.test.yml => windows_powersploit_gpp_discovery.test.yml} (73%) diff --git a/detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml similarity index 84% rename from detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml rename to detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml index 2b62c07a0e..b4ca012384 100644 --- a/detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml +++ b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml @@ -1,4 +1,4 @@ -name: Windows IPC Share Accessed On Multiple Hosts +name: Windows Administrative Shares Accessed On Multiple Hosts id: d92f2d95-05fb-48a7-910f-4d3d61ab8655 version: 1 date: '2023-03-23' @@ -6,11 +6,11 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: [] description: UPDATE_DESCRIPTION -search: ' `wineventlog_security` EventCode=5140 ShareName="\\\\*\\IPC$" +search: ' `wineventlog_security` EventCode=5140 (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$") | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, SubjectUserName, ShareName | where unique_targets > 40 - | `windows_ipc_share_accessed_on_multiple_hosts_filter`' + | `windows_administrative_shares_accessed_on_multiple_hosts_filter`' how_to_implement: UPDATE_HOW_TO_IMPLEMENT known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES references: diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml index 2f8dc28fc6..f0a126a874 100644 --- a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Active Directory Privilege Escalation + - Active Directory Lateral Movement asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_local_administrator_credential_stuffing.yml b/detections/endpoint/windows_local_administrator_credential_stuffing.yml index c0c7a5c991..068aed38e0 100644 --- a/detections/endpoint/windows_local_administrator_credential_stuffing.yml +++ b/detections/endpoint/windows_local_administrator_credential_stuffing.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - Active Directory Privilege Escalation + - Active Directory Lateral Movement asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_powershell_gpp_discovery.yml b/detections/endpoint/windows_powersploit_gpp_discovery.yml similarity index 96% rename from detections/endpoint/windows_powershell_gpp_discovery.yml rename to detections/endpoint/windows_powersploit_gpp_discovery.yml index 757300a686..0920d85b9c 100644 --- a/detections/endpoint/windows_powershell_gpp_discovery.yml +++ b/detections/endpoint/windows_powersploit_gpp_discovery.yml @@ -1,4 +1,4 @@ -name: Windows PowerShell GPP Discovery +name: Windows PowerSploit GPP Discovery id: 0130a0df-83a1-4647-9011-841e950ff302 version: 1 date: '2023-03-16' @@ -12,7 +12,7 @@ description: The following analytic identifies the use of the Get-GPPPassword Po search: ' `powershell` EventCode=4104 (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_powershell_gpp_discovery_filter`' + | `windows_powersploit_gpp_discovery_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml index 59e80a14d8..bd34f9604c 100644 --- a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml +++ b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml @@ -1,4 +1,4 @@ -name: Windows Rapid Authentication on Multiple Hosts +name: Windows Rapid Authentication On Multiple Hosts id: 62606c77-d53d-4182-9371-b02cdbbbcef7 version: 1 date: '2023-03-23' @@ -21,6 +21,7 @@ references: tags: analytic_story: - Active Directory Privilege Escalation + - Active Directory Lateral Movement asset_type: Endpoint cis20: - CIS 3 diff --git a/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml b/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml index 03f543afa5..b8d0cf2ab6 100644 --- a/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml +++ b/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml @@ -1,7 +1,7 @@ -name: Windows IPC Share Accessed On Multiple Hosts Unit Test +name: Windows Administrative Shares Accessed On Multiple Hosts Unit Test tests: -- name: Windows IPC Share Accessed On Multiple Hosts - file: endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml +- name: Windows Administrative Shares Accessed On Multiple Hosts + file: endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/windows_powershell_gpp_discovery.test.yml b/tests/endpoint/windows_powersploit_gpp_discovery.test.yml similarity index 73% rename from tests/endpoint/windows_powershell_gpp_discovery.test.yml rename to tests/endpoint/windows_powersploit_gpp_discovery.test.yml index d3235611f6..3b915003f1 100644 --- a/tests/endpoint/windows_powershell_gpp_discovery.test.yml +++ b/tests/endpoint/windows_powersploit_gpp_discovery.test.yml @@ -1,7 +1,7 @@ -name: Windows PowerShell GPP Discovery Unit Test +name: Windows PowerSploit GPP Discovery Unit Test tests: -- name: Windows PowerShell GPP Discovery - file: endpoint/windows_powershell_gpp_discovery.yml +- name: Windows PowerSploit GPP Discovery + file: endpoint/windows_powersploit_gpp_discovery.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml b/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml index 75ad70d461..b6a499035f 100644 --- a/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml +++ b/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml @@ -1,6 +1,6 @@ -name: Windows Rapid Authentication on Multiple Hosts Unit Test +name: Windows Rapid Authentication On Multiple Hosts Unit Test tests: -- name: Windows Rapid Authentication on Multiple Hosts +- name: Windows Rapid Authentication On Multiple Hosts file: endpoint/windows_rapid_authentication_on_multiple_hosts.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h From 5d52a9cc7a55c3301a6c2f6591905fb21bc78af0 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 27 Mar 2023 12:45:59 -0400 Subject: [PATCH 12/29] fixing name --- ...ows_administrative_shares_accessed_on_multiple_hosts.test.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/endpoint/{windows_ipc_share_accessed_on_multiple_hosts.test.yml => windows_administrative_shares_accessed_on_multiple_hosts.test.yml} (100%) diff --git a/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml b/tests/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.test.yml similarity index 100% rename from tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml rename to tests/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.test.yml From 70fc7ff58e7250010fd8150f7fc4ef4553c29e9f Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 27 Mar 2023 15:26:28 -0400 Subject: [PATCH 13/29] adding detection --- ...tive_shares_accessed_on_multiple_hosts.yml | 4 +- ...ial_privileged_logon_on_multiple_hosts.yml | 65 +++++++++++++++++++ ...rivileged_logon_on_multiple_hosts.test.yml | 12 ++++ 3 files changed, 79 insertions(+), 2 deletions(-) create mode 100644 detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml create mode 100644 tests/endpoint/windows_special_privileged_logon_on_multiple_hosts.test.yml diff --git a/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml index b4ca012384..f14e96e765 100644 --- a/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml +++ b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml @@ -6,9 +6,9 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: [] description: UPDATE_DESCRIPTION -search: ' `wineventlog_security` EventCode=5140 (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$") +search: ' `wineventlog_security` EventCode=5140 OR EventCode=5145 (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$") | bucket span=5m _time - | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, SubjectUserName, ShareName + | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(ShareName) as shares by _time, IpAddress, SubjectUserName, EventCode | where unique_targets > 40 | `windows_administrative_shares_accessed_on_multiple_hosts_filter`' how_to_implement: UPDATE_HOW_TO_IMPLEMENT diff --git a/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml b/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml new file mode 100644 index 0000000000..807a5cd19e --- /dev/null +++ b/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml @@ -0,0 +1,65 @@ +name: Windows Special Privileged Logon On Multiple Hosts +id: 4c461f5a-c2cc-4e86-b132-c262fc9edca7 +version: 1 +date: '2023-03-27' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' `wineventlog_security` EventCode=4672 AND NOT(Caller_User_Name IN ("DWM-1","DWM-2","DWM-3","LOCAL SERVICE","NETWORK SERVICE","SYSTEM","*$")) + | bucket span=5m _time + | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(PrivilegeList) as privileges by _time, Caller_User_Name + | where unique_targets > 40 + | `windows_special_privileged_logon_on_multiple_hosts_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- REFERENCE +tags: + analytic_story: + - Active Directory Privilege Escalation + - Active Directory Lateral Movement + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/special_logon_on_mulitple_hosts/windows-security.log + impact: 80 + kill_chain_phases: + - Reconnaissance + - Exploitation + message: UPDATE message + mitre_attack_id: + - T1087 + - T1021.002 + - T1135 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: Caller_User_Name + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Caller_User_Name + - Computer + - PrivilegeList + risk_score: 64 + security_domain: endpoint diff --git a/tests/endpoint/windows_special_privileged_logon_on_multiple_hosts.test.yml b/tests/endpoint/windows_special_privileged_logon_on_multiple_hosts.test.yml new file mode 100644 index 0000000000..a922c7b9ca --- /dev/null +++ b/tests/endpoint/windows_special_privileged_logon_on_multiple_hosts.test.yml @@ -0,0 +1,12 @@ +name: Windows Special Privileged Logon On Multiple Hosts Unit Test +tests: +- name: Windows Special Privileged Logon On Multiple Hosts + file: endpoint/windows_special_privileged_logon_on_multiple_hosts.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/special_logon_on_mulitple_hosts/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog From 9f0dca11e681b758991406fe69932634f06f5852 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 28 Mar 2023 14:22:16 -0400 Subject: [PATCH 14/29] adding new detection --- .../windows_group_policy_object_created.yml | 70 +++++++++++++++++++ ...ndows_group_policy_object_created.test.yml | 12 ++++ 2 files changed, 82 insertions(+) create mode 100644 detections/endpoint/windows_group_policy_object_created.yml create mode 100644 tests/endpoint/windows_group_policy_object_created.test.yml diff --git a/detections/endpoint/windows_group_policy_object_created.yml b/detections/endpoint/windows_group_policy_object_created.yml new file mode 100644 index 0000000000..a37ee8c7a2 --- /dev/null +++ b/detections/endpoint/windows_group_policy_object_created.yml @@ -0,0 +1,70 @@ +name: Windows Group Policy Object Created +id: 23add2a8-ea22-4fd4-8bc0-8c0b822373a1 +version: 1 +date: '2023-03-27' +author: Mauricio Velazco +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' `wineventlog_security` EventCode=5137 OR (EventCode=5136 AttributeValue!="New Group Policy Object" AND (AttributeLDAPDisplayName=displayName OR AttributeLDAPDisplayName=gPCFileSysPath) ) ObjectClass=groupPolicyContainer + | stats values(AttributeValue) as details values(SubjectUserSid) as User values(ObjectDN) as ObjectDN by ObjectGUID Computer + | eval GPO_Name = mvindex(details, 0) + | eval GPO_Path = mvindex(details, 1) + | fields - details + | `windows_group_policy_object_created_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://attack.mitre.org/techniques/T1484/ +- https://attack.mitre.org/techniques/T1484/001 +- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/ +- https://adsecurity.org/?p=2716 +tags: + analytic_story: + - Active Directory Privilege Escalation + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-security.log + impact: 80 + kill_chain_phases: + - Exploitation + - Installation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1484 + - T1484.001 + - T1078.002 + nist: + - DE.CM + observable: + - name: User + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - AttributeValue + - AttributeLDAPDisplayName + - ObjectClass + - SubjectUserSid + - ObjectDN + - ObjectGUID + - Computer + risk_score: 40 + security_domain: endpoint diff --git a/tests/endpoint/windows_group_policy_object_created.test.yml b/tests/endpoint/windows_group_policy_object_created.test.yml new file mode 100644 index 0000000000..75c9427fa8 --- /dev/null +++ b/tests/endpoint/windows_group_policy_object_created.test.yml @@ -0,0 +1,12 @@ +name: Windows Group Policy Object Created Unit Test +tests: +- name: Windows Group Policy Object Created + file: endpoint/windows_group_policy_object_created.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file From 089a7fa5a2065cd3999019a1ed9c310b356e3f5b Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 29 Mar 2023 12:59:24 -0400 Subject: [PATCH 15/29] adding new T1484 detection --- ...ows_default_domain_policy_gpo_modified.yml | 71 +++++++++++++++++++ ...efault_domain_policy_gpo_modified.test.yml | 12 ++++ 2 files changed, 83 insertions(+) create mode 100644 detections/endpoint/windows_default_domain_policy_gpo_modified.yml create mode 100644 tests/endpoint/windows_default_domain_policy_gpo_modified.test.yml diff --git a/detections/endpoint/windows_default_domain_policy_gpo_modified.yml b/detections/endpoint/windows_default_domain_policy_gpo_modified.yml new file mode 100644 index 0000000000..4b8323d36c --- /dev/null +++ b/detections/endpoint/windows_default_domain_policy_gpo_modified.yml @@ -0,0 +1,71 @@ +name: Windows Default Domain Policy GPO Modified +id: fe6a6cc4-9e0d-4d66-bcf4-2c7f44860876 +version: 1 +date: '2023-03-28' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=versionNumber ObjectDN="CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=*" + | stats min(_time) as firstTime max(_time) as lastTime by ObjectDN SubjectUserSid AttributeValue Computer DSName + | rename AttributeValue as versionNumber + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_default_domain_policy_gpo_modified_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://attack.mitre.org/techniques/T1484/ +- https://attack.mitre.org/techniques/T1484/001 +- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/ +- https://adsecurity.org/?p=2716 +tags: + analytic_story: + - Active Directory Privilege Escalation + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log + impact: 100 + kill_chain_phases: + - Installation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1484 + - T1484.001 + nist: + - DE.CM + observable: + - name: SubjectUserSid + type: User + role: + - Attacker + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - EventCode + - ObjectClass + - AttributeLDAPDisplayName + - ObjectDN + - Computer + - DSName + - AttributeValue + - SubjectUserSid + risk_score: 50 + security_domain: endpoint diff --git a/tests/endpoint/windows_default_domain_policy_gpo_modified.test.yml b/tests/endpoint/windows_default_domain_policy_gpo_modified.test.yml new file mode 100644 index 0000000000..fdf4118af4 --- /dev/null +++ b/tests/endpoint/windows_default_domain_policy_gpo_modified.test.yml @@ -0,0 +1,12 @@ +name: Windows Default Domain Policy GPO Modified Unit Test +tests: +- name: Windows Default Domain Policy GPO Modified + file: endpoint/windows_default_domain_policy_gpo_modified.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog From 406a046c400b712aced5f1a0074a7a7e96aeee85 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 29 Mar 2023 16:12:53 -0400 Subject: [PATCH 16/29] renaming and adding new detection --- ...n_default_group_policy_object_modified.yml | 64 +++++++++++++++++++ ..._default_group_policy_object_modified.yml} | 6 +- macros/admon.yml | 4 ++ ...ault_group_policy_object_modified.test.yml | 12 ++++ ...ult_group_policy_object_modified.test.yml} | 6 +- 5 files changed, 86 insertions(+), 6 deletions(-) create mode 100644 detections/endpoint/windows_admon_default_group_policy_object_modified.yml rename detections/endpoint/{windows_default_domain_policy_gpo_modified.yml => windows_default_group_policy_object_modified.yml} (81%) create mode 100644 macros/admon.yml create mode 100644 tests/endpoint/windows_admon_default_group_policy_object_modified.test.yml rename tests/endpoint/{windows_default_domain_policy_gpo_modified.test.yml => windows_default_group_policy_object_modified.test.yml} (68%) diff --git a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml new file mode 100644 index 0000000000..7416700178 --- /dev/null +++ b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml @@ -0,0 +1,64 @@ +name: Windows Admon Default Group Policy Object Modified +id: 83458004-db60-4170-857d-8572f16f070b +version: 1 +date: '2023-03-29' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" (displayName="Default Domain Policy" OR displayName="Default Domain Controllers Policy") + | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_admon_default_group_policy_object_modified_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://attack.mitre.org/techniques/T1484/ +- https://attack.mitre.org/techniques/T1484/001 +- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/ +- https://adsecurity.org/?p=2716 +tags: + analytic_story: + - Active Directory Privilege Escalation + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log + impact: 100 + kill_chain_phases: + - Installation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1484 + - T1484.001 + nist: + - DE.CM + observable: + - name: dcName + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - admonEventType + - objectCategory + - displayName + - gPCFileSysPath + - dcName + risk_score: 50 + security_domain: endpoint diff --git a/detections/endpoint/windows_default_domain_policy_gpo_modified.yml b/detections/endpoint/windows_default_group_policy_object_modified.yml similarity index 81% rename from detections/endpoint/windows_default_domain_policy_gpo_modified.yml rename to detections/endpoint/windows_default_group_policy_object_modified.yml index 4b8323d36c..96eb6a1245 100644 --- a/detections/endpoint/windows_default_domain_policy_gpo_modified.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified.yml @@ -1,4 +1,4 @@ -name: Windows Default Domain Policy GPO Modified +name: Windows Default Group Policy Object Modified id: fe6a6cc4-9e0d-4d66-bcf4-2c7f44860876 version: 1 date: '2023-03-28' @@ -6,12 +6,12 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: [] description: UPDATE_DESCRIPTION -search: ' EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=versionNumber ObjectDN="CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=*" +search: ' `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=versionNumber (ObjectDN="CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=*" OR ObjectDN="CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=POLICIES,CN=SYSTEM,DC=*") | stats min(_time) as firstTime max(_time) as lastTime by ObjectDN SubjectUserSid AttributeValue Computer DSName | rename AttributeValue as versionNumber | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_default_domain_policy_gpo_modified_filter`' + | `windows_default_group_policy_object_modified_filter`' how_to_implement: UPDATE_HOW_TO_IMPLEMENT known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES references: diff --git a/macros/admon.yml b/macros/admon.yml new file mode 100644 index 0000000000..debd763e8b --- /dev/null +++ b/macros/admon.yml @@ -0,0 +1,4 @@ +definition: source=ActiveDirectory +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: admon diff --git a/tests/endpoint/windows_admon_default_group_policy_object_modified.test.yml b/tests/endpoint/windows_admon_default_group_policy_object_modified.test.yml new file mode 100644 index 0000000000..ae2506ff25 --- /dev/null +++ b/tests/endpoint/windows_admon_default_group_policy_object_modified.test.yml @@ -0,0 +1,12 @@ +name: Windows Admon Default Group Policy Object Modified Unit Test +tests: +- name: Windows Admon Default Group Policy Object Modified + file: endpoint/windows_admon_default_group_policy_object_modified.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log + source: ActiveDirectory + sourcetype: ActiveDirectory \ No newline at end of file diff --git a/tests/endpoint/windows_default_domain_policy_gpo_modified.test.yml b/tests/endpoint/windows_default_group_policy_object_modified.test.yml similarity index 68% rename from tests/endpoint/windows_default_domain_policy_gpo_modified.test.yml rename to tests/endpoint/windows_default_group_policy_object_modified.test.yml index fdf4118af4..0e29862b82 100644 --- a/tests/endpoint/windows_default_domain_policy_gpo_modified.test.yml +++ b/tests/endpoint/windows_default_group_policy_object_modified.test.yml @@ -1,7 +1,7 @@ -name: Windows Default Domain Policy GPO Modified Unit Test +name: Windows Default Group Policy Object Modified Unit Test tests: -- name: Windows Default Domain Policy GPO Modified - file: endpoint/windows_default_domain_policy_gpo_modified.yml +- name: Windows Default Group Policy Object Modified + file: endpoint/windows_default_group_policy_object_modified.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From d4bb7bb3970409b423f5a7a7d6a2d96071d29a7b Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 6 Apr 2023 13:41:42 -0400 Subject: [PATCH 17/29] adding new detection. --- ...dows_admon_group_policy_object_created.yml | 64 +++++++++++++++++++ ...admon_group_policy_object_created.test.yml | 12 ++++ 2 files changed, 76 insertions(+) create mode 100644 detections/endpoint/windows_admon_group_policy_object_created.yml create mode 100644 tests/endpoint/windows_admon_group_policy_object_created.test.yml diff --git a/detections/endpoint/windows_admon_group_policy_object_created.yml b/detections/endpoint/windows_admon_group_policy_object_created.yml new file mode 100644 index 0000000000..634bd5678c --- /dev/null +++ b/detections/endpoint/windows_admon_group_policy_object_created.yml @@ -0,0 +1,64 @@ +name: Windows Admon Group Policy Object Created +id: 69201633-30d9-48ef-b1b6-e680805f0582 +version: 1 +date: '2023-04-06' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" versionNumber=0 displayName!="New Group Policy Object" + | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_admon_group_policy_object_created_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://attack.mitre.org/techniques/T1484/ +- https://attack.mitre.org/techniques/T1484/001 +- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/ +- https://adsecurity.org/?p=2716 +tags: + analytic_story: + - Active Directory Privilege Escalation + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-security.log + impact: 100 + kill_chain_phases: + - Installation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1484 + - T1484.001 + nist: + - DE.CM + observable: + - name: dcName + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - admonEventType + - objectCategory + - displayName + - gPCFileSysPath + - dcName + risk_score: 50 + security_domain: endpoint diff --git a/tests/endpoint/windows_admon_group_policy_object_created.test.yml b/tests/endpoint/windows_admon_group_policy_object_created.test.yml new file mode 100644 index 0000000000..2fb0c5723b --- /dev/null +++ b/tests/endpoint/windows_admon_group_policy_object_created.test.yml @@ -0,0 +1,12 @@ +name: Windows Admon Group Policy Object Created Unit Test +tests: +- name: Windows Admon Group Policy Object Created + file: endpoint/windows_admon_group_policy_object_created.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-security.log + source: ActiveDirectory + sourcetype: ActiveDirectory \ No newline at end of file From 6d6e36333d45927998a5eca1a5fbbccedf7c888d Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 6 Apr 2023 17:43:38 -0400 Subject: [PATCH 18/29] new detection --- .../windows_dnsadmins_new_member_added.yml | 61 +++++++++++++++++++ ...indows_dnsadmins_new_member_added.test.yml | 13 ++++ 2 files changed, 74 insertions(+) create mode 100644 detections/endpoint/windows_dnsadmins_new_member_added.yml create mode 100644 tests/endpoint/windows_dnsadmins_new_member_added.test.yml diff --git a/detections/endpoint/windows_dnsadmins_new_member_added.yml b/detections/endpoint/windows_dnsadmins_new_member_added.yml new file mode 100644 index 0000000000..17f8fd93a3 --- /dev/null +++ b/detections/endpoint/windows_dnsadmins_new_member_added.yml @@ -0,0 +1,61 @@ +name: Windows DnsAdmins New Member Added +id: 27e600aa-77f8-4614-bc80-2662a67e2f48 +version: 1 +date: '2023-04-06' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' `wineventlog_security` EventCode=4732 TargetUserName=DnsAdmins + | stats min(_time) as firstTime max(_time) as lastTime values(SubjectUserName) values(Computer) by MemberSid, TargetUserName + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_dnsadmins_new_member_added_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://attack.mitre.org/techniques/T1098/ +- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/from-dnsadmins-to-system-to-domain-compromise +- https://www.hackingarticles.in/windows-privilege-escalation-dnsadmins-to-domainadmin/ +tags: + analytic_story: + - Active Directory Privilege Escalation + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/dnsadmins_member_added/windows-security.log + impact: 80 + kill_chain_phases: + - Installation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1098 + nist: + - DE.CM + observable: + - name: SubjectUserName + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - TargetUserName + - SubjectUserName + - Computer + - MemberSid + - TargetUserName + risk_score: 40 + security_domain: endpoint diff --git a/tests/endpoint/windows_dnsadmins_new_member_added.test.yml b/tests/endpoint/windows_dnsadmins_new_member_added.test.yml new file mode 100644 index 0000000000..592f1045be --- /dev/null +++ b/tests/endpoint/windows_dnsadmins_new_member_added.test.yml @@ -0,0 +1,13 @@ +name: Windows DnsAdmins New Member Added Unit Test +tests: +- name: Windows DnsAdmins New Member Added + file: endpoint/windows_dnsadmins_new_member_added.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/dnsadmins_member_added/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + update_timestamp: true From aa48a5d5e5439bda2422107b62e9cf030384f8f3 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 20 Apr 2023 16:30:36 -0400 Subject: [PATCH 19/29] tagging existing detections --- .../kerberos_service_ticket_request_using_rc4_encryption.yml | 1 + detections/endpoint/rubeus_command_line_parameters.yml | 1 + .../endpoint/serviceprincipalnames_discovery_with_powershell.yml | 1 + .../endpoint/serviceprincipalnames_discovery_with_setspn.yml | 1 + 4 files changed, 4 insertions(+) diff --git a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml index 514953124e..5931637129 100644 --- a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml +++ b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Active Directory Kerberos Attacks + - Active Directory Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.001/impacket/windows-security.log kill_chain_phases: diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index 730da1784d..f6a81152bd 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -40,6 +40,7 @@ references: tags: analytic_story: - Active Directory Kerberos Attacks + - Active Directory Privilege Escalation asset_type: Endpoint confidence: 60 context: diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml index ad004ac7c1..62f374d9f1 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml @@ -50,6 +50,7 @@ tags: - Active Directory Discovery - Active Directory Kerberos Attacks - Malicious PowerShell + - Active Directory Privilege Escalation automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index 05e43bedb0..ef78230bee 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -57,6 +57,7 @@ tags: analytic_story: - Active Directory Discovery - Active Directory Kerberos Attacks + - Active Directory Privilege Escalation automated_detection_testing: passed confidence: 100 context: From 71e3a9905f6e1fd9343f26394b3f08b2346799d9 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 20 Apr 2023 16:56:25 -0400 Subject: [PATCH 20/29] tagging existing detections --- detections/endpoint/suspicious_computer_account_name_change.yml | 1 + .../endpoint/suspicious_kerberos_service_ticket_request.yml | 1 + .../endpoint/suspicious_ticket_granting_ticket_request.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml index a901cc3aa8..aafbad4254 100644 --- a/detections/endpoint/suspicious_computer_account_name_change.yml +++ b/detections/endpoint/suspicious_computer_account_name_change.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - sAMAccountName Spoofing and Domain Controller Impersonation + - Active Directory Privilege Escalation automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml index ada4e2128a..26cbd52672 100644 --- a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml +++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml @@ -34,6 +34,7 @@ tags: analytic_story: - sAMAccountName Spoofing and Domain Controller Impersonation - Active Directory Kerberos Attacks + - Active Directory Privilege Escalation automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml index 5d1c20f8f1..9554c92cca 100644 --- a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml +++ b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml @@ -35,6 +35,7 @@ tags: analytic_story: - sAMAccountName Spoofing and Domain Controller Impersonation - Active Directory Kerberos Attacks + - Active Directory Privilege Escalation automated_detection_testing: passed confidence: 60 context: From e085d36118f3c4bdcf819c789d827c08e308a375 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 21 Apr 2023 12:46:08 -0400 Subject: [PATCH 21/29] adding new detection --- ...iew_ad_access_control_list_enumeration.yml | 63 +++++++++++++++++++ ...d_access_control_list_enumeration.test.yml | 13 ++++ 2 files changed, 76 insertions(+) create mode 100644 detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml create mode 100644 tests/endpoint/windows_powerview_ad_access_control_list_enumeration.test.yml diff --git a/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml b/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml new file mode 100644 index 0000000000..22b6bf3596 --- /dev/null +++ b/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml @@ -0,0 +1,63 @@ +name: Windows PowerView AD Access Control List Enumeration +id: 39405650-c364-4e1e-a740-32a63ef042a6 +version: 1 +date: '2023-04-20' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' `powershell` EventCode=4104 (ScriptBlockText=*get-objectacl* OR ScriptBlockText=*Get-DomainObjectAcl* ) + | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powerview_ad_access_control_list_enumeration_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.= +known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed. +references: +- https://attack.mitre.org/techniques/T1078/002/ +- https://medium.com/r3d-buck3t/enumerating-access-controls-in-active-directory-c06e2efa8b89 +- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainObjectAcl/ +tags: + analytic_story: + - Active Directory Discovery + - Active Directory Privilege Escalation + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/windows-powershell.log + impact: 40 + kill_chain_phases: + - Reconnaissance + message: PowerView AD acccess control list enumeration detected on $Computer$ + mitre_attack_id: + - T1078.002 + - T1069 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ScriptBlockText + - Opcode + - UserID + risk_score: 20 + security_domain: endpoint diff --git a/tests/endpoint/windows_powerview_ad_access_control_list_enumeration.test.yml b/tests/endpoint/windows_powerview_ad_access_control_list_enumeration.test.yml new file mode 100644 index 0000000000..c8a4003a23 --- /dev/null +++ b/tests/endpoint/windows_powerview_ad_access_control_list_enumeration.test.yml @@ -0,0 +1,13 @@ +name: Windows PowerView AD Access Control List Enumeration Unit Test +tests: +- name: Windows PowerView AD Access Control List Enumeration + file: endpoint/windows_powerview_ad_access_control_list_enumeration.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/windows-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog + update_timestamp: true From e3139a9c90940df4564489b420b2cab28eb8a6f5 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 21 Apr 2023 18:42:36 -0400 Subject: [PATCH 22/29] updated descriptions and metadata --- ...ative_shares_accessed_on_multiple_hosts.yml | 18 ++++++++++++++---- ...on_default_group_policy_object_modified.yml | 11 ++++++++--- ...ndows_admon_group_policy_object_created.yml | 11 ++++++++--- ...ws_default_group_policy_object_modified.yml | 11 ++++++++--- .../windows_dnsadmins_new_member_added.yml | 10 +++++++--- .../windows_group_policy_object_created.yml | 13 ++++++++++--- ...r_of_computer_service_tickets_requested.yml | 16 ++++++++++------ ...local_administrator_credential_stuffing.yml | 4 ++-- ...view_ad_access_control_list_enumeration.yml | 6 +++++- ..._rapid_authentication_on_multiple_hosts.yml | 9 +++++++-- ...cial_privileged_logon_on_multiple_hosts.yml | 18 +++++++++++++----- 11 files changed, 92 insertions(+), 35 deletions(-) diff --git a/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml index f14e96e765..e1682161b5 100644 --- a/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml +++ b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml @@ -5,19 +5,29 @@ date: '2023-03-23' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION +description: The following analytic leverages Event IDs 5140 or 5145 to identify a source computer accessing windows administrative shares (C$, Admin$ and IPC$ ) across a large number + remote endpoints. Specifically, the logic will trigger when a source endpoint accesses administrative shares across 30 or more target computers within a 5 minute timespan. This behavior could + represent an adversary who is enumerating network shares across an Active Directory environment in the search for sensitive files, a common technique leveraged by red teamers and threat actors. + As environments differ across organizations, security teams should customize the thresholds of this detection as needed. search: ' `wineventlog_security` EventCode=5140 OR EventCode=5145 (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$") | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(ShareName) as shares by _time, IpAddress, SubjectUserName, EventCode - | where unique_targets > 40 + | where unique_targets > 30 | `windows_administrative_shares_accessed_on_multiple_hosts_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, you need to be ingesting file share events. + The Advanced Security Audit policy setting `Audit Detailed File Share` or `Audit File Share` within `Object Access` need to be enabled. +known_false_positives: An single endpoint accessing windows administrative shares across a large number of endpoints is not common behavior. + Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems. references: - https://attack.mitre.org/techniques/T1135/ +- https://en.wikipedia.org/wiki/Administrative_share +- https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5140 +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145 tags: analytic_story: - Active Directory Privilege Escalation + - Active Directory Lateral Movement asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml index 7416700178..8a1715f39a 100644 --- a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml @@ -5,19 +5,24 @@ date: '2023-03-29' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION +description: The following analytic leverages Splunks Admon to identify the modification of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain + two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. + The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group + policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs. search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" (displayName="Default Domain Policy" OR displayName="Default Domain Controllers Policy") | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admon_default_group_policy_object_modified_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here + https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory +known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed. references: - https://attack.mitre.org/techniques/T1484/ - https://attack.mitre.org/techniques/T1484/001 - https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/ - https://adsecurity.org/?p=2716 +- https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory tags: analytic_story: - Active Directory Privilege Escalation diff --git a/detections/endpoint/windows_admon_group_policy_object_created.yml b/detections/endpoint/windows_admon_group_policy_object_created.yml index 634bd5678c..a432ffcbf9 100644 --- a/detections/endpoint/windows_admon_group_policy_object_created.yml +++ b/detections/endpoint/windows_admon_group_policy_object_created.yml @@ -5,19 +5,24 @@ date: '2023-04-06' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION +description: The following analytic leverages Splunks Admon to identify the creation of a new Group Policy Object. With GPOs, system administrators can manage and configure + applications, software operations, and user settings throughout an entire organization. GPOs can be abused and leveraged by adversaries to escalate privileges or + deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network. + Security teams should monitor the creation of new Group Policy Objects. search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" versionNumber=0 displayName!="New Group Policy Object" | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admon_group_policy_object_created_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here + https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory +known_false_positives: Group Policy Objects are created as part of regular administrative operations, filter as needed. references: - https://attack.mitre.org/techniques/T1484/ - https://attack.mitre.org/techniques/T1484/001 - https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/ - https://adsecurity.org/?p=2716 +- https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory tags: analytic_story: - Active Directory Privilege Escalation diff --git a/detections/endpoint/windows_default_group_policy_object_modified.yml b/detections/endpoint/windows_default_group_policy_object_modified.yml index 96eb6a1245..aba6fd7e8c 100644 --- a/detections/endpoint/windows_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified.yml @@ -5,15 +5,20 @@ date: '2023-03-28' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION +description: The following analytic leverages Event ID 5136 to identify the modification of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain + two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. + The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group + policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs. search: ' `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=versionNumber (ObjectDN="CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=*" OR ObjectDN="CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=POLICIES,CN=SYSTEM,DC=*") | stats min(_time) as firstTime max(_time) as lastTime by ObjectDN SubjectUserSid AttributeValue Computer DSName | rename AttributeValue as versionNumber | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_group_policy_object_modified_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled. + Furthermore, the appropriate system access control lists (SACL) need to be created as the used events are not logged by default. + A good guide to accomplish this can be found here https://jgspiers.com/audit-group-policy-changes/. +known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed. references: - https://attack.mitre.org/techniques/T1484/ - https://attack.mitre.org/techniques/T1484/001 diff --git a/detections/endpoint/windows_dnsadmins_new_member_added.yml b/detections/endpoint/windows_dnsadmins_new_member_added.yml index 17f8fd93a3..cba07ff4b1 100644 --- a/detections/endpoint/windows_dnsadmins_new_member_added.yml +++ b/detections/endpoint/windows_dnsadmins_new_member_added.yml @@ -5,18 +5,22 @@ date: '2023-04-06' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION +description: The following analytic leverages Event ID 4732 to identify the addition of a new member to the DnsAdmins group within Active Directory. . Members of the DnsAdmin group can manage + the DNS service which most of the times runs on the Domain Controller. By abusing legitimate DNS management functionality, a member of the DnsAdmins group can escalate privileges by + executing malicious code on a Domain Controller as SYSTEM. Security teams should monitor the modification of the DnsAdmins group and validate the changes are legitimate. search: ' `wineventlog_security` EventCode=4732 TargetUserName=DnsAdmins | stats min(_time) as firstTime max(_time) as lastTime values(SubjectUserName) values(Computer) by MemberSid, TargetUserName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dnsadmins_new_member_added_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, Domain Controller events need to be ingested. The Advanced Security Audit policy setting `Audit Security Group Management` + within `Account Management` needs to be enabled. +known_false_positives: New members can be added to the DnsAdmins group as part of legitimate administrative tasks. Filter as needed. references: - https://attack.mitre.org/techniques/T1098/ - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/from-dnsadmins-to-system-to-domain-compromise - https://www.hackingarticles.in/windows-privilege-escalation-dnsadmins-to-domainadmin/ +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732 tags: analytic_story: - Active Directory Privilege Escalation diff --git a/detections/endpoint/windows_group_policy_object_created.yml b/detections/endpoint/windows_group_policy_object_created.yml index a37ee8c7a2..00ae701cff 100644 --- a/detections/endpoint/windows_group_policy_object_created.yml +++ b/detections/endpoint/windows_group_policy_object_created.yml @@ -5,20 +5,27 @@ date: '2023-03-27' author: Mauricio Velazco type: TTP datamodel: [] -description: UPDATE_DESCRIPTION +description: The following analytic leverages Event IDs 5136 and 51137 to identify the creation of a new Group Policy Object. With GPOs, system administrators can manage and configure + applications, software operations, and user settings throughout an entire organization. GPOs can be abused and leveraged by adversaries to escalate privileges or + deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network. + Security teams should monitor the creation of new Group Policy Objects. search: ' `wineventlog_security` EventCode=5137 OR (EventCode=5136 AttributeValue!="New Group Policy Object" AND (AttributeLDAPDisplayName=displayName OR AttributeLDAPDisplayName=gPCFileSysPath) ) ObjectClass=groupPolicyContainer | stats values(AttributeValue) as details values(SubjectUserSid) as User values(ObjectDN) as ObjectDN by ObjectGUID Computer | eval GPO_Name = mvindex(details, 0) | eval GPO_Path = mvindex(details, 1) | fields - details | `windows_group_policy_object_created_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled. + Furthermore, the appropriate system access control lists (SACL) need to be created as the used events are not logged by default. + A good guide to accomplish this can be found here https://jgspiers.com/audit-group-policy-changes/. +known_false_positives: Group Policy Objects are created as part of regular administrative operations, filter as needed. references: - https://attack.mitre.org/techniques/T1484/ - https://attack.mitre.org/techniques/T1484/001 - https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/ - https://adsecurity.org/?p=2716 +- https://www.bleepingcomputer.com/news/security/lockbit-ransomware-now-encrypts-windows-domains-using-group-policies/ +- https://www.varonis.com/blog/group-policy-objects tags: analytic_story: - Active Directory Privilege Escalation diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml index f0a126a874..b9934efdf2 100644 --- a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml @@ -6,25 +6,29 @@ author: Mauricio Velazco, Splunk type: Anomaly datamodel: [] description: The following analytic leverages Event ID 4769, `A Kerberos - service ticket was requested`, to identify a large number of computer service + service ticket was requested`, to identify more than 30 computer service ticket requests from one source. When a domain joined endpoint connects to other remote - endpoint, it first will request a Kerberos Ticket with the computer name as the + endpoint, it will first request a Kerberos Service Ticket with the computer name as the Service Name. A user requesting a large number of computer service tickets for different endpoints could represent malicious behavior like lateral movement, malware staging, reconnaissance, etc.\ Active Directory environments can be very different depending on the organization. Users should test this detection and customize - the arbitrary threshold when needed. + the arbitrary threshold as needed. search: ' `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$" | bucket span=2m _time | stats dc(ServiceName) AS unique_targets values(ServiceName) as host_targets by _time, IpAddress, TargetUserName - | where unique_targets > 4 + | where unique_targets > 30 | `windows_large_number_of_computer_service_tickets_requested_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. + The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: An single endpoint requesting a large number of kerberos service tickets is not common behavior. + Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems. references: - https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ +- https://attack.mitre.org/techniques/T1135/ +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769 tags: analytic_story: - Active Directory Privilege Escalation diff --git a/detections/endpoint/windows_local_administrator_credential_stuffing.yml b/detections/endpoint/windows_local_administrator_credential_stuffing.yml index 068aed38e0..be1d47173d 100644 --- a/detections/endpoint/windows_local_administrator_credential_stuffing.yml +++ b/detections/endpoint/windows_local_administrator_credential_stuffing.yml @@ -7,8 +7,8 @@ type: TTP datamodel: [] description: The following analytic leverages events 4625 and 4624 to identify an endpoint using the builtin local Administrator account to authenticate to a large numbers of endpoints. Specifically, the logic will trigger when an endpoints attempts to authenticate to more than 30 target computers within a 5 minute timespan. This behavior could - represent an adversary who has obtained access to credentials and is trying to validate if these credentials work on other hosts to escalate their privileges. - As environments differ across organizations, security teams should customize the thresholds of this detection. + represent an adversary who has obtained access to local credentials and is trying to validate if these credentials work on other hosts to escalate their privileges. + As environments differ across organizations, security teams should customize the thresholds of this detection as needed. search: ' `wineventlog_security` EventCode=4625 OR EventCode=4624 Logon_Type=3 TargetUserName=Administrator | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName, EventCode diff --git a/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml b/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml index 22b6bf3596..4794ae505c 100644 --- a/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml +++ b/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml @@ -5,7 +5,11 @@ date: '2023-04-20' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION +description: The following analytic leverages Event ID 4104 to identify the execution of the PowerView powershell commandlets `Get-ObjectAcl` and `Get-DomainObjectAcl`. This commandlets + are used to enumerate Access Control List permissions given to Active Directory objects. In an active directory environment, an object is an entity that represents an available resource within + the organizations network, such as domain controllers, users, groups, computers, shares, etc. Maintaining Active Directory permissions is complicated and hard to manage, especially in complex + and large environments with multiple domains. Weak permissions may allow adversaries and red teamers to escalate their privileges in Active Directory. PowerView is a common tool leveraged + by attackers to identify and exploit configuration weaknesses. search: ' `powershell` EventCode=4104 (ScriptBlockText=*get-objectacl* OR ScriptBlockText=*Get-DomainObjectAcl* ) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml index bd34f9604c..c91f21ecef 100644 --- a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml +++ b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml @@ -5,11 +5,14 @@ date: '2023-03-23' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION +description: The following analytic leverages Event ID 4624 to identify a source computer authenticating to a large number of remote endpoints within an Active Directory network. + Specifically, the logic will trigger when a source endpoint authenticates to 30 or more target computers within a 5 minute timespan. This behavior could represent an adversary who is + moving laterally across the environment or enumerating network shares in the search for sensitive files. + As environments differ across organizations, security teams should customize the thresholds of this detection as needed. search: ' EventCode=4624 LogonType=3 TargetUserName!="ANONYMOUS LOGON" TargetUserName!="*$" | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName - | where unique_targets > 40 + | where unique_targets > 30 | `windows_rapid_authentication_on_multiple_hosts_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. @@ -18,6 +21,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed. references: - https://attack.mitre.org/techniques/T1135/ +- https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624 tags: analytic_story: - Active Directory Privilege Escalation diff --git a/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml b/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml index 807a5cd19e..8b2262dc5a 100644 --- a/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml +++ b/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml @@ -5,16 +5,24 @@ date: '2023-03-27' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION +description: The following analytic leverages Event ID 4672 to identify a source user authenticating with special privileges across a large number + remote endpoints. Specifically, the logic will trigger when a source user obtains special privileges across 30 or more target computers within a 5 minute timespan. + Special privileges are assigned to a new logon session when sensitive privileges like SeDebugPrivilege and SeImpersonatePrivilege are assigned. This behavior could represent an + adversary who is moving laterally and executing remote code across the network. It can also be triggered by other behavior like an adversary enumerating network shares. + As environments differ across organizations, security teams should customize the thresholds of this detection as needed. search: ' `wineventlog_security` EventCode=4672 AND NOT(Caller_User_Name IN ("DWM-1","DWM-2","DWM-3","LOCAL SERVICE","NETWORK SERVICE","SYSTEM","*$")) | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(PrivilegeList) as privileges by _time, Caller_User_Name - | where unique_targets > 40 + | where unique_targets > 30 | `windows_special_privileged_logon_on_multiple_hosts_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, you need to be ingesting special logon events. + The Advanced Security Audit policy setting `Audit Special Logon` within `Logon/Logoff` need to be enabled. +known_false_positives: Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed. references: -- REFERENCE +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672 +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319113(v=ws.11) +- https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ +- https://attack.mitre.org/tactics/TA0008/ tags: analytic_story: - Active Directory Privilege Escalation From 737d03ef76408a174b1d47c18e34ffd760f026e2 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 24 Apr 2023 11:07:39 -0400 Subject: [PATCH 23/29] Update windows_powerview_ad_access_control_list_enumeration.yml --- .../windows_powerview_ad_access_control_list_enumeration.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml b/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml index 4794ae505c..2e3176a6f2 100644 --- a/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml +++ b/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml @@ -5,7 +5,7 @@ date: '2023-04-20' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic leverages Event ID 4104 to identify the execution of the PowerView powershell commandlets `Get-ObjectAcl` and `Get-DomainObjectAcl`. This commandlets +description: The following analytic leverages Event ID 4104 to identify the execution of the PowerView powershell commandlets `Get-ObjectAcl` or `Get-DomainObjectAcl`. This commandlets are used to enumerate Access Control List permissions given to Active Directory objects. In an active directory environment, an object is an entity that represents an available resource within the organizations network, such as domain controllers, users, groups, computers, shares, etc. Maintaining Active Directory permissions is complicated and hard to manage, especially in complex and large environments with multiple domains. Weak permissions may allow adversaries and red teamers to escalate their privileges in Active Directory. PowerView is a common tool leveraged From 74938e42a5fe7b00a977dc8a1285b959ff1d0c8a Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 24 Apr 2023 13:45:28 -0400 Subject: [PATCH 24/29] adding new detection. updating message on others --- ...n_default_group_policy_object_modified.yml | 2 +- ...dows_admon_group_policy_object_created.yml | 2 +- ...s_default_group_policy_object_modified.yml | 2 +- ...group_policy_object_modified_with_gpme.yml | 82 +++++++++++++++++++ .../windows_dnsadmins_new_member_added.yml | 2 +- .../windows_group_policy_object_created.yml | 2 +- ..._of_computer_service_tickets_requested.yml | 4 +- ...rapid_authentication_on_multiple_hosts.yml | 2 +- ...ial_privileged_logon_on_multiple_hosts.yml | 2 +- ..._policy_object_modified_with_gpme.test.yml | 13 +++ 10 files changed, 104 insertions(+), 9 deletions(-) create mode 100644 detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml create mode 100644 tests/endpoint/windows_default_group_policy_object_modified_with_gpme.test.yml diff --git a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml index 8a1715f39a..8f96b6cea2 100644 --- a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml @@ -43,7 +43,7 @@ tags: kill_chain_phases: - Installation - Actions on Objectives - message: UPDATE message + message: A default domain group policy was updated on $dcName$ mitre_attack_id: - T1484 - T1484.001 diff --git a/detections/endpoint/windows_admon_group_policy_object_created.yml b/detections/endpoint/windows_admon_group_policy_object_created.yml index a432ffcbf9..07cd40ef47 100644 --- a/detections/endpoint/windows_admon_group_policy_object_created.yml +++ b/detections/endpoint/windows_admon_group_policy_object_created.yml @@ -43,7 +43,7 @@ tags: kill_chain_phases: - Installation - Actions on Objectives - message: UPDATE message + message: A new group policy objected was created on $dcName$ mitre_attack_id: - T1484 - T1484.001 diff --git a/detections/endpoint/windows_default_group_policy_object_modified.yml b/detections/endpoint/windows_default_group_policy_object_modified.yml index aba6fd7e8c..ca717775c1 100644 --- a/detections/endpoint/windows_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified.yml @@ -44,7 +44,7 @@ tags: kill_chain_phases: - Installation - Actions on Objectives - message: UPDATE message + message: A default group policy object was modified on $Computer$ by $SubjectUserSid$ mitre_attack_id: - T1484 - T1484.001 diff --git a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml new file mode 100644 index 0000000000..0f8f00513f --- /dev/null +++ b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml @@ -0,0 +1,82 @@ +name: Windows Default Group Policy Object Modified with GPME +id: eaf688b3-bb8f-454d-b105-920a862cd8cb +version: 1 +date: '2023-04-24' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic leverages the Endpoint datamodel to identify the potential edition of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain + two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. + The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group + policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the edition of the default GPOs. +search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mmc.exe (Processes.process =*gpme.msc*) AND (Processes.process = "*31B2F340-016D-11D2-945F-00C04FB984F9*" OR Processes.process = "*6AC1786C-016F-11D2-945F-00C04fB984F9*" ) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_default_group_policy_object_modified_with_gpme_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed. +references: +- https://attack.mitre.org/techniques/T1484/ +- https://attack.mitre.org/techniques/T1484/001 +- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/ +- https://adsecurity.org/?p=2716 +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265969(v=ws.11) +tags: + analytic_story: + - Active Directory Privilege Escalation + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log + impact: 100 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A default group policy object was opened with Group Policy Manage Editor on $dest$ + mitre_attack_id: + - T1484 + - T1484.001 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 50 + security_domain: endpoint diff --git a/detections/endpoint/windows_dnsadmins_new_member_added.yml b/detections/endpoint/windows_dnsadmins_new_member_added.yml index cba07ff4b1..7fcb8fc9cf 100644 --- a/detections/endpoint/windows_dnsadmins_new_member_added.yml +++ b/detections/endpoint/windows_dnsadmins_new_member_added.yml @@ -39,7 +39,7 @@ tags: kill_chain_phases: - Installation - Actions on Objectives - message: UPDATE message + message: A new member was added to the DnsAdmins group by $SubjectUserName$ mitre_attack_id: - T1098 nist: diff --git a/detections/endpoint/windows_group_policy_object_created.yml b/detections/endpoint/windows_group_policy_object_created.yml index 00ae701cff..b373f2d85a 100644 --- a/detections/endpoint/windows_group_policy_object_created.yml +++ b/detections/endpoint/windows_group_policy_object_created.yml @@ -47,7 +47,7 @@ tags: - Exploitation - Installation - Actions on Objectives - message: UPDATE message + message: A new group policy objected was created by $User$ mitre_attack_id: - T1484 - T1484.001 diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml index b9934efdf2..c34827bf9c 100644 --- a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml @@ -17,7 +17,7 @@ description: The following analytic leverages Event ID 4769, `A Kerberos the arbitrary threshold as needed. search: ' `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$" - | bucket span=2m _time + | bucket span=5m _time | stats dc(ServiceName) AS unique_targets values(ServiceName) as host_targets by _time, IpAddress, TargetUserName | where unique_targets > 30 | `windows_large_number_of_computer_service_tickets_requested_filter`' @@ -48,7 +48,7 @@ tags: impact: 60 kill_chain_phases: - Reconnaissance - message: UPDATE message + message: A large number of kerberos computer service tickets were requested by $IpAddress$ within 5 minutes. mitre_attack_id: - T1135 - T1078 diff --git a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml index c91f21ecef..e05150d85d 100644 --- a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml +++ b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml @@ -42,7 +42,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: UPDATE message + message: The source computer with ip address $IpAddress$ authenticated to a large number of remote endpoints within 5 minutes. mitre_attack_id: - T1003.002 nist: diff --git a/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml b/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml index 8b2262dc5a..71fd7c49d4 100644 --- a/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml +++ b/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml @@ -43,7 +43,7 @@ tags: kill_chain_phases: - Reconnaissance - Exploitation - message: UPDATE message + message: A source user $Caller_User_Name$ obtained special privileges on a large number of endpoints within 5 minutes. mitre_attack_id: - T1087 - T1021.002 diff --git a/tests/endpoint/windows_default_group_policy_object_modified_with_gpme.test.yml b/tests/endpoint/windows_default_group_policy_object_modified_with_gpme.test.yml new file mode 100644 index 0000000000..f105615cdb --- /dev/null +++ b/tests/endpoint/windows_default_group_policy_object_modified_with_gpme.test.yml @@ -0,0 +1,13 @@ +name: Windows Default Group Policy Object Modified with GPME Unit Test +tests: +- name: Windows Default Group Policy Object Modified with GPME + file: endpoint/windows_default_group_policy_object_modified_with_gpme.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 79558b4fad911903d779eb712cbb10694fca19e7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 24 Apr 2023 13:46:03 -0400 Subject: [PATCH 25/29] removing semgrep --- .github/workflows/semgrep-analysis.yml | 58 -------------------------- 1 file changed, 58 deletions(-) delete mode 100644 .github/workflows/semgrep-analysis.yml diff --git a/.github/workflows/semgrep-analysis.yml b/.github/workflows/semgrep-analysis.yml deleted file mode 100644 index 15094de479..0000000000 --- a/.github/workflows/semgrep-analysis.yml +++ /dev/null @@ -1,58 +0,0 @@ -# This workflow file requires a free account on Semgrep.dev to -# manage rules, file ignores, notifications, and more. -# -# See https://semgrep.dev/docs - -name: Semgrep - -on: - push: - pull_request: - types: [opened, reopened] -jobs: - - validate-tag-if-present: - runs-on: ubuntu-latest - - steps: - - name: TAGGED, Validate that the tag is in the correct format - - run: | - echo "The GITHUB_REF: $GITHUB_REF" - #First check to see if the release is a tag - if [[ $GITHUB_REF =~ refs/tags/* ]]; then - #Yes, this is a tag, so we need to test to make sure that the tag - #is in the correct format (like v1.10.20) - if [[ $GITHUB_REF =~ refs/tags/v[0-9]+.[0-9]+.[0-9]+ ]]; then - echo "PASS: Tagged release with good format" - exit 0 - else - echo "FAIL: Tagged release with bad format" - exit 1 - fi - else - echo "PASS: Not a tagged release" - exit 0 - fi - semgrep: - name: Scan - runs-on: ubuntu-latest - steps: - # Checkout project source - - uses: actions/checkout@v2 - - # Scan code using project's configuration on https://semgrep.dev/manage - - uses: returntocorp/semgrep-action@v1 - with: - generateSarif: "1" - config: >- # more at semgrep.dev/explore - p/security-audit - p/secrets - - # Upload SARIF file generated in previous step - #The following lines are commented out right now pending a fix to the semgrep repo - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v1 - with: - sarif_file: semgrep.sarif - if: always() From 4cc7f9edce711d7f02914f1d936cacdabccb0792 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 24 Apr 2023 15:25:05 -0400 Subject: [PATCH 26/29] fixing test file --- .../endpoint/windows_admon_group_policy_object_created.yml | 2 +- ...windows_default_group_policy_object_modified_with_gpme.yml | 2 +- .../windows_admon_group_policy_object_created.test.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_admon_group_policy_object_created.yml b/detections/endpoint/windows_admon_group_policy_object_created.yml index 07cd40ef47..5b3a12abc9 100644 --- a/detections/endpoint/windows_admon_group_policy_object_created.yml +++ b/detections/endpoint/windows_admon_group_policy_object_created.yml @@ -38,7 +38,7 @@ tags: - Stage:Privilege Escalation - Stage:Persistence dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-admon.log impact: 100 kill_chain_phases: - Installation diff --git a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml index 0f8f00513f..21308e3d12 100644 --- a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml @@ -9,7 +9,7 @@ description: The following analytic leverages the Endpoint datamodel to identify two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the edition of the default GPOs. -search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mmc.exe (Processes.process =*gpme.msc*) AND (Processes.process = "*31B2F340-016D-11D2-945F-00C04FB984F9*" OR Processes.process = "*6AC1786C-016F-11D2-945F-00C04fB984F9*" ) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mmc.exe (Processes.process =*gpme.msc*) AND (Processes.process = "*31B2F340-016D-11D2-945F-00C04FB984F9*" OR Processes.process = "*6AC1786C-016F-11D2-945F-00C04fB984F9*" ) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/tests/endpoint/windows_admon_group_policy_object_created.test.yml b/tests/endpoint/windows_admon_group_policy_object_created.test.yml index 2fb0c5723b..f5baec0a50 100644 --- a/tests/endpoint/windows_admon_group_policy_object_created.test.yml +++ b/tests/endpoint/windows_admon_group_policy_object_created.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-security.log + - file_name: windows-admon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-admon.log source: ActiveDirectory sourcetype: ActiveDirectory \ No newline at end of file From df3c967f026811ffbf1255195f7a9b7a4c490f19 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 24 Apr 2023 18:36:35 -0400 Subject: [PATCH 27/29] fixing test metadata --- detections/endpoint/windows_group_policy_object_created.yml | 4 +--- detections/endpoint/windows_powersploit_gpp_discovery.yml | 5 ++--- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/windows_group_policy_object_created.yml b/detections/endpoint/windows_group_policy_object_created.yml index 55828da360..7c2c79cfef 100644 --- a/detections/endpoint/windows_group_policy_object_created.yml +++ b/detections/endpoint/windows_group_policy_object_created.yml @@ -33,8 +33,6 @@ tags: - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 50 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-security.log impact: 80 message: A new group policy objected was created by $User$ mitre_attack_id: @@ -65,6 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/windows_powersploit_gpp_discovery.yml b/detections/endpoint/windows_powersploit_gpp_discovery.yml index f0f41594f8..e1d66e4466 100644 --- a/detections/endpoint/windows_powersploit_gpp_discovery.yml +++ b/detections/endpoint/windows_powersploit_gpp_discovery.yml @@ -5,7 +5,6 @@ date: '2023-03-16' author: Mauricio Velazco, Splunk status: production type: TTP - data_source: - Powershell 4104 description: The following analytic identifies the use of the Get-GPPPassword PowerShell commandlet employed to search for unsecured credentials Group Policy Preferences (GPP). @@ -63,5 +62,5 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog From 9bfddfa0a718edb11a7cdf4f4eed53925f9620c1 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 24 Apr 2023 19:02:18 -0400 Subject: [PATCH 28/29] updating story narrative --- .../active_directory_privilege_escalation.yml | 20 ++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/stories/active_directory_privilege_escalation.yml b/stories/active_directory_privilege_escalation.yml index 8d24cc30d4..216854fd09 100644 --- a/stories/active_directory_privilege_escalation.yml +++ b/stories/active_directory_privilege_escalation.yml @@ -3,9 +3,23 @@ id: fa34a5d8-df0a-404c-8237-11f99cba1d5f version: 1 date: '2023-03-20' author: Mauricio Velazco, Splunk -description: UPDATE_DESCRIPTION -narrative: UPDATE_NARRATIVE -references: [] +description: Monitor for activities and techniques associated with Privilege Escalation + attacks within Active Directory environments. +narrative: Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. + Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. + Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities.\ + + Active Directory is a central component of most enterprise networks, providing authentication and authorization services for users, computers, and other resources. + It stores sensitive information such as passwords, user accounts, and security policies, and is therefore a high-value target for attackers. + Privilege escalation attacks in Active Directory typically involve exploiting vulnerabilities or misconfigurations across the network to gain elevated privileges, + such as Domain Administrator access. Once an attacker has escalated their privileges and taken full control of a domain, they can easily move laterally throughout the network, + access sensitive data, and carry out further attacks. Security teams should monitor for privilege escalation attacks in Active Directory to identify a breach before attackers achieve operational success.\ + + The following analytic story groups detection opportunities that seek to identify an adversary attempting to escalate privileges in an Active Directory network. +references: +- https://attack.mitre.org/tactics/TA0004/ +- https://adsecurity.org/?p=3658 +- https://adsecurity.org/?p=2362 tags: analytic_story: Active Directory Privilege Escalation category: [] From 07934f7736b8ac361b89c35312aeee69ee0c6edd Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 1 May 2023 15:40:15 -0700 Subject: [PATCH 29/29] risk fixes --- ...trative_shares_accessed_on_multiple_hosts.yml | 4 ++-- ...s_local_administrator_credential_stuffing.yml | 2 +- ...ws_rapid_authentication_on_multiple_hosts.yml | 2 +- ...ure_active_directory_privilege_escalation.yml | 16 ---------------- 4 files changed, 4 insertions(+), 20 deletions(-) delete mode 100644 stories/azure_active_directory_privilege_escalation.yml diff --git a/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml index c57b5ddcd3..dc0be480e3 100644 --- a/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml +++ b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml @@ -32,11 +32,11 @@ tags: asset_type: Endpoint confidence: 80 impact: 70 - message: $IpAddress$ accessed the IPC share on more than 40 endpoints in a timespan of 5 minutes. + message: $IpAddress$ accessed the IPC share on more than 30 endpoints in a timespan of 5 minutes. mitre_attack_id: - T1135 observable: - - name: Computer + - name: host_targets type: Endpoint role: - Victim diff --git a/detections/endpoint/windows_local_administrator_credential_stuffing.yml b/detections/endpoint/windows_local_administrator_credential_stuffing.yml index 9789f28329..909c9015f5 100644 --- a/detections/endpoint/windows_local_administrator_credential_stuffing.yml +++ b/detections/endpoint/windows_local_administrator_credential_stuffing.yml @@ -40,7 +40,7 @@ tags: - T1110 - T1110.004 observable: - - name: ComputerName + - name: host_targets type: Endpoint role: - Victim diff --git a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml index 8b986e4c74..15087537cb 100644 --- a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml +++ b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml @@ -36,7 +36,7 @@ tags: mitre_attack_id: - T1003.002 observable: - - name: ComputerName + - name: host_targets type: Endpoint role: - Victim diff --git a/stories/azure_active_directory_privilege_escalation.yml b/stories/azure_active_directory_privilege_escalation.yml deleted file mode 100644 index 93b97c570b..0000000000 --- a/stories/azure_active_directory_privilege_escalation.yml +++ /dev/null @@ -1,16 +0,0 @@ -name: Azure Active Directory Privilege Escalation -id: 49e54dd3-ed8b-478e-aac6-3c827fc73a93 -version: 1 -date: '2023-03-20' -author: Mauricio Velazco, Splunk -description: UPDATE_DESCRIPTION -narrative: UPDATE_NARRATIVE -references: [] -tags: - analytic_story: Azure Active Directory Privilege Escalation - category: [] - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - usecase: Advanced Threat Detection