mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
pyth0n1c
@@ -0,0 +1,69 @@
|
||||
name: Windows Access Token Manipulation SeDebugPrivilege
|
||||
id: 6ece9ed0-5f92-4315-889d-48560472b188
|
||||
version: 1
|
||||
date: '2022-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
description: The following analytic identifies a suspicious process enabling the "SeDebugPrivilege" privilege token.
|
||||
SeDebugPrivilege allows a process to inspect and adjust the memory of other processes, and has long been a security concern. SeDebugPrivilege allows the token bearer to access any process or thread, regardless of security descriptors, per Palantir.
|
||||
This technique is abused by adversaries to gain debug privileges with their malicious software to be able to access or debug a process to dump credentials or to inject malicious code.
|
||||
search: '`wineventlog_security` EventCode=4703 EnabledPrivilegeList = "*SeDebugPrivilege*" AND NOT(ProcessName IN ("*\\Program File*", "*\\System32\\lsass.exe*", "*\\SysWOW64\\lsass.exe*", "*\\SysWOW64\\svchost.exe*", "*\\System32\\svchost.exe*"))
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by Computer ProcessName ProcessId SubjectDomainName SubjectUserName SubjectUserSid TargetUserName TargetLogonId TargetDomainName EnabledPrivilegeList action
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_access_token_manipulation_sedebugprivilege_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Windows Security Event Logs with 4703 EventCode enabled. The Windows TA is also
|
||||
required.
|
||||
known_false_positives: Some native binaries and browser applications may request SeDebugPrivilege. Filter as needed.
|
||||
references:
|
||||
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703
|
||||
- https://devblogs.microsoft.com/oldnewthing/20080314-00/?p=23113
|
||||
- https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
|
||||
- https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication
|
||||
tags:
|
||||
analytic_story:
|
||||
- Brute Ratel C4
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 60
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml.log
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: A process $ProcessName$ adjust its privileges with SeDebugPrivilege on $Computer$.
|
||||
mitre_attack_id:
|
||||
- T1134.002
|
||||
- T1134
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: Computer
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- ProcessName
|
||||
- Security_ID
|
||||
- action
|
||||
- result
|
||||
- Process_ID
|
||||
- Message
|
||||
- member_dn
|
||||
- ComputerName
|
||||
- user
|
||||
risk_score: 36
|
||||
security_domain: endpoint
|
||||
+74
@@ -0,0 +1,74 @@
|
||||
name: Windows Access Token Manipulation Winlogon Duplicate Token Handle
|
||||
id: dda126d7-1d99-4f0b-b72a-4c14031f9398
|
||||
version: 1
|
||||
date: '2022-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel: []
|
||||
description: The following analytic identifies a process requesting access to winlogon.exe attempting to duplicate its handle.
|
||||
This technique was seen in several adversaries to gain privileges for their process.
|
||||
Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
|
||||
search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") GrantedAccess = 0x1040
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime
|
||||
by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId GrantedAccess CallTrace Computer user_id
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting data
|
||||
that records process activity from your hosts to populate the endpoint data model
|
||||
in the processes node. If you are using Sysmon, you must have at least version 6.0.4
|
||||
of the Sysmon TA.
|
||||
known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed.
|
||||
references:
|
||||
- https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle
|
||||
- https://attack.mitre.org/techniques/T1134/001/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Brute Ratel C4
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 60
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: A process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$
|
||||
mitre_attack_id:
|
||||
- T1134.001
|
||||
- T1134
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: Computer
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- name: SourceImage
|
||||
type: Process Name
|
||||
role:
|
||||
- Parent Process
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- SourceImage
|
||||
- TargetImage
|
||||
- SourceProcessGUID
|
||||
- TargetProcessGUID
|
||||
- SourceProcessId
|
||||
- TargetProcessId
|
||||
- GrantedAccess
|
||||
- CallTrace
|
||||
- Computer
|
||||
- user_id
|
||||
risk_score: 36
|
||||
security_domain: endpoint
|
||||
+75
@@ -0,0 +1,75 @@
|
||||
name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path
|
||||
id: b8f7ed6b-0556-4c84-bffd-839c262b0278
|
||||
version: 1
|
||||
date: '2022-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
description: The following analytic identifies a process requesting access in winlogon.exe to duplicate its handle with a non-common or public process source path.
|
||||
This technique was seen where adversaries attempt to gain privileges to their process.
|
||||
This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and using it to a new process instance.
|
||||
Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
|
||||
search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") AND GrantedAccess = 0x1040
|
||||
AND NOT (SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*"))
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId GrantedAccess CallTrace
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting data
|
||||
that records process activity from your hosts to populate the endpoint data model
|
||||
in the processes node. If you are using Sysmon, you must have at least version 6.0.4
|
||||
of the Sysmon TA.
|
||||
known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed.
|
||||
references:
|
||||
- https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle
|
||||
- https://attack.mitre.org/techniques/T1134/001/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Brute Ratel C4
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: a process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$
|
||||
mitre_attack_id:
|
||||
- T1134.001
|
||||
- T1134
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: Computer
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- name: SourceImage
|
||||
type: Process Name
|
||||
role:
|
||||
- Parent Process
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- SourceImage
|
||||
- TargetImage
|
||||
- SourceProcessGUID
|
||||
- TargetProcessGUID
|
||||
- SourceProcessId
|
||||
- TargetProcessId
|
||||
- GrantedAccess
|
||||
- CallTrace
|
||||
- Computer
|
||||
- user_id
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Defacement Modify Transcodedwallpaper File
|
||||
id: e11c3d90-5bc7-42ad-94cd-ba75db10d897
|
||||
version: 1
|
||||
date: '2022-08-25'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a modification to the Transcodedwallpaper file in the wallpaper theme directory
|
||||
to change the wallpaper of the host machine. This technique was seen in adversaries attempting to deface
|
||||
or change the desktop wallpaper of the targeted host. During our testing, the common process that affects or changes the wallpaper
|
||||
if a user changes it via desktop personalized setting is explorer.exe.
|
||||
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_path !="*\\Windows\\Explorer.EXE"
|
||||
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid Processes.original_file_name
|
||||
| `drop_dm_object_name(Processes)`
|
||||
|rename process_guid as proc_guid
|
||||
| join proc_guid, _time [
|
||||
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
|
||||
where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper"
|
||||
by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid
|
||||
| `drop_dm_object_name(Filesystem)`
|
||||
|rename process_guid as proc_guid
|
||||
| fields file_name file_path process_name process_path process dest file_create_time _time proc_guid]
|
||||
| `windows_defacement_modify_transcodedwallpaper_file_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the
|
||||
process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition,
|
||||
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
known_false_positives: 3rd part software application can change the wallpaper. Filter is needed.
|
||||
references:
|
||||
- https://forums.ivanti.com/s/article/Wallpaper-Windows-Settings-Desktop-Settings-and-the-transcodedwallpaper-jpg?language=en_US
|
||||
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_sifreli.a
|
||||
tags:
|
||||
analytic_story:
|
||||
- Brute Ratel C4
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Execution
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon.log
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: modification or creation of transcodedwallpaper file by $process_name$ in $dest$
|
||||
mitre_attack_id:
|
||||
- T1491
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: process_name
|
||||
type: Process
|
||||
role:
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- dest
|
||||
- file_create_time
|
||||
- file_name
|
||||
- file_path
|
||||
- process_name
|
||||
- process_path
|
||||
- process
|
||||
risk_score: 9
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,76 @@
|
||||
name: Windows Process Injection With Public Source Path
|
||||
id: 492f09cf-5d60-4d87-99dd-0bc325532dda
|
||||
version: 1
|
||||
date: '2022-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel: []
|
||||
description: The following analytic identifies a process in a non-standard file path on Windows attempting to create a remote thread into a process. This Windows API,CreateRemoteThread, is commonly used by adversaries
|
||||
for process injection to evade detections or gain privilege escalation.
|
||||
search: '`sysmon` EventCode=8 TargetImage = "*.exe" AND NOT(SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*"))
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage signature TargetProcessGuid SourceProcessGuid TargetProcessId SourceProcessId StartAddress EventCode Computer
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_process_injection_with_public_source_path_filter`'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting data
|
||||
that records process activity from your hosts to populate the endpoint data model
|
||||
in the processes node. If you are using Sysmon, you must have at least version 6.0.4
|
||||
of the Sysmon TA.
|
||||
known_false_positives: Some security products or third party applications may utilize CreateRemoteThread, filter as needed before enabling as a notable.
|
||||
references:
|
||||
- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Brute Ratel C4
|
||||
asset_type: 80
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/create_remote_thread/sysmon.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: process $SourceImage$ create a remote thread to process $TargetImage$ on host $Computer$
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
- T1055.002
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: Computer
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: SourceImage
|
||||
type: Process
|
||||
role:
|
||||
- Attacker
|
||||
- name: TargetImage
|
||||
type: Process
|
||||
role:
|
||||
- Target
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- SourceImage
|
||||
- TargetImage
|
||||
- TargetProcessId
|
||||
- SourceProcessId
|
||||
- StartAddress
|
||||
- EventCode
|
||||
- Computer
|
||||
- signature
|
||||
- TargetProcessGuid
|
||||
- SourceProcessGuid
|
||||
- StartAddress
|
||||
risk_score: 64
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,72 @@
|
||||
name: Windows Service Deletion In Registry
|
||||
id: daed6823-b51c-4843-a6ad-169708f1323e
|
||||
version: 1
|
||||
date: '2022-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a service being deleted from the Windows Registry under CurrentControlSet\Services.
|
||||
Adversaries may delete a service as part of defense evasion.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
|
||||
where Registry.registry_path= "*\\SYSTEM\\CurrentControlSet\\Services*" AND (Registry.action = deleted OR (Registry.registry_value_name = DeleteFlag AND Registry.registry_value_data = 0x00000001 AND Registry.action=modified))
|
||||
by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_value_name Registry.action Registry.dest
|
||||
| `drop_dm_object_name(Registry)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_service_deletion_in_registry_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
|
||||
that this registry was included in your config files ex. sysmon config to be monitored.
|
||||
known_false_positives: This event can be seen when administrator delete a service or uninstall/reinstall a software that creates service entry,
|
||||
but it is still recommended to check this alert with high priority.
|
||||
references:
|
||||
- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Brute Ratel C4
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: A service was deleted on $dest$ within the Windows registry.
|
||||
mitre_attack_id:
|
||||
- T1489
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.user
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
- Processes.process_id
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.dest
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.process_guid
|
||||
risk_score: 18
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Access Token Manipulation SeDebugPrivilege Unit Test
|
||||
tests:
|
||||
- name: Windows Access Token Manipulation SeDebugPrivilege
|
||||
file: endpoint/windows_access_token_manipulation_sedebugprivilege.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: security-xml.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
update_timestamp: true
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
name: Windows Access Token Manipulation Winlogon Duplicate Token Handle Unit Test
|
||||
tests:
|
||||
- name: Windows Access Token Manipulation Winlogon Duplicate Token Handle
|
||||
file: endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path Unit Test
|
||||
tests:
|
||||
- name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path
|
||||
file: endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Defacement Modify Transcodedwallpaper File Unit Test
|
||||
tests:
|
||||
- name: Windows Defacement Modify Transcodedwallpaper File
|
||||
file: endpoint/windows_defacement_modify_transcodedwallpaper_file.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Process Injection With Public Source Path Unit Test
|
||||
tests:
|
||||
- name: Windows Process Injection With Public Source Path
|
||||
file: endpoint/windows_process_injection_with_public_source_path.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/create_remote_thread/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Service Deletion In Registry Unit Test
|
||||
tests:
|
||||
- name: Windows Service Deletion In Registry
|
||||
file: endpoint/windows_service_deletion_in_registry.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
|
||||
update_timestamp: true
|
||||
Reference in New Issue
Block a user