admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-08-09 18:42:36 +00:00
committed by GitHub
parent 4e3dc7fe9c da6a9c2d0f
commit 7c85b0dfd8
61 changed files with 181 additions and 122 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+3 -2
View File
@@ -9,13 +9,14 @@ description: This detection indicates use of Mimikatz modules that facilitate Pa
attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true
null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true
OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
+3 -2
View File
@@ -12,7 +12,8 @@ description: Stolen credentials are applied by methods such as user impersonatio
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line,
/(?i)Invoke-TokenManipulation/)=true OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true
OR match_regex(cmd_line, /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true
@@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
+3 -2
View File
@@ -10,12 +10,13 @@ description: This detection identifies use of DSInternals modules that verify pa
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Test-PasswordQuality/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___attempt_to_delete_services.yml
+3 -2
View File
@@ -15,10 +15,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null) | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name
null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name
= "sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
detections/endpoint/ssa___attempt_to_disable_services.yml
+3 -2
View File
@@ -16,10 +16,11 @@ search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(inpu
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null) | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line,
null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line,
"%config%") AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name",
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+3 -2
View File
@@ -11,14 +11,15 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
"_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
"process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where process_name="cmd.exe" OR process_name="reg.exe" | where cmd_line != null AND
match_regex(cmd_line, /(?i)save\s+/)=true AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true
OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true
OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line,
/(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true
) | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
| into write_ssa_detected_events(); '
how_to_implement: You must be ingesting windows endpoint data that tracks process
activity, including parent-child relationships from your endpoints.
detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
+3 -2
View File
@@ -16,7 +16,8 @@ search: '| from read_ssa_enriched_events()
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true
OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line,
/(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true
OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line,
@@ -26,7 +27,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
+3 -2
View File
@@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events()
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true
OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,
/(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true
OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,
@@ -27,7 +28,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
+3 -2
View File
@@ -17,14 +17,15 @@ search: ' | from read_ssa_enriched_events()
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null) | where cmd_line != null AND process_name != null AND parent_process_name
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND process_name != null AND parent_process_name
!= null AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true
AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path,
/(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-s/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
+3 -2
View File
@@ -16,13 +16,14 @@ search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null) | where cmd_line != null AND process_name != null AND process_path
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND process_name != null AND process_path
!= null AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path,
/(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-v/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
+3 -2
View File
@@ -14,13 +14,14 @@ description: Credential extraction is often an illegal recovery of credential ma
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line,
/(?i)\-dbpath[\s;:\.\|]+/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml
+3 -2
View File
@@ -13,12 +13,13 @@ description: Credential extraction is often an illegal recovery of credential ma
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND match_regex(cmd_line, /(?i)all\s+\-oA\s+\-output/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml
+3 -2
View File
@@ -12,7 +12,8 @@ description: Credential extraction is often an illegal recovery of credential ma
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line,
/(?i)CRYPTO::keys/)=true OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR
match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR match_regex(cmd_line, /(?i)lsadump::sam/)=true
@@ -22,7 +23,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
+3 -2
View File
@@ -15,7 +15,8 @@ search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null) | where cmd_line != null AND parent_process_name
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND parent_process_name
!= null AND process_name != null AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true
OR match_regex(parent_process_name, /(?i)livekd\.exe/)=true ) AND match_regex(process_name,
/(?i)conhost\.exe/)=true AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line,
@@ -23,7 +24,7 @@ search: ' | from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
+3 -2
View File
@@ -14,13 +14,14 @@ search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null) | where cmd_line != null AND process_name != null
"process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND process_name != null
AND ( match_regex(process_name, /^(?i)ntkd\.exe/)=true OR match_regex(process_name,
/^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, /(?i)\-z\s+/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
+3 -2
View File
@@ -12,7 +12,8 @@ description: Credential extraction is often an illegal recovery of credential ma
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line,
/(?i)Get-CachedGPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true
OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true
@@ -23,7 +24,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___delete_a_net_user.yml
+3 -2
View File
@@ -17,10 +17,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: o successfully implement this search, you need to be ingesting logs
detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+3 -2
View File
@@ -14,11 +14,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND match_regex(cmd_line,
/(?i)deny/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+4 -3
View File
@@ -11,10 +11,11 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
"_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
"string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) |
where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
null)), process=lower(ucast(map_get(input_event, "process"), "string", null)),
event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine),
body=create_map(["process_name", process_name]) | into write_ssa_detected_events();'
body=create_map(["event_id", event_id, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including Windows command line logging. You can see how we test this with [Event
Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
detections/endpoint/ssa___detect_kerberoasting.yml
+3 -2
View File
@@ -12,11 +12,12 @@ search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_
"ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
"service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
| first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
| eval start_time=_time, end_time=_time, body=create_map(["EventCode", EventCode,
| eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id, "EventCode", EventCode,
"ServiceName", ServiceName, "TicketOptions", TicketOptions, "TicketEncryptionType",
TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))|
detections/endpoint/ssa___detect_pass_hash.yml
+2 -2
View File
@@ -14,13 +14,13 @@ search: ' | from read_ssa_enriched_events()
"authentication_type"), authentication_method=map_get(input_event, "authentication_method"),
origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event,
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
"string", null)
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9"
AND authentication_method="seclogo")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map(["authentication_type", authentication_type, "authentication_method",
dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type, "authentication_method",
authentication_method]) | into write_ssa_detected_events();'
how_to_implement: The test data is converted from Windows Security Event logs generated
from Attach Range simulation and used in SPL search and extended to SPL2
detections/endpoint/ssa___disable_net_user_account.yml
+3 -2
View File
@@ -15,10 +15,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
detections/endpoint/ssa___first_time_seen_cmd_line.yml
+3 -2
View File
@@ -18,11 +18,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext"
*/ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
/* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm,
/\d+/, "N") | where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string",
/\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string",
""), /.* \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp,
dest_device_id, dest_user_id | first_time_event input_columns=["cmd_line_norm"]
| where first_time_cmd_line_norm | eval start_time = timestamp, end_time = timestamp,
entities = mvappend(dest_device_id, dest_user_id), body=create_map(["cmd_line",
entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be populating the endpoint data model for SSA and specifically
the process_name and the process fields
detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+3 -2
View File
@@ -14,11 +14,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND match_regex(cmd_line,
/(?i)grant/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR
process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
+3 -2
View File
@@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that enable
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line,
/(?i)Get-Keystrokes/)=true OR match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true
OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true OR match_regex(cmd_line,
@@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
+3 -2
View File
@@ -10,12 +10,13 @@ description: This detection identifies access to PowerSploit modules that create
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)New-DomainUser/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
+3 -2
View File
@@ -10,13 +10,14 @@ description: This detection identifies use of DSInternals modules that enable or
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line,
/(?i)Enable-ADDBAccount/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
+3 -2
View File
@@ -10,13 +10,14 @@ description: This detection identifies access to PowerSploit modules that delete
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)event::drop/)=true OR match_regex(cmd_line,
/(?i)event::clear/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
+3 -2
View File
@@ -11,14 +11,15 @@ description: This detection identifies use of DSInternals modules for illegal ma
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line,
/(?i)Set-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true
OR match_regex(cmd_line, /(?i)Set-LsaPolicyInformation/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
+3 -2
View File
@@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that enable
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Set-DomainObject/)=true OR match_regex(cmd_line,
/(?i)Set-ADObject/)=true OR match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true
OR match_regex(cmd_line, /(?i)Set-MasterBootRecord/)=true )
@@ -19,7 +20,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
+3 -2
View File
@@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that illega
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line,
/(?i)Add-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true
OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true OR match_regex(cmd_line,
@@ -19,7 +20,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
+3 -2
View File
@@ -10,13 +10,14 @@ description: This detection identifies use of Mimikatz modules for illegal privi
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)privilege::debug/)=true OR match_regex(cmd_line,
/(?i)token::elevate/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
+3 -2
View File
@@ -10,7 +10,8 @@ description: This detection identifies use of Mimikatz modules for illegal contr
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)process::start/)=true OR match_regex(cmd_line,
/(?i)service::\+/)=true OR match_regex(cmd_line, /(?i)service::\-/)=true OR match_regex(cmd_line,
/(?i)service::start/)=true OR match_regex(cmd_line, /(?i)service::stop/)=true OR
@@ -19,7 +20,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
+3 -2
View File
@@ -12,7 +12,8 @@ description: This detection identifies access to PowerSploit modules that enable
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Install-SSP/)=true OR match_regex(cmd_line,
/(?i)Set-CriticalProcess/)=true OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true
OR match_regex(cmd_line, /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line,
@@ -27,7 +28,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+3 -2
View File
@@ -16,12 +16,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line,
"%/G%") AND (match_regex(cmd_line, /(?i)everyone:/)=true OR match_regex(cmd_line,
/(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" OR process_name="xcacls.exe"
OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
+3 -2
View File
@@ -10,14 +10,15 @@ description: This detection identifies use of PowerSploit modules that facilitat
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line,
/(?i)Invoke-CheckLocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+3 -2
View File
@@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events()
| eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where process_name="cmd.exe" | rex field=parent_process "(?<field0>[^\\\\]+)$"
| where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe"
@@ -24,7 +25,7 @@ search: '| from read_ssa_enriched_events()
OR field0="java.exe" OR field0="powershell.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name",
dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name",
parent_process]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting sysmon logs. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
+2 -1
View File
@@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event,
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
"string", null) | where parent_process_name!=null | select parent_process_name,
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where parent_process_name!=null | select parent_process_name,
process_name, cmd_line, timestamp, dest_device_id, dest_user_id | conditional_anomaly
conditional="parent_process_name" target="process_name" | where (process_name="powershell.exe"
OR process_name="regsvcs.exe" OR process_name="ftp.exe" OR process_name="dfsvc.exe"
detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
+3 -2
View File
@@ -13,7 +13,8 @@ description: This detection identifies use of PowerSploit modules that discover
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line,
/(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true
OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line,
@@ -28,7 +29,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
+3 -2
View File
@@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line,
/(?i)Invoke-EnumerateLocalAdmin/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true
OR match_regex(cmd_line, /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line,
@@ -37,7 +38,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
+3 -2
View File
@@ -10,13 +10,14 @@ description: This detection identifies use of Mimikatz modules for discovery of
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)net::user/)=true OR match_regex(cmd_line,
/(?i)net::group/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
+3 -2
View File
@@ -12,7 +12,8 @@ description: This detection identifies access to PowerSploit modules for reconna
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Get-DomainSID/)=true OR match_regex(cmd_line,
/(?i)Get-DomainSite/)=true OR match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line,
/(?i)Get-DomainSubnet/)=true OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true
@@ -27,7 +28,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
+3 -2
View File
@@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line,
/(?i)Get-Domain/)=true OR match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line,
/(?i)Get-DomainComputer/)=true OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true
@@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
+3 -2
View File
@@ -10,12 +10,13 @@ description: This detection identifies use of Mimikatz modules for discovery of
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)net::ServerInfo/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
+3 -2
View File
@@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that discov
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line,
/(?i)Invoke-ProcessHunter/)=true OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true
OR match_regex(cmd_line, /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true
@@ -22,7 +23,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
+3 -2
View File
@@ -10,12 +10,13 @@ description: This detection identifies use of Mimikatz modules for discovery and
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)net::share/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
+3 -2
View File
@@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Find-DomainShare/)=true OR match_regex(cmd_line,
/(?i)Invoke-ShareFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true
OR match_regex(cmd_line, /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line,
@@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
+3 -2
View File
@@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules for reconna
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line,
/(?i)Get-DNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true
OR match_regex(cmd_line, /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true
@@ -21,7 +22,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
+3 -2
View File
@@ -10,7 +10,8 @@ description: This detection identifies reconnaissance of credential stores and u
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)crypto::capi/)=true OR match_regex(cmd_line,
/(?i)crypto::cng/)=true OR match_regex(cmd_line, /(?i)crypto::providers/)=true OR
match_regex(cmd_line, /(?i)crypto::stores/)=true OR match_regex(cmd_line, /(?i)crypto::sc/)=true
@@ -18,7 +19,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
+3 -2
View File
@@ -10,12 +10,13 @@ description: This detection identifies use of PowerSploit modules for assessment
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Find-AVSignature/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
+3 -2
View File
@@ -10,12 +10,13 @@ description: This detection identifies use of PowerSploit modules for assessment
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Invoke-PrivescAudit/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
+3 -2
View File
@@ -14,12 +14,13 @@ description: This detection identifies use of Mimikatz modules for discovery of
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)misc::detours/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
+3 -2
View File
@@ -10,13 +10,14 @@ description: This detection identifies use of Mimikatz modules for discovery and
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)process::list/)=true OR match_regex(cmd_line,
/(?i)service::list/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___resize_shadowstorage_volume.yml
+3 -2
View File
@@ -17,11 +17,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null) | where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line,
null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line,
"%shadowstorage%") AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
+3 -2
View File
@@ -13,7 +13,8 @@ search: '| from read_ssa_enriched_events()
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true
OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true
OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line,
/(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true
@@ -21,7 +22,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
+3 -2
View File
@@ -10,13 +10,14 @@ description: This detection identifies illegal setting of credentials via Mimika
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)misc::addsid/)=true OR match_regex(cmd_line,
/(?i)CRYPTO::scauth/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
+3 -2
View File
@@ -10,12 +10,13 @@ description: This detection identifies illegal setting of credentials via PowerS
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
cmd_line=ucast(map_get(input_event, "process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
!= null AND ( match_regex(cmd_line, /(?i)Set-DomainUserPassword/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
detections/endpoint/ssa___system_process_running_unexpected_location.yml
+2 -2
View File
@@ -16,7 +16,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null));
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
$cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe"
OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe"
@@ -226,7 +226,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
| from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(device, user), body=create_map(["process_path",
end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: None
detections/endpoint/ssa___unusually_long_command_line.yml
+3 -2
View File
@@ -13,7 +13,8 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
"_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
process_name=ucast(map_get(input_event, "process_name"), "string", null) | where
process_name=ucast(map_get(input_event, "process_name"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line!=null and dest_user_id!=null | eval cmd_line_norm=replace(cast(cmd_line,
"string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, /\w:\\[^\s]+/,
"PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm,
@@ -21,7 +22,7 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
| where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
"cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["cmd_line",
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting sysmon endpoint data that monitors command
lines.
detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+3 -2
View File
@@ -13,14 +13,15 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line,
"% cl %") AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line,
/(?i)system/)=true OR match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line,
/(?i)application/)=true OR match_regex(cmd_line, /(?i)setup/)=true OR match_regex(cmd_line,
/(?i)powershell/)=true) AND process_name="wevtutil.exe" | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name",
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name",
parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+3 -2
View File
@@ -13,11 +13,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line,
"% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" | eval
start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: You must be ingesting data that records process activity from your