diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index ecb09f7e98..5d5efcd2f7 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -9,13 +9,14 @@ description: This detection indicates use of Mimikatz modules that facilitate Pa attack, Golden or Silver kerberos ticket attack, and Skeleton key attack. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true OR match_regex(cmd_line, /(?i)misc::skeleton/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index 16e8b0e679..bbd8fec3c4 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -12,7 +12,8 @@ description: Stolen credentials are applied by methods such as user impersonatio search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true @@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index 633ae2f609..4bd7dae1cc 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -10,12 +10,13 @@ description: This detection identifies use of DSInternals modules that verify pa search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-PasswordQuality/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml index c6b479fa22..2731d5bb83 100644 --- a/detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/detections/endpoint/ssa___attempt_to_delete_services.yml @@ -15,10 +15,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null) | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml index 05865adfa6..6733b9599a 100644 --- a/detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/detections/endpoint/ssa___attempt_to_disable_services.yml @@ -16,10 +16,11 @@ search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(inpu "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null) | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, - "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 3d19e423e1..c248d53128 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -11,14 +11,15 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe" OR process_name="reg.exe" | where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, - dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) + dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events(); ' how_to_implement: You must be ingesting windows endpoint data that tracks process activity, including parent-child relationships from your endpoints. diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index d8d32dad82..71463e23fb 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -16,7 +16,8 @@ search: '| from read_ssa_enriched_events() process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line, /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line, @@ -26,7 +27,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index 79db9249a7..80e336023d 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events() process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line, @@ -27,7 +28,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index d14effa4d7..c7f1cc3c54 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -17,14 +17,15 @@ search: ' | from read_ssa_enriched_events() cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null) | where cmd_line != null AND process_name != null AND parent_process_name + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND process_name != null AND parent_process_name != null AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-s/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index 4b4a04dc24..8a9d12996b 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -16,13 +16,14 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), - "string", null) | where cmd_line != null AND process_name != null AND process_path + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-v/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index 6fc58c60fa..36cdd32b5b 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -14,13 +14,14 @@ description: Credential extraction is often an illegal recovery of credential ma search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\|]+/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index 020080237e..c6642280ca 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -13,12 +13,13 @@ description: Credential extraction is often an illegal recovery of credential ma search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line, /(?i)all\s+\-oA\s+\-output/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index ebe6f4588f..31e3d2b244 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -12,7 +12,8 @@ description: Credential extraction is often an illegal recovery of credential ma search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR match_regex(cmd_line, /(?i)lsadump::sam/)=true @@ -22,7 +23,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index 95fb6ac305..35ec20bf69 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -15,7 +15,8 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null) | where cmd_line != null AND parent_process_name + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND parent_process_name != null AND process_name != null AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name, /(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, @@ -23,7 +24,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index 1c36de7878..1bb21416ba 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -14,13 +14,14 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, - "process_name"), "string", null) | where cmd_line != null AND process_name != null + "process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND process_name != null AND ( match_regex(process_name, /^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, /(?i)\-z\s+/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index 04dbeae255..a4f2a1fa10 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -12,7 +12,8 @@ description: Credential extraction is often an illegal recovery of credential ma search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true @@ -23,7 +24,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml index 18226a3a7c..2dde626af4 100644 --- a/detections/endpoint/ssa___delete_a_net_user.yml +++ b/detections/endpoint/ssa___delete_a_net_user.yml @@ -17,10 +17,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: o successfully implement this search, you need to be ingesting logs diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index 324178117e..8dc9164db4 100644 --- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -14,11 +14,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index 46397d9466..42a14efbf0 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -11,10 +11,11 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", - null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) | - where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true + null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), + event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine), - body=create_map(["process_name", process_name]) | into write_ssa_detected_events();' + body=create_map(["event_id", event_id, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index ac4bca3592..b5edb0aaf7 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -12,11 +12,12 @@ search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_ "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID - | eval start_time=_time, end_time=_time, body=create_map(["EventCode", EventCode, + | eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id, "EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, "TicketEncryptionType", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))| diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index 3acdee459f..34909eee66 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -14,13 +14,13 @@ search: ' | from read_ssa_enriched_events() "authentication_type"), authentication_method=map_get(input_event, "authentication_method"), origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), - "string", null) + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9" AND authentication_method="seclogo") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body=create_map(["authentication_type", authentication_type, "authentication_method", + dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type, "authentication_method", authentication_method]) | into write_ssa_detected_events();' how_to_implement: The test data is converted from Windows Security Event logs generated from Attach Range simulation and used in SPL search and extended to SPL2 diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml index d7d1aff9a1..00c4a1fdb0 100644 --- a/detections/endpoint/ssa___disable_net_user_account.yml +++ b/detections/endpoint/ssa___disable_net_user_account.yml @@ -15,10 +15,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 747832406a..af2b9c4c8d 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -18,11 +18,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"), /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, - /\d+/, "N") | where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", + /\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id, dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm | eval start_time = timestamp, end_time = timestamp, - entities = mvappend(dest_device_id, dest_user_id), body=create_map(["cmd_line", + entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be populating the endpoint data model for SSA and specifically the process_name and the process fields diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index 291da7b3bd..62f8f53196 100644 --- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -14,11 +14,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index d823bc0991..aa36f3b5b2 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that enable search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true OR match_regex(cmd_line, @@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 212c382844..bf83556b14 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -10,12 +10,13 @@ description: This detection identifies access to PowerSploit modules that create search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)New-DomainUser/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index 8117269ce4..8c8e4a5a75 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -10,13 +10,14 @@ description: This detection identifies use of DSInternals modules that enable or search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index 9820dcb2a8..1b63b5a8f2 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -10,13 +10,14 @@ description: This detection identifies access to PowerSploit modules that delete search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index 4190380254..5fbebe9f19 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -11,14 +11,15 @@ description: This detection identifies use of DSInternals modules for illegal ma search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, /(?i)Set-LsaPolicyInformation/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index f078d62322..1c6bcef846 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that enable search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line, /(?i)Set-MasterBootRecord/)=true ) @@ -19,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index d085cc9296..efc7522548 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that illega search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true OR match_regex(cmd_line, @@ -19,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index fccfccad9f..3c2a8ccb59 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -10,13 +10,14 @@ description: This detection identifies use of Mimikatz modules for illegal privi search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index 8f5d877367..debc75fd6e 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies use of Mimikatz modules for illegal contr search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line, /(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line, /(?i)service::stop/)=true OR @@ -19,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index 8883cfe1e2..3a6a2be8b7 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -12,7 +12,8 @@ description: This detection identifies access to PowerSploit modules that enable search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, @@ -27,7 +28,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 43d0dbea67..12ba448867 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -16,12 +16,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index 4f796555b4..eac07c811f 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -10,14 +10,15 @@ description: This detection identifies use of PowerSploit modules that facilitat search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 8fb17415ed..e79b2cb80c 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events() | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), - dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) + dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe" | rex field=parent_process "(?[^\\\\]+)$" | where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe" @@ -24,7 +25,7 @@ search: '| from read_ssa_enriched_events() OR field0="java.exe" OR field0="powershell.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name", + dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name", parent_process]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml index f946e48aae..8c99cb828c 100644 --- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml +++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml @@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), - "string", null) | where parent_process_name!=null | select parent_process_name, + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where parent_process_name!=null | select parent_process_name, process_name, cmd_line, timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name" target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe" OR process_name="ftp.exe" OR process_name="dfsvc.exe" diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index b1653762d6..68a1d9ccc2 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -13,7 +13,8 @@ description: This detection identifies use of PowerSploit modules that discover search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, @@ -28,7 +29,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index 7f8cf6e654..b6787b7172 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, @@ -37,7 +38,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index be4717def3..f647db5dee 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -10,13 +10,14 @@ description: This detection identifies use of Mimikatz modules for discovery of search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index a7e80199eb..779d3a8915 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -12,7 +12,8 @@ description: This detection identifies access to PowerSploit modules for reconna search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true @@ -27,7 +28,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index 6e3077f5bd..e899edf6ca 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true @@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index f65abc61c0..44173c043c 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -10,12 +10,13 @@ description: This detection identifies use of Mimikatz modules for discovery of search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::ServerInfo/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index 02d762f620..f3ce7d571f 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that discov search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true @@ -22,7 +23,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index a3f1c2d85b..c3b890b3b5 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -10,12 +10,13 @@ description: This detection identifies use of Mimikatz modules for discovery and search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::share/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index 64a86372ba..cd02448f35 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, @@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index 647dcf4512..cdab390ef6 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules for reconna search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line, /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true @@ -21,7 +22,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index 5cfdef007f..3fc583f000 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies reconnaissance of credential stores and u search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, /(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true OR match_regex(cmd_line, /(?i)crypto::sc/)=true @@ -18,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index 32ef4abbeb..32d70c14e9 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -10,12 +10,13 @@ description: This detection identifies use of PowerSploit modules for assessment search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-AVSignature/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index f8f29c6fdf..4d488adaa2 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -10,12 +10,13 @@ description: This detection identifies use of PowerSploit modules for assessment search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-PrivescAudit/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index 034d96eae1..4763f416a3 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -14,12 +14,13 @@ description: This detection identifies use of Mimikatz modules for discovery of search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::detours/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index 1f7bf96dc5..7e1999d04b 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -10,13 +10,14 @@ description: This detection identifies use of Mimikatz modules for discovery and search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml index 15aa136dae..74b24ad268 100644 --- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -17,11 +17,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null) | where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%") AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index 20ee3eb47d..976cba71c9 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -13,7 +13,8 @@ search: '| from read_ssa_enriched_events() process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line, /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true @@ -21,7 +22,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index 7847644266..448b877477 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -10,13 +10,14 @@ description: This detection identifies illegal setting of credentials via Mimika search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index 7099d84b62..d8cc6c0f62 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -10,12 +10,13 @@ description: This detection identifies illegal setting of credentials via PowerS search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainUserPassword/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index a24ce7dc5c..cdc56115b7 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -16,7 +16,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", - null)); + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null); $cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe" OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe" @@ -226,7 +226,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 | union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp, - end_time=timestamp, entities=mvappend(device, user), body=create_map(["process_path", + end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: None diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml index ec9e82b65f..8f0861acd9 100644 --- a/detections/endpoint/ssa___unusually_long_command_line.yml +++ b/detections/endpoint/ssa___unusually_long_command_line.yml @@ -13,7 +13,8 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma "_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), - process_name=ucast(map_get(input_event, "process_name"), "string", null) | where + process_name=ucast(map_get(input_event, "process_name"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm, @@ -21,7 +22,7 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id", "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp, - end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["cmd_line", + end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting sysmon endpoint data that monitors command lines. diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index 848a73c031..68350a2464 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -13,14 +13,15 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index 3de5522398..d286d41a21 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -13,11 +13,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting data that records process activity from your