From 67d09a1c524102150e1cb2fcc506bf31a6988aae Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 12 Apr 2023 10:09:43 -0700 Subject: [PATCH] Fixing some syntactic errors with a number of detections. --- ...failed_requests_to_access_applications.yml | 45 ++++---- .../okta_risk_threshold_exceeded.yml | 57 +++++----- ...supply_chain_attack_network_indicators.yml | 55 +++++----- ...ows_ad_domain_replication_acl_addition.yml | 93 ++++++++-------- ...rivileged_account_sid_history_addition.yml | 103 +++++++++--------- .../windows_vulnerable_driver_loaded.yml | 83 +++++++------- ...windows_ad_replication_service_traffic.yml | 65 +++++------ ...gue_domain_controller_network_activity.yml | 49 +++++---- 8 files changed, 286 insertions(+), 264 deletions(-) diff --git a/detections/application/okta_multiple_failed_requests_to_access_applications.yml b/detections/application/okta_multiple_failed_requests_to_access_applications.yml index 58558f97a6..7335bb5b27 100644 --- a/detections/application/okta_multiple_failed_requests_to_access_applications.yml +++ b/detections/application/okta_multiple_failed_requests_to_access_applications.yml @@ -1,12 +1,13 @@ name: Okta Multiple Failed Requests to Access Applications id: 1c21fed1-7000-4a2e-9105-5aaafa437247 version: 1 -date: '2023-03-17' +date: "2023-03-17" author: John Murphy, Okta, Michael Haag, Splunk type: Hunting status: experimental data_source: [] -description: 'The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: \ +description: + 'The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: \ * Retrieves policy evaluation and SSO details in events that contain the Application requested \ * Formats target fields so we can aggregate specifically on Applications (AppInstances) \ @@ -16,37 +17,37 @@ description: 'The following analytic identifies multiple failed app requests in * Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies \ * Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.' -search: "`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip('target{}.type', 'target{}.displayName', \": \") | eval targets=mvfilter(targets LIKE \"AppInstance%\") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType=\"policy.evaluate_sign_on\",targets,NULL))) as total_challenges sum(eval(if(eventType=\"user.authentication.sso\",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0 | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if(\"outcome.result\"=\"SUCCESS\",targets,NULL))) as success_apps values(eval(if(\":outcome.result\"!=\"SUCCESS\",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity=\"HIGH\", mitre_technique_id=\"T1538\", description=\"actor.alternateId\". \" from \" . \"client.ipAddress\" . \" seen opening \" . total_challenges . \" chiclets/apps with \" . total_successes . \" challenges successfully passed\" | fields - count, targets | search ratio < 0.5 total_challenges > 2` | okta_multiple_failed_requests_to_access_applications_filter`" +search: '`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip(''target{}.type'', ''target{}.displayName'', ": ") | eval targets=mvfilter(targets LIKE "AppInstance%") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType="policy.evaluate_sign_on",targets,NULL))) as total_challenges sum(eval(if(eventType="user.authentication.sso",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0 | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if("outcome.result"="SUCCESS",targets,NULL))) as success_apps values(eval(if(":outcome.result"!="SUCCESS",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity="HIGH", mitre_technique_id="T1538", description="actor.alternateId". " from " . "client.ipAddress" . " seen opening " . total_challenges . " chiclets/apps with " . total_successes . " challenges successfully passed" | fields - count, targets | search ratio < 0.5 total_challenges > 2 | `okta_multiple_failed_requests_to_access_applications_filter`' how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested. -known_false_positives: False positives may be present based on organization size and configuration of Okta. +known_false_positives: False positives may be present based on organization size and configuration of Okta. references: -- https://attack.mitre.org/techniques/T1538 -- https://attack.mitre.org/techniques/T1550/004 + - https://attack.mitre.org/techniques/T1538 + - https://attack.mitre.org/techniques/T1550/004 tags: analytic_story: - - Suspicious Okta Activity + - Suspicious Okta Activity asset_type: Infrastructure confidence: 70 impact: 80 message: Multiple Failed Requests to Access Applications via Okta for $actor.alternateId$. mitre_attack_id: - - T1550.004 - - T1538 + - T1550.004 + - T1538 observable: - - name: actor.alternateId - type: User - role: - - Victim + - name: actor.alternateId + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud required_fields: - - _time - - authenticationContext.externalSessionId - - targets - - actor.alternateId - - client.ipAddress - - eventType + - _time + - authenticationContext.externalSessionId + - targets + - actor.alternateId + - client.ipAddress + - eventType risk_score: 56 security_domain: access diff --git a/detections/application/okta_risk_threshold_exceeded.yml b/detections/application/okta_risk_threshold_exceeded.yml index 381a021b25..4f7326338a 100644 --- a/detections/application/okta_risk_threshold_exceeded.yml +++ b/detections/application/okta_risk_threshold_exceeded.yml @@ -1,17 +1,19 @@ name: Okta Risk Threshold Exceeded id: d8b967dd-657f-4d88-93b5-c588bcd7218c version: 1 -date: '2022-09-29' +date: "2022-09-29" author: Michael Haag, Splunk status: production type: Correlation -description: The following correlation will take risk associated with the content +description: + The following correlation will take risk associated with the content from "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic stories and tally it up. Once it hits the threshold of 100 (may be changed), it will trigger an anomaly. As needed, reduce or raise the risk scores assocaited with the anomaly and TTP analytics tagged to these two stories. data_source: [] -search: '| tstats `summariesonly` sum(All_Risk.calculated_risk_score) as risk_score, +search: + '| tstats `security_content_summariesonly` sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count,values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) @@ -22,45 +24,48 @@ search: '| tstats `summariesonly` sum(All_Risk.calculated_risk_score) as risk_sc risk_threshold=100 | where All_Risk.analyticstories IN ("Suspicious Okta Activity", "Okta MFA Exhaustion") risk_score > $risk_threshold$ | `get_risk_severity(risk_score)` | `okta_risk_threshold_exceeded_filter`' -how_to_implement: Ensure "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic +how_to_implement: + Ensure "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic stories are enabled. TTP may be set to Notables for point detections, anomaly should not be notables but risk generators. The correlation relies on risk before generating a notable. Modify the value as needed. Default threshold is 100. This value may need to be increased based on activity in your environment. -known_false_positives: False positives will be limited to the amount of events generated +known_false_positives: + False positives will be limited to the amount of events generated by the analytics tied to the stories. Analytics will need to be tesetd and tuned, risk score reduced, as needed based on organization. references: -- https://developer.okta.com/docs/reference/api/event-types -- https://sec.okta.com/everythingisyes + - https://developer.okta.com/docs/reference/api/event-types + - https://sec.okta.com/everythingisyes tags: analytic_story: - - Suspicious Okta Activity - - Okta MFA Exhaustion + - Suspicious Okta Activity + - Okta MFA Exhaustion asset_type: Infrastructure confidence: 80 impact: 70 - message: Risk threshold exceeded for $risk_object_type$=$risk_object$ related to + message: + Risk threshold exceeded for $risk_object_type$=$risk_object$ related to Okta events. mitre_attack_id: - - T1078 - - T1110 + - T1078 + - T1110 observable: - - name: risk_object - type: Other - role: - - Victim - - name: risk_object_type - type: Other - role: - - Victim + - name: risk_object + type: Other + role: + - Victim + - name: risk_object_type + type: Other + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud required_fields: - - All_Risk.risk_object - - All_Risk.risk_object_type - - All_Risk.analyticstories + - All_Risk.risk_object + - All_Risk.risk_object_type + - All_Risk.analyticstories risk_score: 56 security_domain: access diff --git a/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml b/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml index b903625ce5..651a91fe40 100644 --- a/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml +++ b/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml @@ -1,19 +1,20 @@ name: 3CX Supply Chain Attack Network Indicators id: 791b727c-deec-4fbe-a732-756131b3c5a1 version: 1 -date: '2023-03-30' +date: "2023-03-30" author: Michael Haag, Splunk type: TTP status: experimental data_source: [] description: The analytic provided below employs the Network_Resolution datamodel to detect domain indicators associated with the 3CX supply chain attack. By leveraging this query, you can efficiently conduct retrospective analysis of your data to uncover potential compromises. -search: '| tstats `summariesonly` values(DNS.answer) as IPs min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query - | `drop_dm_object_name(DNS)` +search: + "| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query + | `drop_dm_object_name(DNS)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | lookup 3cx_ioc_domains domain as query OUTPUT Description isIOC | search isIOC=true - | `3cx_supply_chain_attack_network_indicators_filter`' + | `3cx_supply_chain_attack_network_indicators_filter`" how_to_implement: To successfully implement this search you need to be ingesting information into the `Network Resolution` datamodel in the `DNS` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA''s are installed. known_false_positives: False positives will be present for accessing the 3cx[.]com website. Remove from the lookup as needed. references: @@ -24,37 +25,37 @@ references: - https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/ tags: analytic_story: - - 3CX Supply Chain Attack + - 3CX Supply Chain Attack asset_type: Network confidence: 100 cve: - - CVE-2023-29059 + - CVE-2023-29059 impact: 100 message: Indicators related to 3CX supply chain attack have been identified on $src$. mitre_attack_id: - - T1195.002 + - T1195.002 observable: - - name: src - type: Hostname - role: - - Victim - - name: query - type: URL Domain - role: - - Attacker + - name: src + type: Hostname + role: + - Victim + - name: query + type: URL Domain + role: + - Attacker product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud required_fields: - - DNS.src - - DNS.query - - _time + - DNS.src + - DNS.query + - _time risk_score: 100 security_domain: network tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_network-windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_network-windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index e8421664fa..6305fb636c 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -1,66 +1,69 @@ name: Windows AD Domain Replication ACL Addition id: 8c372853-f459-4995-afdc-280c114d33ab version: 1 -date: '2022-11-18' +date: "2022-11-18" author: Dean Luxton type: TTP status: production data_source: [] -description: This analytic detects the addition of the permissions necessary to perform a DCSync attack. - In order to replicate AD objects, the initiating user or computer must have the following permissions on the domain. - - DS-Replication-Get-Changes - - DS-Replication-Get-Changes-All - Certain Sync operations may require the additional permission of DS-Replication-Get-Changes-In-Filtered-Set. - By default, adding DCSync permissions via the Powerview Add-ObjectACL operation adds all 3. This alert identifies where this trifecta has been met, and also where just the base level requirements have been met. +description: + This analytic detects the addition of the permissions necessary to perform a DCSync attack. + In order to replicate AD objects, the initiating user or computer must have the following permissions on the domain. + - DS-Replication-Get-Changes + - DS-Replication-Get-Changes-All + Certain Sync operations may require the additional permission of DS-Replication-Get-Changes-In-Filtered-Set. + By default, adding DCSync permissions via the Powerview Add-ObjectACL operation adds all 3. This alert identifies where this trifecta has been met, and also where just the base level requirements have been met. search: '`wineventlog_security` | rex field=AttributeValue max_match=10000 \"OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?PS-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)\"| table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid| mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,\"true\",\"false\"), fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,\"true\",\"false\")| where minDCSyncPermissions=\"true\" | lookup identity_lookup_expanded objectSid as DSRGetChanges_user_sid OUTPUT sAMAccountName as user | rename DSRGetChanges_user_sid as userSid | stats min(_time) as _time values(user) as user by dest src_user userSid minDCSyncPermissions fullSet| `windows_ad_domain_replication_acl_addition_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting the eventcode 5136. The Advanced Security Audit policy setting - `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to `Write All Properties` - applied to the domain root and all descendant objects. Once the necessary logging has been enabled, enumerate the domain policy to verify if existing - accounts with access need to be whitelisted, or revoked. Assets and Identities is also leveraged to automatically translate the objectSid into username. - Ensure your identities lookup is configured with the sAMAccountName and objectSid of all AD user and computer objects. -known_false_positives: When there is a change to nTSecurityDescriptor, Windows logs the entire ACL with the newly added components. - If existing accounts are present with this permission, they will raise an alert each time the nTSecurityDescriptor is updated unless whitelisted. +how_to_implement: + To successfully implement this search, you need to be ingesting the eventcode 5136. The Advanced Security Audit policy setting + `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to `Write All Properties` + applied to the domain root and all descendant objects. Once the necessary logging has been enabled, enumerate the domain policy to verify if existing + accounts with access need to be whitelisted, or revoked. Assets and Identities is also leveraged to automatically translate the objectSid into username. + Ensure your identities lookup is configured with the sAMAccountName and objectSid of all AD user and computer objects. +known_false_positives: + When there is a change to nTSecurityDescriptor, Windows logs the entire ACL with the newly added components. + If existing accounts are present with this permission, they will raise an alert each time the nTSecurityDescriptor is updated unless whitelisted. references: -- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb -- https://github.com/SigmaHQ/sigma/blob/29a5c62784faf986dc03952ae3e90e3df3294284/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb + - https://github.com/SigmaHQ/sigma/blob/29a5c62784faf986dc03952ae3e90e3df3294284/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint - confidence: 80 + confidence: 80 impact: 100 message: $src_user$ has granted $user$ permission to replicate AD objects mitre_attack_id: - - T1484 + - T1484 observable: - - name: user - type: User - role: - - Victim - - name: src_user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud required_fields: - - _time - - dest - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass + - _time + - dest + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass risk_score: 80 security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml index 3c5fe213d0..7e0bdd2349 100644 --- a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml @@ -1,71 +1,74 @@ name: Windows AD Privileged Account SID History Addition id: 6b521149-b91c-43aa-ba97-c2cac59ec830 version: 1 -date: '2022-09-12' +date: "2022-09-12" author: Dean Luxton type: TTP status: production data_source: -- Windows Security 4742 -- Windows Security 4738 -description: This detection identifies when the SID of a privileged user is added to - the SID History attribute of another user. Useful for tracking SID history abuse - across multiple domains. This detection leverages the Asset and Identities - framework. See the implementation section for further details on configuration. -search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) - | rex field=SidHistory "(^%{|^)(?P.*?)(}$|$)" - | eval category="privileged" - | lookup identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match - | where isnotnull(match) - | rename TargetSid as userSid - | table _time action status host user userSid SidHistory Logon_ID src_user - | `windows_active_directory_privileged_account_sid_history_addition_filter`' -how_to_implement: Ensure you have objectSid and the Down Level Logon Name `DOMAIN\sAMACountName` - added to the identity field of your Asset and Identities lookup, along with the - category of privileged for the applicable users. Ensure you are - ingesting eventcodes 4742 and 4738. Two advanced audit policies - `Audit User Account Management` and `Audit Computer Account Management` under - `Account Management` are required to generate these event codes. -known_false_positives: Migration of privileged accounts. + - Windows Security 4742 + - Windows Security 4738 +description: + This detection identifies when the SID of a privileged user is added to + the SID History attribute of another user. Useful for tracking SID history abuse + across multiple domains. This detection leverages the Asset and Identities + framework. See the implementation section for further details on configuration. +search: + '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) + | rex field=SidHistory "(^%{|^)(?P.*?)(}$|$)" + | eval category="privileged" + | lookup identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match + | where isnotnull(match) + | rename TargetSid as userSid + | table _time action status host user userSid SidHistory Logon_ID src_user + | `windows_ad_privileged_account_sid_history_addition_filter`' +how_to_implement: + Ensure you have objectSid and the Down Level Logon Name `DOMAIN\sAMACountName` + added to the identity field of your Asset and Identities lookup, along with the + category of privileged for the applicable users. Ensure you are + ingesting eventcodes 4742 and 4738. Two advanced audit policies + `Audit User Account Management` and `Audit Computer Account Management` under + `Account Management` are required to generate these event codes. +known_false_positives: Migration of privileged accounts. references: -- https://adsecurity.org/?p=1772 + - https://adsecurity.org/?p=1772 tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 90 impact: 100 message: A Privileged User Account SID History Attribute was added to $user$ by $src_user$ mitre_attack_id: - - T1134.005 - - T1134 + - T1134.005 + - T1134 observable: - - name: src_user - type: User - role: - - Victim - - name: user - type: User - role: - - Victim + - name: src_user + type: User + role: + - Victim + - name: user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud required_fields: - - _time - - EventCode - - SidHistory - - TargetSid - - TargetDomainName - - user - - src_user - - Logon_ID + - _time + - EventCode + - SidHistory + - TargetSid + - TargetDomainName + - user + - src_user + - Logon_ID risk_score: 90 security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_vulnerable_driver_loaded.yml b/detections/endpoint/windows_vulnerable_driver_loaded.yml index a776c0093f..cd5337c70b 100644 --- a/detections/endpoint/windows_vulnerable_driver_loaded.yml +++ b/detections/endpoint/windows_vulnerable_driver_loaded.yml @@ -1,72 +1,77 @@ name: Windows Vulnerable Driver Loaded id: a2b1f1ef-221f-4187-b2a4-d4b08ec745f4 version: 1 -date: '2022-12-12' +date: "2022-12-12" author: Michael Haag, Splunk status: experimental type: Hunting -description: The following analytic utilizes a known list of vulnerable Windows drivers +description: + The following analytic utilizes a known list of vulnerable Windows drivers to help defenders find potential persistence or privelege escalation via a vulnerable driver. This analytic uses Sysmon EventCode 6, driver loading. A known gap with this lookup is that it does not use the hash or known signer of the vulnerable driver therefore it is up to the defender to identify version and signing info and confirm it is a vulnerable driver. data_source: -- Sysmon Event ID 6 -search: '`sysmon` EventCode=6 | lookup loldrivers driver_name AS ImageLoaded OUTPUT + - Sysmon Event ID 6 +search: + "`sysmon` EventCode=6 | lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description | search is_driver = TRUE | stats min(_time) as firstTime max(_time) as lastTime count by dest ImageLoaded driver_description | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_loading_known_vulnerable_driver_filter`' -how_to_implement: Sysmon collects driver loads via EventID 6, however you may modify + | `security_content_ctime(lastTime)` | `windows_vulnerable_driver_loaded_filter`" +how_to_implement: + Sysmon collects driver loads via EventID 6, however you may modify the query to utilize this lookup to identify potentially persistent drivers that are known to be vulnerable. -known_false_positives: False positives will be present. Drill down into the driver +known_false_positives: + False positives will be present. Drill down into the driver further by version number and cross reference by signer. Review the reference material in the lookup. In addition, modify the query to look within specific paths, which will remove a lot of "normal" drivers. references: -- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_vuln_drivers_names.yml -- https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md -- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules -- https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/ -- https://github.com/jbaines-r7/dellicious -- https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md -- https://github.com/namazso/physmem_drivers -- https://github.com/stong/CVE-2020-15368 -- https://github.com/CaledoniaProject/drivers-binaries -- https://github.com/Chigusa0w0/AsusDriversPrivEscala -- https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/ -- https://eclypsium.com/2019/11/12/mother-of-all-drivers/ -- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37969 + - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_vuln_drivers_names.yml + - https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md + - https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules + - https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/ + - https://github.com/jbaines-r7/dellicious + - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md + - https://github.com/namazso/physmem_drivers + - https://github.com/stong/CVE-2020-15368 + - https://github.com/CaledoniaProject/drivers-binaries + - https://github.com/Chigusa0w0/AsusDriversPrivEscala + - https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/ + - https://eclypsium.com/2019/11/12/mother-of-all-drivers/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37969 tags: analytic_story: - - Windows Drivers + - Windows Drivers asset_type: Endpoint confidence: 50 impact: 50 - message: An process has loaded a possible vulnerable driver on $dest$. Review and + message: + An process has loaded a possible vulnerable driver on $dest$. Review and escalate as needed. mitre_attack_id: - - T1543.003 + - T1543.003 observable: - - name: dest - type: Hostname - role: - - Victim + - name: dest + type: Hostname + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud required_fields: - - _time - - dest - - ImageLoaded + - _time + - dest + - ImageLoaded risk_score: 25 security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/detections/network/windows_ad_replication_service_traffic.yml b/detections/network/windows_ad_replication_service_traffic.yml index df3e625ee7..9df3c90b3e 100644 --- a/detections/network/windows_ad_replication_service_traffic.yml +++ b/detections/network/windows_ad_replication_service_traffic.yml @@ -1,56 +1,59 @@ name: Windows AD Replication Service Traffic id: c6e24183-a5f4-4b2a-ad01-2eb456d09b67 version: 1 -date: '2022-11-26' +date: "2022-11-26" author: Steven Dick type: TTP status: experimental data_source: [] -description: This search looks for evidence of Active Directory replication traffic [MS-DRSR] from unexpected sources. - This traffic is often seen exclusively between Domain Controllers for AD database replication. - Any detections from non-domain controller source to a domain controller may indicate the usage of DCSync or DCShadow credential dumping techniques. -search: ' | tstats `security_content_summariesonly` count values(All_Traffic.transport) as transport values(All_Traffic.user) as user +description: + This search looks for evidence of Active Directory replication traffic [MS-DRSR] from unexpected sources. + This traffic is often seen exclusively between Domain Controllers for AD database replication. + Any detections from non-domain controller source to a domain controller may indicate the usage of DCSync or DCShadow credential dumping techniques. +search: + '| tstats `security_content_summariesonly` count values(All_Traffic.transport) as transport values(All_Traffic.user) as user values(All_Traffic.src_category) as src_category values(All_Traffic.dest_category) as dest_category min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app IN ("ms-dc-replication","*drsr*","ad drs") by All_Traffic.src All_Traffic.dest All_Traffic.app - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `windows_ad_replication_service_traffic_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - application aware firewall or proxy logs into the Network Datamodel. Categorize +how_to_implement: + To successfully implement this search, you need to be ingesting + application aware firewall or proxy logs into the Network Datamodel. Categorize all known domain controller Assets servers with an appropriate category for filtering. known_false_positives: New domain controllers or certian scripts run by administrators. references: -- https://adsecurity.org/?p=1729 -- https://attack.mitre.org/techniques/T1003/006/ -- https://attack.mitre.org/techniques/T1207/ + - https://adsecurity.org/?p=1729 + - https://attack.mitre.org/techniques/T1003/006/ + - https://attack.mitre.org/techniques/T1207/ tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: endpoint confidence: 100 impact: 100 message: Active Directory Replication Traffic from Unknown Source - $src$ mitre_attack_id: - - T1003 - - T1003.006 - - T1207 + - T1003 + - T1003.006 + - T1207 observable: - - name: dest - type: IP Address - role: - - Victim - - name: src - type: IP Address - role: - - Attacker + - name: dest + type: IP Address + role: + - Victim + - name: src + type: IP Address + role: + - Attacker product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud required_fields: - - All_Traffic.src - - All_Traffic.dest - - All_Traffic.app + - All_Traffic.src + - All_Traffic.dest + - All_Traffic.app risk_score: 100 - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/network/windows_ad_rogue_domain_controller_network_activity.yml b/detections/network/windows_ad_rogue_domain_controller_network_activity.yml index 479c4d75a6..24875ceda1 100644 --- a/detections/network/windows_ad_rogue_domain_controller_network_activity.yml +++ b/detections/network/windows_ad_rogue_domain_controller_network_activity.yml @@ -1,46 +1,47 @@ name: Windows AD Rogue Domain Controller Network Activity id: c4aeeeef-da7f-4338-b3ba-553cbcbe2138 version: 1 -date: '2022-09-08' +date: "2022-09-08" author: Dean Luxton type: TTP status: experimental data_source: [] -description: This detection is looking at zeek wiredata for specific replication RPC calls being performed from a device which is not a domain controller. - If you would like to capture these RPC calls using Splunk Stream, please vote for my idea here https://ideas.splunk.com/ideas/APPSID-I-619 ;) +description: + This detection is looking at zeek wiredata for specific replication RPC calls being performed from a device which is not a domain controller. + If you would like to capture these RPC calls using Splunk Stream, please vote for my idea here https://ideas.splunk.com/ideas/APPSID-I-619 ;) search: '`zeek_rpc` DrsReplicaAdd OR DRSGetNCChanges | where NOT (dest_category="Domain Controller") OR NOT (src_category="Domain Controller") - | fillnull value="Unknown" src_category, dest_category - | table _time endpoint operation src src_category dest dest_category | `rogue_dc_network_activity_filter`' -how_to_implement: Run zeek on domain controllers to capture the DCE RPC calls, ensure the domain controller categories are defined in Assets and Identities. -known_false_positives: None. + | fillnull value="Unknown" src_category, dest_category + | table _time endpoint operation src src_category dest dest_category | `windows_ad_rogue_domain_controller_network_activity_filter`' +how_to_implement: Run zeek on domain controllers to capture the DCE RPC calls, ensure the domain controller categories are defined in Assets and Identities. +known_false_positives: None. references: -- https://adsecurity.org/?p=1729 + - https://adsecurity.org/?p=1729 tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 100 impact: 100 message: Rogue DC Activity Detected from $src_category$ device $src$ to $dest$ ($dest_category$) mitre_attack_id: - - T1207 + - T1207 observable: - - name: src - type: IP Address - role: - - Attacker - - name: dest - type: IP Address - role: - - Victim + - name: src + type: IP Address + role: + - Attacker + - name: dest + type: IP Address + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud required_fields: - - _time - - src - - dest + - _time + - src + - dest risk_score: 100 security_domain: network