admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updating detections

Browse Source
This commit is contained in:
dluxtron
2024-07-02 12:11:48 +10:00
parent c028bd6e58
commit 820151cdb2
9 changed files with 0 additions and 407 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/application/detect_distributed_password_spray_attempts.yml
-69
View File
@@ -1,69 +0,0 @@
name: Detect Distributed Password Spray Attempts
id: b1a82fc8-8a9f-4344-9ec2-bde5c5331b57
version: 1
date: '2023-11-01'
author: Dean Luxton
status: production
type: Hunting
data_source:
- Authentication Datamodel
description: This analytic uses the 3-sigma approach to detect a distributed password spray attack. Utilising the authentication datamodel this detection is affective for all CIM mapped authication events.
search: '| tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts dc(Authentication.src) as unique_src count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action="failure" by Authentication.action, Authentication.signature_id, sourcetype, _time span=2m
| `drop_dm_object_name("Authentication")`
```fill out time buckets for 0-count events during entire search length```
| appendpipe [| timechart limit=0 span=5m count | table _time]
| fillnull value=0 unique_accounts, unique_src
``` remove duplicate & empty time buckets```
| sort - total_failures
| dedup _time
``` Create aggregation field & apply to all null events```
| eval counter=sourcetype+"__"+signature_id
| eventstats values(counter) as fnscounter | eval counter=coalesce(counter,fnscounter)
``` 3-sigma detection logic ```
| eventstats avg(unique_accounts) as comp_avg_user , stdev(unique_accounts) as comp_std_user avg(unique_src) as comp_avg_src , stdev(unique_src) as comp_std_src by counter
| eval upperBoundUser=(comp_avg_user+comp_std_user*3), upperBoundsrc=(comp_avg_src+comp_std_src*3)
| eval isOutlier=if((unique_accounts > 30 and unique_accounts >= upperBoundUser) and (unique_src > 30 and unique_accounts >= upperBoundsrc), 1, 0)
| replace "::ffff:*" with * in src
| where isOutlier=1
| foreach *
[ eval <<FIELD>> = if(<<FIELD>>="null",null(),<<FIELD>>)]
| table _time, action, unique_src, unique_accounts, total_failures, sourcetype, signature_id
| sort - total_failures | `detect_distributed_password_spray_attempts_filter`'
how_to_implement: Ensure in-scope authentication data is CIM mapped and the src field is populated with the source device. Also ensure fill_nullvalue is set within the macro security_content_summariesonly.
known_false_positives: It is common to see a spike of legitimate failed authentication events on monday mornings.
references:
- https://attack.mitre.org/techniques/T1110/003/
tags:
analytic_story:
- Compromised User Account
- Active Directory Password Spraying
asset_type: Endpoint
atomic_guid:
- 90bc2e54-6c84-47a5-9439-0a2a92b4b175
confidence: 70
impact: 70
message: Distributed Password Spray Attempt Detected
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: src
type: Endpoint
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 49
required_fields:
- Authentication.action
- Authentication.user
- Authentication.src
security_domain: access
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techni[…]ure_ad_distributed_spray/azure_ad_distributed_spray.log
source: azure:monitor:aad
sourcetype: azure:monitor:aad
detections/application/detect_password_spray_attempts.yml
-67
View File
@@ -1,67 +0,0 @@
name: Detect Password Spray Attempts
id: 086ab581-8877-42b3-9aee-4a7ecb0923af
version: 1
date: '2023-11-01'
author: Dean Luxton
status: production
type: TTP
data_source:
- Authentication Datamodel
description: This analytic uses the 3-sigma approach to detect an unusual volume of failed authentication from a single source. Utilising the authentication datamodel this detection is affective for all CIM mapped authication events.
search: '| tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts values(Authentication.app) as app count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action="failure" by Authentication.src, Authentication.action, Authentication.signature_id, sourcetype, _time span=2m
| `drop_dm_object_name("Authentication")`
```fill out time buckets for 0-count events during entire search length```
| appendpipe [| timechart limit=0 span=5m count | table _time]
| fillnull value=0 unique_accounts, unique_src
``` remove duplicate & empty time buckets```
| sort - total_failures
| dedup _time
``` Create aggregation field & apply to all null events```
| eval counter=src+"__"+sourcetype+"__"+signature_id
| eventstats values(counter) as fnscounter | eval counter=coalesce(counter,fnscounter)
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by counter
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 30 and unique_accounts >= upperBound, 1, 0)
| replace "::ffff:*" with * in src
| where isOutlier=1
| foreach * [ eval <<FIELD>> = if(<<FIELD>>="null",null(),<<FIELD>>)]
| table _time, src, action, app, unique_accounts, total_failures, sourcetype, signature_id
| `detect_password_spray_attempts_filter`'
how_to_implement: Ensure in-scope authentication data is CIM mapped and the src field is populated with the source device. Also ensure fill_nullvalue is set within the macro security_content_summariesonly.
known_false_positives: Unknown
references:
- https://attack.mitre.org/techniques/T1110/003/
tags:
analytic_story:
- Compromised User Account
- Active Directory Password Spraying
asset_type: Endpoint
atomic_guid:
- 90bc2e54-6c84-47a5-9439-0a2a92b4b175
confidence: 70
impact: 70
message: Potential Password Spraying attack from $src$ targeting $unique_accounts$ unique accounts.
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: src
type: Endpoint
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 49
required_fields:
- Authentication.action
- Authentication.user
- Authentication.src
security_domain: access
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
detections/application/windows_ad_add_self_to_group.yml
-51
View File
@@ -1,51 +0,0 @@
name: Windows AD add Self to Group
id: 065f2701-b7ea-42f5-9ec4-fbc2261165f9
version: 1
date: '2023-12-18'
author: Dean Luxton
status: production
type: TTP
data_source:
- Windows Event Log Security 4728
description: Detect when a user adds themselfs to an AD Group.
search: '`wineventlog_security` EventCode IN (4728)
| where user=src_user
| stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name, src_user
| `windows_ad_add_self_to_group_filter`'
how_to_implement: This analytic requires eventCode 4728 to be ingested.
known_false_positives: Unknown
references: []
tags:
analytic_story:
- Active Directory Privilege Escalation
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 100
impact: 50
message: $user$ added themselves to AD Group $Group_Name$
mitre_attack_id:
- T1098
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 50
required_fields:
- EventCode
- user
- src_user
- signature
- Group_Name
security_domain: audit
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
update_timestamp: true
detections/application/windows_increase_in_group_or_object_modification_activity.yml
-52
View File
@@ -1,52 +0,0 @@
name: Windows Increase in Group or Object Modification Activity
id: 4f9564dd-a204-4f22-b375-4dfca3a68731
version: 1
date: '2023-10-13'
author: Dean Luxton
status: production
type: TTP
data_source:
- XmlWinEventLog:Security
description: Increase in group or AD object modifications.
search: >-
`wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764)
| bucket span=5m _time
| stats values(object) as object, dc(object) as objectCount, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status
| eventstats avg(objectCount) as comp_avg, stdev(objectCount) as comp_std by src_user, signature
| eval upperBound=(comp_avg+comp_std)
| eval isOutlier=if(objectCount > 10 and (objectCount >= upperBound), 1, 0)
| search isOutlier=1
| `windows_increase_in_group_or_object_modification_activity_filter`
how_to_implement: Run over past 7 days for best results.
known_false_positives: Unknown
references: []
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 40
impact: 20
message: Spike in Group or Object Modifications performed by $src_user$
mitre_attack_id:
- T1098
observable:
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 8
required_fields:
- EventCode
- src_user
- signature
security_domain: audit
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
detections/application/windows_increase_in_user_modification_activity.yml
-53
View File
@@ -1,53 +0,0 @@
name: Windows Increase in User Modification Activity
id: 0995fca1-f346-432f-b0bf-a66d14e6b428
version: 1
date: '2023-10-13'
author: Dean Luxton
status: production
type: TTP
data_source:
- XmlWinEventLog:Security
description: Increase in user account modifications.
search: >-
`wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780)
| bucket span=5m _time
| stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status
| eventstats avg(userCount) as comp_avg , stdev(userCount) as comp_std by src_user, signature
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0)
| search isOutlier=1
| stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category values(signature) as signature by _time, src_user, status
| `windows_increase_in_user_modification_activity_filter`
how_to_implement: Run over past 7 days for best results.
known_false_positives: Genuine activity
references: []
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 40
impact: 20
message: Spike in User Modification actions performed by $src_user$
mitre_attack_id:
- T1098
observable:
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 8
required_fields:
- EventCode
- src_user
- signature
security_domain: audit
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
detections/endpoint/windows_network_share_discovery_with_net.yml
-59
View File
@@ -1,59 +0,0 @@
name: Windows Network Share Discovery With Net
id: 4dc3951f-b3f8-4f46-b412-76a483f72277
version: 1
date: '2023-04-21'
author: Dean Luxton
status: production
type: TTP
data_source:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share/windows-sysmon.log
description: Network share discovery performed on Windows using the Net Command.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit FROM datamodel=Endpoint.Processes WHERE ((Processes.process_name="net.exe" OR Processes.orig_process_name="net.exe") AND (Processes.process="*net*view*" OR Processes.process="*net*share*")) BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec
Processes.process Processes.parent_process
| `drop_dm_object_name(Processes)`
| regex process="net\s+view|net\s+share"
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_network_share_discovery_with_net_filter`'
how_to_implement: Ensure you are populating the endpoint datamodel.
known_false_positives: Unknown
references:
- https://attack.mitre.org/techniques/T1135/
tags:
analytic_story:
- Active Directory Discovery
- Active Directory Privilege Escalation
- Network Discovery
asset_type: Endpoint
atomic_guid:
- ab39a04f-0c93-4540-9ff2-83f862c385ae
confidence: 100
impact: 20
message: Network share enumeration performed on $dest$ by $user$, executed by parent process $parent_process$
mitre_attack_id:
- T1135
required_fields:
- Processes.process_name
- Processes.user
- Processes.dest
- Processes.process_exec
- Processes.parent_process_exec
- Processes.process
- Processes.parent_process
observable:
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 20
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
detections/endpoint/windows_vulnerable_driver_installed.yml
View File
detections/network/internal_vertical_port_scan.yml
View File
detections/network/internal_vulnerability_scan.yml
-56
View File
@@ -1,56 +0,0 @@
name: Internal Vulnerability Scan
id: 46f946ed-1c78-4e96-9906-c7a4be15e39b
version: 1
date: '2023-10-27'
author: Dean Luxton
status: experimental
type: TTP
data_source: []
description: This analytic detects internal hosts triggering multiple IDS signatures (either more than 25 signatures against a single host, or a single signature across over 25 destinations), which can be indicative of active vulnerability scanning performed within the network.
search: '| tstats `security_content_summariesonly` values(IDS_Attacks.action) as action
values(IDS_Attacks.src_category) as src_category values(IDS_Attacks.dest_category)
as dest_category count from datamodel=Intrusion_Detection.IDS_Attacks where IDS_Attacks.src
IN (10.0.0.0/8,192.168.0.0/16,172.16.0.0/12) IDS_Attacks.severity IN (critical,
high, medium) by IDS_Attacks.src IDS_Attacks.severity IDS_Attacks.signature IDS_Attacks.dest
IDS_Attacks.dest_port IDS_Attacks.transport span=1s _time | `drop_dm_object_name("IDS_Attacks")`
| eval gtime=_time | bin span=1h gtime | eventstats count as sevCount by severity
src | eventstats count as sigCount by signature src | eval severity=severity +"("+sevCount+")"
| eval signature=signature +"("+sigCount+")" | eval dest_port=transport + "/" +
dest_port | stats min(_time) as _time values(action) as action dc(dest) as destCount
dc(signature) as sigCount values(signature) values(src_category) as src_category
values(dest_category) as dest_category values(severity) as severity values(dest_port)
as dest_ports by src gtime | fields - gtime | where destCount>25 OR sigCount>25
| `internal_vulnerability_scan_filter`'
how_to_implement: CIM mapped IDS/IPS logs are a required to drive this detection.
known_false_positives: Vulnerability Scanners and informational / low severity signatures.
references: []
tags:
analytic_story:
- Network Discovery
asset_type: Endpoint
confidence: 80
impact: 80
message: Large volume of IDS signatures triggered by $src$
mitre_attack_id:
- T1595.002
- T1046
observable:
- name: src
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 64
required_fields:
- _time
- IDS_Attacks.action
- IDS_Attacks.src
- IDS_Attacks.dest
- IDS_Attacks.dest_port
- IDS_Attacks.severity
- IDS_Attacks.signature
- IDS_Attacks.transport
security_domain: network