From 159f22e9af9d386ec3e6c433803305357059ffab Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 18 Apr 2023 13:00:52 -0700 Subject: [PATCH 1/6] manual test --- .../aws_multiple_users_failing_to_authenticate_from_ip.yml | 2 +- .../cloud_provisioning_activity_from_previously_unseen_city.yml | 1 + ...oud_provisioning_activity_from_previously_unseen_country.yml | 1 + ..._provisioning_activity_from_previously_unseen_ip_address.yml | 1 + ...loud_provisioning_activity_from_previously_unseen_region.yml | 1 + 5 files changed, 5 insertions(+), 1 deletion(-) diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index 83102a0a19..a0e7aadc44 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -56,10 +56,10 @@ tags: - src_ip risk_score: 54 security_domain: threat + manual_test: This search needs has time window and events split up in CI. Tested manually tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json source: aws_cloudtrail sourcetype: aws:cloudtrail - update_timestamp: true diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml index 06696213ba..7507a5ad98 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml @@ -77,6 +77,7 @@ tags: - All_Changes.command risk_score: 18 security_domain: threat + manual_test: This search needs the baseline to be run first to create a lookup tests: - name: True Positive Test attack_data: diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml index 65e30efbcc..6c47c7d635 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml @@ -77,6 +77,7 @@ tags: - All_Changes.command risk_score: 42 security_domain: threat + manual_test: This search needs the baseline to be run first to create a lookup tests: - name: True Positive Test attack_data: diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml index f1347bb8c1..d5f4968758 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml @@ -76,6 +76,7 @@ tags: - All_Changes.command risk_score: 42 security_domain: threat + manual_test: This search needs the baseline to be run first to create a lookup tests: - name: True Positive Test attack_data: diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml index a45e258f42..f72a0dc556 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml @@ -77,6 +77,7 @@ tags: - All_Changes.command risk_score: 42 security_domain: threat + manual_test: This search needs the baseline to be run first to create a lookup tests: - name: True Positive Test attack_data: From 13c4b3f1e3a4e796d07dbe54991d6e9433d7ad21 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 18 Apr 2023 13:13:57 -0700 Subject: [PATCH 2/6] 3 more --- .../windows_ad_domain_controller_audit_policy_disabled.yml | 1 + .../endpoint/windows_ad_domain_replication_acl_addition.yml | 1 + .../windows_ad_privileged_account_sid_history_addition.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index 96f64bec8a..890519be9d 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -41,6 +41,7 @@ tags: - SubcategoryGuid risk_score: 60 security_domain: endpoint + manual_test: True, needs to be investigated tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 6305fb636c..77cde718d1 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -61,6 +61,7 @@ tags: - ObjectClass risk_score: 80 security_domain: endpoint + manual_test: True, needs to be investigated! tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml index 7e0bdd2349..2b011d2ae2 100644 --- a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml @@ -66,6 +66,7 @@ tags: - Logon_ID risk_score: 90 security_domain: endpoint + manual_test: True, needs to be investigated tests: - name: True Positive Test attack_data: From c86fe48dfa0b3d12b4b160c969e3d89b4cbce91c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 18 Apr 2023 14:08:19 -0700 Subject: [PATCH 3/6] Update windows_ad_domain_controller_audit_policy_disabled.yml --- .../windows_ad_domain_controller_audit_policy_disabled.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index 890519be9d..78c5c9e165 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -41,10 +41,10 @@ tags: - SubcategoryGuid risk_score: 60 security_domain: endpoint - manual_test: True, needs to be investigated + manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_gpo/windows-security-xml.log source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file + sourcetype: xmlwineventlog From e9a68e2d5a975bb65d777471711804436b746df2 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 18 Apr 2023 14:13:30 -0700 Subject: [PATCH 4/6] aafter Erics feedback --- .../endpoint/windows_ad_domain_replication_acl_addition.yml | 6 +++--- .../windows_ad_privileged_account_sid_history_addition.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 77cde718d1..6b8ee817e0 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -4,7 +4,7 @@ version: 1 date: "2022-11-18" author: Dean Luxton type: TTP -status: production +status: experimental data_source: [] description: This analytic detects the addition of the permissions necessary to perform a DCSync attack. @@ -13,7 +13,7 @@ description: - DS-Replication-Get-Changes-All Certain Sync operations may require the additional permission of DS-Replication-Get-Changes-In-Filtered-Set. By default, adding DCSync permissions via the Powerview Add-ObjectACL operation adds all 3. This alert identifies where this trifecta has been met, and also where just the base level requirements have been met. -search: '`wineventlog_security` | rex field=AttributeValue max_match=10000 \"OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?PS-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)\"| table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid| mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,\"true\",\"false\"), fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,\"true\",\"false\")| where minDCSyncPermissions=\"true\" | lookup identity_lookup_expanded objectSid as DSRGetChanges_user_sid OUTPUT sAMAccountName as user | rename DSRGetChanges_user_sid as userSid | stats min(_time) as _time values(user) as user by dest src_user userSid minDCSyncPermissions fullSet| `windows_ad_domain_replication_acl_addition_filter`' +search: '`wineventlog_security` | rex field=AttributeValue max_match=10000 \"OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?PS-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)\"| table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid| mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,\"true\",\"false\"), fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,\"true\",\"false\")| where minDCSyncPermissions=\"true\" | lookup identity_lookup_expanded objectSid as DSRGetChanges_user_sid OUTPUT sAMAccountName as user | rename DSRGetChanges_user_sid as userSid | stats min(_time) as _time values(user) as user by dest src_user userSid minDCSyncPermissions fullSet| `windows_ad_domain_replication_acl_addition_filter`' how_to_implement: To successfully implement this search, you need to be ingesting the eventcode 5136. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to `Write All Properties` @@ -61,7 +61,7 @@ tags: - ObjectClass risk_score: 80 security_domain: endpoint - manual_test: True, needs to be investigated! + manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested. tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml index 2b011d2ae2..e0ac174bd1 100644 --- a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml @@ -66,7 +66,7 @@ tags: - Logon_ID risk_score: 90 security_domain: endpoint - manual_test: True, needs to be investigated + manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested. tests: - name: True Positive Test attack_data: From d1d72506cb07fb36d16762b65d2e898225ade929 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 18 Apr 2023 14:14:15 -0700 Subject: [PATCH 5/6] Update aws_multiple_users_failing_to_authenticate_from_ip.yml --- .../aws_multiple_users_failing_to_authenticate_from_ip.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index a0e7aadc44..58d8156f10 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -56,7 +56,7 @@ tags: - src_ip risk_score: 54 security_domain: threat - manual_test: This search needs has time window and events split up in CI. Tested manually + manual_test: This search needs has time window and events split up in CI testing. tests: - name: True Positive Test attack_data: From 64f4af2b094c998b9b81d9f4f5b1b68395a372ec Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 18 Apr 2023 14:15:23 -0700 Subject: [PATCH 6/6] Update aws_multiple_users_failing_to_authenticate_from_ip.yml --- .../aws_multiple_users_failing_to_authenticate_from_ip.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index 58d8156f10..417c5349b8 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -56,7 +56,7 @@ tags: - src_ip risk_score: 54 security_domain: threat - manual_test: This search needs has time window and events split up in CI testing. + manual_test: This search needs a specific number of events in a time window for the alert to trigger and events split up in CI testing while updating timestamp. tests: - name: True Positive Test attack_data: