admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-09-27 15:21:01 -07:00
committed by GitHub
parent d3e104c3f3 fefee99f51
commit 8341c2dcc1
186 changed files with 4194 additions and 5508 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_core/domain/entities/detection.py
+1
View File
@@ -75,6 +75,7 @@ class Detection(BaseModel, SecurityContentObject):
nes_fields: str = None
providing_technologies: list = None
runtime: str = None
internalVersion: str = None
# @validator('name')v
# def name_max_length(cls, v, values):
bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py
+2
View File
@@ -40,7 +40,9 @@ class DetectionTags(BaseModel):
risk_level: str = None
observable_str: str = None
evidence_str: str = None
analytics_story_str: str = None
kill_chain_phases_id: list = None
kill_chain_phases_str: str = None
research_site_url: str = None
event_schema: str = None
mappings: list = None
bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py
+42 -3
View File
@@ -10,6 +10,37 @@ class FindingReportObject():
@staticmethod
def writeFindingReport(detection : Detection) -> None:
if detection.tags.confidence < 33:
detection.tags.confidence_id = 1
elif detection.tags.confidence < 66:
detection.tags.confidence_id = 2
else:
detection.tags.confidence_id = 3
if detection.tags.impact < 20:
detection.tags.impact_id = 1
elif detection.tags.impact < 40:
detection.tags.impact_id = 2
elif detection.tags.impact < 60:
detection.tags.impact_id = 3
elif detection.tags.impact < 80:
detection.tags.impact_id = 4
else:
detection.tags.impact_id = 5
detection.tags.kill_chain_phases_id = dict()
for kill_chain_phase in detection.tags.kill_chain_phases:
detection.tags.kill_chain_phases_id[kill_chain_phase] = SES_KILL_CHAIN_MAPPINGS[kill_chain_phase]
kill_chain_phase_str = "["
i = 0
for kill_chain_phase in detection.tags.kill_chain_phases_id.keys():
kill_chain_phase_str = kill_chain_phase_str + '{"phase": "' + kill_chain_phase + '", "phase_id": ' + str(detection.tags.kill_chain_phases_id[kill_chain_phase]) + "}"
if not i == (len(detection.tags.kill_chain_phases_id.keys()) - 1):
kill_chain_phase_str = kill_chain_phase_str + ', '
i = i + 1
kill_chain_phase_str = kill_chain_phase_str + ']'
detection.tags.kill_chain_phases_str = kill_chain_phase_str
if detection.tags.risk_score < 20:
detection.tags.risk_level_id = 0
@@ -27,15 +58,23 @@ class FindingReportObject():
detection.tags.risk_level_id = 4
detection.tags.risk_level = "Critical"
evidence_str = "create_map("
evidence_str = "{"
for i in range(len(detection.tags.observable)):
evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '", ' + detection.tags.observable[i]["name"].replace(".", "_")
evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '": ' + detection.tags.observable[i]["name"].replace(".", "_")
if not i == (len(detection.tags.observable) - 1):
evidence_str = evidence_str + ', '
evidence_str = evidence_str + ')'
evidence_str = evidence_str + '}'
detection.tags.evidence_str = evidence_str
analytics_story_str = "["
for i in range(len(detection.tags.analytic_story)):
analytics_story_str = analytics_story_str + '"' + detection.tags.analytic_story[i] + '"'
if not i == (len(detection.tags.analytic_story) - 1):
analytics_story_str = analytics_story_str + ', '
analytics_story_str = analytics_story_str + ']'
detection.tags.analytics_story_str = analytics_story_str
if "actor.user.name" in detection.tags.required_fields:
actor_user_name = "actor_user_name"
else:
bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py
+3 -1
View File
@@ -66,7 +66,8 @@ class ObjToYmlAdapter(Adapter):
"nist": obj.tags.nist
}
obj.runtime = "SPL-DSP"
obj.runtime = "SPL2"
obj.internalVersion = 2
# remove unncessary fields
YmlWriter.writeYmlFile(file_path, obj.dict(
@@ -84,6 +85,7 @@ class ObjToYmlAdapter(Adapter):
"known_false_positives": True,
"references": True,
"runtime": True,
"internalVersion": True,
"tags":
{
#"analytic_story": True,
bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2
+29 -27
View File
@@ -1,28 +1,30 @@
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", {{ detection.tags.evidence_str }},
"message", concat("{{ detection.name }} has been triggered on ", device_hostname, " by ", {{ actor_user_name }}, "."),
"users", [
create_map(
"name", {{ actor_user_name }}, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", {{ detection.tags.risk_level_id }},
"risk_score", {{ detection.tags.risk_score }},
"severity_id", 0,
"rule", create_map("name", "{{ detection.name }}", "uid", "{{ detection.id }}", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {{ detection.tags.evidence_str }},
message = "{{ detection.name }} has been triggered on " + device_hostname + " by " + {{ actor_user_name }} + ".",
users = [{"name": {{ actor_user_name }}, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = {{ detection.tags.analytics_story_str }},
class_name = "Detection Report",
confidence = {{ detection.tags.confidence }},
confidence_id = {{ detection.tags.confidence_id }},
duration = 0,
impact = {{ detection.tags.impact }},
impact_id = {{ detection.tags.impact_id }},
kill_chain = {{ detection.tags.kill_chain_phases_str }},
nist = ["DE.AE"],
risk_level = "{{ detection.tags.risk_level }}",
category_uid = 2,
class_uid = 102001,
risk_level_id = {{ detection.tags.risk_level_id }},
risk_score = {{ detection.tags.risk_score }},
severity_id = 0,
rule = {"name": "{{ detection.name }}", "uid": "{{ detection.id }}", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink;
bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py
+10 -15
View File
@@ -33,7 +33,7 @@ class SplunkBABackend(TextQueryBackend):
wildcard_single : ClassVar[str] = "%"
add_escaped : ClassVar[str] = "\\"
re_expression : ClassVar[str] = "match_regex({field}, /(?i){regex}/)=true"
re_expression : ClassVar[str] = "match({field}, /(?i){regex}/)=true"
re_escape_char : ClassVar[str] = ""
re_escape : ClassVar[Tuple[str]] = ('"',)
@@ -64,7 +64,7 @@ class SplunkBABackend(TextQueryBackend):
deferred_separator : ClassVar[str] = " OR "
deferred_only_query : ClassVar[str] = "*"
wildcard_match_expression : ClassVar[Optional[str]] = "like({field}, {value})"
wildcard_match_expression : ClassVar[Optional[str]] = "{field} LIKE {value}"
def __init__(self, processing_pipeline: Optional["sigma.processing.pipeline.ProcessingPipeline"] = None, collect_errors: bool = False, min_time : str = "-30d", max_time : str = "now", detection : Detection = None, field_mapping: dict = None, **kwargs):
@@ -88,32 +88,29 @@ class SplunkBABackend(TextQueryBackend):
# fields_input_parsing = fields_input_parsing + ', '
detection_str = """
| from read_ba_enriched_events()
| eval timestamp = ucast(map_get(input_event,"time"),"long", null)
| eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>", null)
| eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null)
$main = from source
| eval timestamp = time
| eval metadata_uid = metadata.uid
""".replace("\n", " ")
parsed_fields = []
for field in self.field_mapping["mapping"].keys():
mapped_field = self.field_mapping["mapping"][field]
parent = 'input_event'
parent = 'parent'
i = 1
values = mapped_field.split('.')
for val in values:
if parent == "input_event":
new_val = val
if parent == "parent":
parent = val
continue
else:
new_val = parent + '_' + val
if new_val in parsed_fields:
parent = new_val
i = i + 1
continue
if i == len(values):
parser_str = '| eval ' + new_val + '' + '=ucast(map_get(' + parent + ',"' + val + '"), "string", null) '
else:
parser_str = '| eval ' + new_val + '' + '=ucast(map_get(' + parent + ',"' + val + '"), "map<string, any>", null) '
parser_str = '| eval ' + new_val + ' = ' + parent + '.' + val + ' '
detection_str = detection_str + parser_str
parsed_fields.append(new_val)
parent = new_val
@@ -121,8 +118,6 @@ class SplunkBABackend(TextQueryBackend):
detection_str = detection_str + "| where " + query
detection_str = detection_str.replace("\\\\\\\\", "\\\\")
return detection_str
def finalize_output_data_model(self, queries: List[str]) -> List[str]:
detections/cloud/azure_ad_user_enabled_and_password_reset.yml
+5 -5
View File
@@ -14,8 +14,8 @@ search: ' `azuread` (operationName="Enable account" OR operationName="Reset pass
OR operationName="Update user") | transaction properties.targetResources{}.userPrincipalName
startsWith=(operationName="Enable account") endsWith=(operationName="Reset password (by admin)") maxspan=2m
| rename properties.* as * | rename targetResources{}.userPrincipalName
as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy
| stats values(operationName) values(initiatedBy) as initiatedBy by _time, userPrincipalName,
as user | rename initiatedBy.user.userPrincipalName as initiatedBy
| stats values(operationName) values(initiatedBy) as initiatedBy by _time, user,
result | `azure_ad_user_enabled_and_password_reset_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
@@ -36,12 +36,12 @@ tags:
mitre_attack_id:
- T1098
observable:
- name: userPrincipalName
type: User Name
- name: user
type: User
role:
- Victim
- name: initiatedBy
type: User Name
type: User
role:
- Attacker
product:
detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
+1
View File
@@ -29,6 +29,7 @@ tags:
- Prohibited Traffic Allowed or Protocol Mismatch
- Windows Registry Abuse
- Azorult
- NjRAT
asset_type: Endpoint
confidence: 50
impact: 50
detections/endpoint/allow_network_discovery_in_firewall.yml
+1
View File
@@ -37,6 +37,7 @@ tags:
- Ransomware
- Revil Ransomware
- BlackByte Ransomware
- NjRAT
asset_type: Endpoint
confidence: 50
impact: 50
detections/endpoint/cmd_carry_out_string_command_parameter.yml
+1
View File
@@ -50,6 +50,7 @@ tags:
- Azorult
- Data Destruction
- Warzone RAT
- NjRAT
asset_type: Endpoint
automated_detection_testing: passed
confidence: 50
detections/endpoint/detect_certify_with_powershell_script_block_logging.yml
+1 -1
View File
@@ -39,7 +39,7 @@ tags:
role:
- Victim
- name: user
type: User Name
type: User
role:
- Victim
- name: command
detections/endpoint/excessive_usage_of_taskkill.yml
+1
View File
@@ -36,6 +36,7 @@ tags:
- CISA AA22-264A
- AgentTesla
- CISA AA22-277A
- NjRAT
asset_type: Endpoint
confidence: 70
impact: 40
detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+1
View File
@@ -62,6 +62,7 @@ tags:
- Amadey
- BlackByte Ransomware
- Warzone RAT
- NjRAT
asset_type: Endpoint
confidence: 50
impact: 40
detections/endpoint/firewall_allowed_program_enable.yml
+1
View File
@@ -38,6 +38,7 @@ tags:
- Windows Defense Evasion Tactics
- Azorult
- BlackByte Ransomware
- NjRAT
asset_type: Endpoint
confidence: 50
impact: 50
detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
+1
View File
@@ -34,6 +34,7 @@ tags:
- RedLine Stealer
- FIN7
- Warzone RAT
- NjRAT
asset_type: Endpoint
confidence: 70
impact: 50
detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+2
View File
@@ -34,6 +34,8 @@ tags:
- AgentTesla
- RedLine Stealer
- FIN7
- Warzone RAT
- NjRAT
asset_type: Endpoint
confidence: 70
impact: 50
detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+1
View File
@@ -44,6 +44,7 @@ tags:
- AsyncRAT
- Data Destruction
- IcedID
- NjRAT
confidence: 80
impact: 70
message: A suspicious powershell script contains base64 command in $ScriptBlockText$
detections/endpoint/registry_keys_used_for_persistence.yml
+1
View File
@@ -69,6 +69,7 @@ tags:
- Sneaky Active Directory Persistence Tricks
- BlackByte Ransomware
- Warzone RAT
- NjRAT
asset_type: Endpoint
confidence: 95
impact: 80
detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+1
View File
@@ -56,6 +56,7 @@ tags:
- Azorult
- Amadey
- Scheduled Tasks
- NjRAT
asset_type: Endpoint
confidence: 80
impact: 70
detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
+1
View File
@@ -30,6 +30,7 @@ references:
tags:
analytic_story:
- Chaos Ransomware
- NjRAT
asset_type: Endpoint
confidence: 90
impact: 90
detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml
+1
View File
@@ -30,6 +30,7 @@ tags:
- RedLine Stealer
- Amadey
- Warzone RAT
- NjRAT
asset_type: Endpoint
confidence: 50
impact: 50
detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml
+1
View File
@@ -30,6 +30,7 @@ tags:
- RedLine Stealer
- Amadey
- Warzone RAT
- NjRAT
asset_type: Endpoint
confidence: 70
impact: 70
detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
+1
View File
@@ -32,6 +32,7 @@ tags:
- Hermetic Wiper
- Caddy Wiper
- BlackByte Ransomware
- NjRAT
asset_type: Endpoint
confidence: 100
impact: 90
detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
+1
View File
@@ -36,6 +36,7 @@ tags:
- Hermetic Wiper
- Caddy Wiper
- BlackByte Ransomware
- NjRAT
asset_type: Endpoint
confidence: 100
impact: 90
detections/endpoint/windows_replication_through_removable_media.yml
+12 -12
View File
@@ -1,7 +1,7 @@
name: Windows Replication Through Removable Media
id: 60df805d-4605-41c8-bbba-57baa6a4eb97
version: 1
date: '2023-01-17'
date: '2023-09-07'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -18,17 +18,16 @@ description: This analytic is developed to detect suspicious executable or scrip
and the reason why that executable or scripts are dropped in the root drive.
data_source:
- Sysmon Event ID 11
search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = *.exe
OR Filesystem.file_name = *.dll OR Filesystem.file_name = *.sys OR Filesystem.file_name
= *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name = *.vbe OR Filesystem.file_name
= *.js OR Filesystem.file_name= *.bat OR Filesystem.file_name = *.cmd OR Filesystem.file_name
= *.pif) by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name
Filesystem.file_path Filesystem.user | `drop_dm_object_name(Filesystem)` | eval
dropped_file_path = split(file_path, "\\") | eval dropped_file_path_split_count
= mvcount(dropped_file_path) | eval root_drive = mvindex(dropped_file_path,0) |
where LIKE(root_drive, "%:") AND dropped_file_path_split_count = 2 AND root_drive!=
"C:" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk")
by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.user
| `drop_dm_object_name(Filesystem)`
| eval dropped_file_path = split(file_path, "\\")
| eval dropped_file_path_split_count = mvcount(dropped_file_path)
| eval root_drive = mvindex(dropped_file_path,0)
| where LIKE(root_drive, "%:") AND dropped_file_path_split_count = 2 AND root_drive!= "C:"
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_replication_through_removable_media_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
@@ -41,6 +40,7 @@ references:
tags:
analytic_story:
- Chaos Ransomware
- NjRAT
asset_type: Endpoint
confidence: 80
impact: 80
detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml
+2 -2
View File
@@ -57,11 +57,11 @@ tags:
role:
- Victim
- name: src_user
type: User Name
type: User
role:
- Victim
- name: user
type: User Name
type: User
role:
- Victim
- name: ssl_hash
detections/endpoint/windows_suspect_process_with_authentication_traffic.yml
+1 -1
View File
@@ -55,7 +55,7 @@ tags:
role:
- Victim
- name: user
type: User Name
type: User
role:
- Victim
- name: process_name
detections/endpoint/windows_system_logoff_commandline.yml
+2 -1
View File
@@ -16,7 +16,7 @@ data_source:
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe)
Processes.process="*shutdown*" Processes.process="* /l*" Processes.process="* /t*"
Processes.process="*shutdown*" Processes.process IN ("* /l*", "* -l*") Processes.process IN ("* /t*","* -t*","* /f*","* -f*")
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -38,6 +38,7 @@ references:
tags:
analytic_story:
- DarkCrystal RAT
- NjRAT
asset_type: Endpoint
confidence: 80
impact: 70
detections/endpoint/windows_system_reboot_commandline.yml
+2 -1
View File
@@ -17,7 +17,7 @@ data_source:
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe)
Processes.process="*shutdown*" Processes.process="* /r*" Processes.process="* /t*"
Processes.process="*shutdown*" Processes.process IN ("* /r*", "* -r*") Processes.process IN ("* /t*","* -t*","* /f*","* -f*")
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -39,6 +39,7 @@ references:
tags:
analytic_story:
- DarkCrystal RAT
- NjRAT
asset_type: Endpoint
confidence: 50
impact: 60
detections/endpoint/windows_system_shutdown_commandline.yml
+6 -5
View File
@@ -23,11 +23,11 @@ data_source:
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe)
Processes.process="*shutdown*" AND Processes.process IN("* /s*", "* -s*", "* /r*",
"* -r*") AND Processes.process="* /t*" by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.original_file_name Processes.process Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_system_shutdown_commandline_filter`'
Processes.process="*shutdown*" AND Processes.process IN("* /s*", "* -s*") AND Processes.process IN ("* /t*","* -t*","* /f*","* -f*")
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_system_shutdown_commandline_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
@@ -46,6 +46,7 @@ tags:
analytic_story:
- DarkCrystal RAT
- Sandworm Tools
- NjRAT
asset_type: Endpoint
confidence: 70
impact: 70
detections/endpoint/windows_unsigned_dll_side_loading.yml
+2 -1
View File
@@ -7,7 +7,7 @@ status: production
type: Anomaly
data_source:
- Sysmon Event ID 7
description: This analysis focuses on detecting potentially malicious unsigned DLLs created in either the c:\windows\system32 or c:\windows\syswow64 folders.
description: This analytic focuses on detecting potentially malicious unsigned DLLs created in either the c:\windows\system32 or c:\windows\syswow64 folders.
This particular technique was observed in the context of the Warzone (Ave Maria) RAT, where it employed a method known as DLL hijacking (dll-side-loading)
by dropping the "dismcore.dll" to achieve privilege escalation.
DLL hijacking is a stealthy attack technique used by cybercriminals to exploit the way Windows searches and loads DLLs. By placing a malicious DLL with the
@@ -30,6 +30,7 @@ references:
tags:
analytic_story:
- Warzone RAT
- NjRAT
asset_type: Endpoint
confidence: 70
impact: 70
detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
+1
View File
@@ -41,6 +41,7 @@ tags:
- Unusual Processes
- Data Destruction
- WhisperGate
- NjRAT
asset_type: Endpoint
confidence: 70
impact: 70
detections/network/detect_arp_poisoning.yml
+1 -1
View File
@@ -1,5 +1,5 @@
name: Detect ARP Poisoning
id: b44bebd6-bd39-467b-9321-73971bcd7aac
id: b44bebd6-bd39-467b-9321-73971bcd1aac
version: 1
date: '2020-08-11'
author: Mikael Bjerkeland, Splunk
detections/network/tor_traffic.yml
+23 -21
View File
@@ -1,26 +1,22 @@
name: TOR Traffic
id: ea688274-9c06-4473-b951-e4cb7a5d7a45
version: 2
date: '2020-07-22'
author: David Dorsey, Splunk
status: experimental
version: 3
date: '2023-09-20'
author: David Dorsey, Bhavin Patel, Splunk
status: production
type: TTP
description: This search looks for network traffic identified as The Onion Router
(TOR), a benign anonymity network which can be abused for a variety of nefarious
purposes.
description: The following analytic looks for allowed network traffic to The Onion Router(TOR), a benign anonymity network which can be abused for a variety of nefarious purposes. Detecting Tor traffic is paramount for upholding network security and mitigating potential threats. Tor's capacity to provide users with anonymity has been exploited by cybercriminals for activities like hacking, data breaches, and illicit content dissemination. Additionally, organizations must monitor Tor usage within their networks to ensure compliance with policies and regulations, as it can bypass conventional monitoring and filtering measures. Lastly, the ability to identify Tor traffic empowers security teams to promptly investigate and address potential security incidents, fortifying the protection of sensitive data and preserving the integrity of the network environment.
data_source: []
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed
by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")`
| `tor_traffic_filter`'
how_to_implement: In order to properly run this search, Splunk needs to ingest data
from firewalls or other network control devices that mediate the traffic allowed
into an environment. This is necessary so that the search can identify an 'action'
taken on the traffic of interest. The search requires the Network_Traffic data model
be populated.
how_to_implement: In order to properly run this search, Splunk needs to ingest data from Next Generation Firewalls like Palo Alto Networks Firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model to be populated.
known_false_positives: None at this time
references: []
references:
- https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRtCAK
- https://unit42.paloaltonetworks.com/tor-traffic-enterprise-networks/#:~:text=For%20enterprises%20concerned%20about%20the,the%20most%20important%20security%20risks.
tags:
analytic_story:
- Prohibited Traffic Allowed or Protocol Mismatch
@@ -28,15 +24,15 @@ tags:
- NOBELIUM Group
- Command And Control
asset_type: Endpoint
confidence: 50
impact: 50
message: tbd
confidence: 80
impact: 100
message: Suspicious network traffic allowed using TOR has been detected from $src_ip$ to $dest_ip$
mitre_attack_id:
- T1071
- T1071.001
- T1090
- T1090.003
observable:
- name: dest
type: Hostname
- name: src_ip
type: IP Address
role:
- Victim
product:
@@ -50,5 +46,11 @@ tags:
- All_Traffic.src_ip
- All_Traffic.dest_ip
- All_Traffic.dest_port
risk_score: 25
risk_score: 80
security_domain: network
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed.log
source: pan_tor_allowed
sourcetype: pan:traffic
detections/web/juniper_networks_remote_code_execution_exploit_detection.yml
+1
View File
@@ -21,6 +21,7 @@ references:
- https://thehackernews.com/2023/08/new-juniper-junos-os-flaws-expose.html
- https://github.com/watchtowrlabs/juniper-rce_cve-2023-36844
- https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/
- https://vulncheck.com/blog/juniper-cve-2023-36845
tags:
analytic_story:
- Juniper JunOS Remote Code Execution
dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml
Vendored
+41 -48
View File
@@ -4,53 +4,45 @@ version: 1
status: production
description: The following detection identifies the usage of archive tools from the
command line.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%")
OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe")
OR like(actor_process_file_name, "%cmd.exe"))
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Anomalous usage of Archive Tools has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 42,
"severity_id", 0,
"rule", create_map("name", "Anomalous usage of Archive Tools", "uid", "63614a58-10e2-4c6c-ae81-ea1113681439", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="WinRAR.exe"
OR process_file_name LIKE "7z%" OR process_file_name LIKE "winzip%") AND (actor_process_file_name
LIKE "%powershell.exe" OR actor_process_file_name LIKE "%cmd.exe")
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Anomalous usage of Archive Tools has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Cobalt Strike", "NOBELIUM Group", "Insider Threat"],
class_name = "Detection Report",
confidence = 60,
confidence_id = 2,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 42,
severity_id = 0,
rule = {"name": "Anomalous usage of Archive Tools", "uid": "63614a58-10e2-4c6c-ae81-ea1113681439", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -115,4 +107,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___attempt_to_delete_services.yml
Vendored
+40 -47
View File
@@ -7,52 +7,44 @@ description: The following analytic identifies Windows Service Control, `sc.exe`
instances of service enumeration of attempts to stop a service and then delete it.
Adversaries utilize this technique to terminate security services or other related
services to continue there objective and evade detections.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Attempt To Delete Services has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 1,
"risk_score", 36,
"severity_id", 0,
"rule", create_map("name", "Attempt To Delete Services", "uid", "a0c8c292-d01a-11eb-aa18-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="sc.exe" AND
process_cmd_line LIKE "%delete%"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Attempt To Delete Services has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["XMRig", "Ransomware"],
class_name = "Detection Report",
confidence = 60,
confidence_id = 2,
duration = 0,
impact = 60,
impact_id = 4,
kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 36,
severity_id = 0,
rule = {"name": "Attempt To Delete Services", "uid": "a0c8c292-d01a-11eb-aa18-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -121,4 +113,5 @@ test:
- file_name: sc_del.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___attempt_to_disable_services.yml
Vendored
+40 -47
View File
@@ -7,52 +7,44 @@ description: The following analytic identifies Windows Service Control, `sc.exe`
instances of service enumeration of attempts to stop a service and then disable
it. Adversaries utilize this technique to terminate security services or other related
services to continue there objective and evade detections.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%")
AND process_file_name="sc.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Attempt To Disable Services has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 1,
"risk_score", 36,
"severity_id", 0,
"rule", create_map("name", "Attempt To Disable Services", "uid", "afb31de4-d023-11eb-98d5-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_cmd_line LIKE "%config%"
AND process_cmd_line LIKE "%disabled%" AND process_file_name="sc.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Attempt To Disable Services has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["XMRig", "Ransomware"],
class_name = "Detection Report",
confidence = 60,
confidence_id = 2,
duration = 0,
impact = 60,
impact_id = 4,
kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 36,
severity_id = 0,
rule = {"name": "Attempt To Disable Services", "uid": "afb31de4-d023-11eb-98d5-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -118,4 +110,5 @@ test:
- file_name: sc_disable.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
Vendored
+44 -51
View File
@@ -5,56 +5,48 @@ status: production
description: The following analytic identifies the use of `reg.exe` attempting to
export Windows registry keys that contain hashed credentials. Adversaries will utilize
this technique to capture and perform offline password cracking.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line,
/(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line,
/(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true
OR match_regex(process_cmd_line, /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line,
/(?i)save/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Attempted Credential Dump From Registry via Reg exe has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 3,
"risk_score", 63,
"severity_id", 0,
"rule", create_map("name", "Attempted Credential Dump From Registry via Reg exe", "uid", "14038953-e5f2-4daf-acff-5452062baf03", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="reg.exe" OR
process_file_name="cmd.exe") AND (match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true
OR match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match(process_cmd_line,
/(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match(process_cmd_line, /(?i)HKLM\\System/)=true
OR match(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match(process_cmd_line, /(?i)HKLM\\Security/)=true)
AND match(process_cmd_line, /(?i)save/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Attempted Credential Dump From Registry via Reg exe has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Credential Dumping"],
class_name = "Detection Report",
confidence = 90,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "High",
category_uid = 2,
class_uid = 102001,
risk_level_id = 3,
risk_score = 63,
severity_id = 0,
rule = {"name": "Attempted Credential Dump From Registry via Reg exe", "uid": "14038953-e5f2-4daf-acff-5452062baf03", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -118,4 +110,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml
Vendored
+41 -47
View File
@@ -5,52 +5,45 @@ status: production
description: This search looks for flags passed to bcdedit.exe modifications to the
built-in Windows error recovery boot configurations. This is typically used by ransomware
to prevent recovery.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%")
AND like(process_cmd_line, "%recoveryenabled%"))
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("BCDEdit Failure Recovery Modification has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 4,
"risk_score", 80,
"severity_id", 0,
"rule", create_map("name", "BCDEdit Failure Recovery Modification", "uid", "76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="bcdedit.exe"
AND (process_cmd_line LIKE "%no%" AND process_cmd_line LIKE "%recoveryenabled%")
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "BCDEdit Failure Recovery Modification has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Ryuk Ransomware", "Ransomware", "Information Sabotage"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 100,
impact_id = 5,
kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}],
nist = ["DE.AE"],
risk_level = "Critical",
category_uid = 2,
class_uid = 102001,
risk_level_id = 4,
risk_score = 80,
severity_id = 0,
rule = {"name": "BCDEdit Failure Recovery Modification", "uid": "76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
@@ -113,4 +106,5 @@ test:
- file_name: windows-security_bcdedit_wbadmin.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml
Vendored
+40 -47
View File
@@ -5,52 +5,44 @@ status: production
description: this search is to detect execution of `cipher.exe` to clear the unallocated
sectors of a specific disk. This technique was seen in some ransomware to make it
impossible to forensically recover deleted files.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Clear Unallocated Sector Using Cipher App has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 4,
"risk_score", 90,
"severity_id", 0,
"rule", create_map("name", "Clear Unallocated Sector Using Cipher App", "uid", "8f907d90-6173-11ec-9c23-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="cipher.exe"
AND process_cmd_line LIKE "%/W:%"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Clear Unallocated Sector Using Cipher App has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Ransomware", "Information Sabotage"],
class_name = "Detection Report",
confidence = 100,
confidence_id = 3,
duration = 0,
impact = 90,
impact_id = 5,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Critical",
category_uid = 2,
class_uid = 102001,
risk_level_id = 4,
risk_score = 90,
severity_id = 0,
rule = {"name": "Clear Unallocated Sector Using Cipher App", "uid": "8f907d90-6173-11ec-9c23-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -114,4 +106,5 @@ test:
- file_name: security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___delete_a_net_user.yml
Vendored
+41 -47
View File
@@ -8,52 +8,45 @@ description: This analytic will detect a suspicious net.exe/net1.exe command-lin
user or deleting adversaries tracks created during its lateral movement additional
systems. During triage, review parallel processes for additional behavior. Identify
any other user accounts created before or after.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%")
AND (process_file_name="net.exe" OR process_file_name="net1.exe")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Delete A Net User has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 49,
"severity_id", 0,
"rule", create_map("name", "Delete A Net User", "uid", "8776d79c-d26e-11eb-9a56-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%"
AND process_cmd_line LIKE "%/delete%" AND (process_file_name="net.exe" OR process_file_name="net1.exe")
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Delete A Net User has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["XMRig", "Ransomware"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 49,
severity_id = 0,
rule = {"name": "Delete A Net User", "uid": "8776d79c-d26e-11eb-9a56-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -120,4 +113,5 @@ test:
- file_name: security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml
Vendored
+41 -48
View File
@@ -6,53 +6,45 @@ description: The following analytic identifies the use of `cacls.exe`, `icacls.e
or `xcacls.exe` placing the deny permission on a file or directory. Adversaries
perform this behavior to prevent responders from reviewing or gaining access to
adversary files on disk.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe"
OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Deny Permission using Cacls Utility has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 1,
"risk_score", 35,
"severity_id", 0,
"rule", create_map("name", "Deny Permission using Cacls Utility", "uid", "b76eae28-cd25-11eb-9c92-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="icacls.exe"
OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match(process_cmd_line,
/(?i)deny/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Deny Permission using Cacls Utility has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["XMRig", "Information Sabotage"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 50,
impact_id = 3,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 35,
severity_id = 0,
rule = {"name": "Deny Permission using Cacls Utility", "uid": "b76eae28-cd25-11eb-9c92-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -116,4 +108,5 @@ test:
- file_name: all_icalc.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
Vendored
+46 -53
View File
@@ -6,58 +6,50 @@ description: The following analytic identifies parent processes, browsers, Windo
terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
many applications spawn cmd.exe natively or built into macros. Much of this will
need to be tuned to further enhance the risk.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where ((actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe"
OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe"
OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe"
OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe"
OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe"
AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe"
AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Detect Prohibited Applications Spawning cmd exe has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 1,
"risk_score", 35,
"severity_id", 0,
"rule", create_map("name", "Detect Prohibited Applications Spawning cmd exe", "uid", "c10a18cb-fd80-4ffa-a844-25026e0a0c94", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where ((actor_process_file_name="winword.exe"
OR actor_process_file_name="excel.exe" OR actor_process_file_name="outlook.exe"
OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe"
OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe"
OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe")
OR (actor_process_file_name="java.exe" AND (NOT match(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true))
OR (actor_process_file_name="chrome.exe" AND (NOT process_cmd_line="chrome-extension")))
AND process_file_name="cmd.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Detect Prohibited Applications Spawning cmd exe has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Suspicious Command-Line Executions", "Insider Threat"],
class_name = "Detection Report",
confidence = 50,
confidence_id = 2,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Installation", "phase_id": 5}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 35,
severity_id = 0,
rule = {"name": "Detect Prohibited Applications Spawning cmd exe", "uid": "c10a18cb-fd80-4ffa-a844-25026e0a0c94", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: In order to successfully implement this analytic, you will need
endpoint process data from a EDR product or Sysmon. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
@@ -120,4 +112,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml
Vendored
+44 -51
View File
@@ -9,57 +9,49 @@ description: This analytic identifies commonly used command-line arguments used
is not indicative of malicious behavior. During triage, at this stage of a ransomware
event, exfiltration is about to occur or has already. Isolate the endpoint and continue
investigating by review file modifications and parallel processes.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line,
"%--transfers%") OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line,
"%--ignore-existing%") OR like(process_cmd_line, "%--no-check-certificate%") OR
like(process_cmd_line, "%--progress%") OR like(process_cmd_line, "%--config%") OR
like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line,
"%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe"
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_cmd_line LIKE "%--multi-thread-streams%"
OR process_cmd_line LIKE "%--transfers%" OR process_cmd_line LIKE "%--auto-confirm%"
OR process_cmd_line LIKE "%--ignore-existing%" OR process_cmd_line LIKE "%--no-check-certificate%"
OR process_cmd_line LIKE "%--progress%" OR process_cmd_line LIKE "%--config%" OR
process_cmd_line LIKE "%ftp%" OR process_cmd_line LIKE "%pcloud%" OR process_cmd_line
LIKE "%mega%" OR process_cmd_line LIKE "%copy%") AND process_file_name="rclone.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Detect RClone Command-Line Usage has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 1,
"risk_score", 35,
"severity_id", 0,
"rule", create_map("name", "Detect RClone Command-Line Usage", "uid", "e8b74268-5454-11ec-a799-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Detect RClone Command-Line Usage has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["DarkSide Ransomware", "Ransomware", "Insider Threat"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 50,
impact_id = 3,
kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 35,
severity_id = 0,
rule = {"name": "Detect RClone Command-Line Usage", "uid": "e8b74268-5454-11ec-a799-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
@@ -126,4 +118,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___disable_net_user_account.yml
Vendored
+41 -47
View File
@@ -6,52 +6,45 @@ description: This analytic will identify a suspicious command-line that disables
user account using the native `net.exe` or `net1.exe` utility to Windows. This technique
may used by the adversaries to interrupt availability of accounts and continue the
impact against the organization.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%")
AND (process_file_name="net.exe" OR process_file_name="net1.exe")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Disable Net User Account has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 49,
"severity_id", 0,
"rule", create_map("name", "Disable Net User Account", "uid", "ba858b08-d26c-11eb-af9b-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%"
AND process_cmd_line LIKE "%/active:no%" AND (process_file_name="net.exe" OR process_file_name="net1.exe")
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Disable Net User Account has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["XMRig", "Ransomware"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}, {"phase": "Delivery", "phase_id": 3}, {"phase": "Installation", "phase_id": 5}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 49,
severity_id = 0,
rule = {"name": "Disable Net User Account", "uid": "ba858b08-d26c-11eb-af9b-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -120,4 +113,5 @@ test:
- file_name: net_user_dis.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml
Vendored
+42 -48
View File
@@ -8,53 +8,46 @@ description: This search is to detect potential DNS exfiltration using nslookup
use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are
commonly used by attacker and also the retry parameter which is designed to query
C2 DNS multiple tries.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%")
OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line,
"%-querytype=%")) AND process_file_name="nslookup.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("DNS Exfiltration Using Nslookup App has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 3,
"risk_score", 72,
"severity_id", 0,
"rule", create_map("name", "DNS Exfiltration Using Nslookup App", "uid", "2452e632-9e0d-11eb-34ba-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-retry=%"
OR process_cmd_line LIKE "%-type=%" OR process_cmd_line LIKE "%-q=%" OR process_cmd_line
LIKE "%-qt=%" OR process_cmd_line LIKE "%-querytype=%") AND process_file_name="nslookup.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "DNS Exfiltration Using Nslookup App has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Suspicious DNS Traffic", "Dynamic DNS", "Data Exfiltration", "Command And Control"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 90,
impact_id = 5,
kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}],
nist = ["DE.AE"],
risk_level = "High",
category_uid = 2,
class_uid = 102001,
risk_level_id = 3,
risk_score = 72,
severity_id = 0,
rule = {"name": "DNS Exfiltration Using Nslookup App", "uid": "2452e632-9e0d-11eb-34ba-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
@@ -121,4 +114,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___fsutil_zeroing_file.yml
Vendored
+40 -47
View File
@@ -5,52 +5,44 @@ status: production
description: This search is to detect a suspicious fsutil process to zeroing a target
file. This technique was seen in lockbit ransomware where it tries to zero out its
malware path as part of its defense evasion after encrypting the compromised host.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Fsutil Zeroing File has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 54,
"severity_id", 0,
"rule", create_map("name", "Fsutil Zeroing File", "uid", "f792cdc9-43ee-4429-a3c0-ffce4fed1a85", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_cmd_line LIKE "%setzerodata%"
AND process_file_name="fsutil.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Fsutil Zeroing File has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Ransomware", "Insider Threat", "Information Sabotage"],
class_name = "Detection Report",
confidence = 90,
confidence_id = 3,
duration = 0,
impact = 60,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 54,
severity_id = 0,
rule = {"name": "Fsutil Zeroing File", "uid": "f792cdc9-43ee-4429-a3c0-ffce4fed1a85", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -116,4 +108,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml
Vendored
+41 -48
View File
@@ -6,53 +6,45 @@ description: The following analytic identifies the use of `cacls.exe`, `icacls.e
or `xcacls.exe` placing the grant permission on a file or directory. Adversaries
perform this behavior to allow components of their files to run, however it allows
responders to review or gaining access to adversary files on disk.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe"
OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Grant Permission Using Cacls Utility has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 1,
"risk_score", 35,
"severity_id", 0,
"rule", create_map("name", "Grant Permission Using Cacls Utility", "uid", "c6da561a-cd29-11eb-ae65-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="icacls.exe"
OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match(process_cmd_line,
/(?i)grant/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Grant Permission Using Cacls Utility has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["XMRig", "Insider Threat"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 50,
impact_id = 3,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 35,
severity_id = 0,
rule = {"name": "Grant Permission Using Cacls Utility", "uid": "c6da561a-cd29-11eb-ae65-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -116,4 +108,5 @@ test:
- file_name: all_icalc.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml
Vendored
+40 -47
View File
@@ -6,52 +6,44 @@ description: Attackers leverage an existing Windows binary, attrib.exe, to mark
as hidden by using specific flags so that the victim does not see the file. The
search looks for specific command-line arguments to detect the use of attrib.exe
to hide files.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Hiding Files And Directories With Attrib exe has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 3,
"risk_score", 72,
"severity_id", 0,
"rule", create_map("name", "Hiding Files And Directories With Attrib exe", "uid", "028e4406-6176-11ec-aec2-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="attrib.exe"
AND match(process_cmd_line, /(?i)/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Hiding Files And Directories With Attrib exe has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Windows Defense Evasion Tactics", "Windows Persistence Techniques", "Information Sabotage", "Insider Threat"],
class_name = "Detection Report",
confidence = 90,
confidence_id = 3,
duration = 0,
impact = 80,
impact_id = 5,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "High",
category_uid = 2,
class_uid = 102001,
risk_level_id = 3,
risk_score = 72,
severity_id = 0,
rule = {"name": "Hiding Files And Directories With Attrib exe", "uid": "028e4406-6176-11ec-aec2-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
@@ -119,4 +111,5 @@ test:
- file_name: security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml
Vendored
+41 -48
View File
@@ -8,54 +8,46 @@ description: This analytic identifies suspicious modification of ACL permission
is commonly configured by the file or directory owner with appropriate permission.
This behavior raises suspicion if this command is seen on an endpoint utilized by
an account with no permission to do so.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line,
/(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND
(process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)S-1-1-0:/)=true
OR match(process_cmd_line, /(?i)SYSTEM:/)=true OR match(process_cmd_line, /(?i)everyone:/)=true)
AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Modify ACLs Permission Of Files Or Folders has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 1,
"risk_score", 35,
"severity_id", 0,
"rule", create_map("name", "Modify ACLs Permission Of Files Or Folders", "uid", "9ae9a48a-cdbe-11eb-875a-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Modify ACLs Permission Of Files Or Folders has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["XMRig"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 50,
impact_id = 3,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 35,
severity_id = 0,
rule = {"name": "Modify ACLs Permission Of Files Or Folders", "uid": "9ae9a48a-cdbe-11eb-875a-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -118,4 +110,5 @@ test:
- file_name: all_icalc.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml
Vendored
+43 -50
View File
@@ -5,55 +5,47 @@ status: production
description: The following analytic will identify a Windows Office Product spawning
WScript.exe or CScript.exe. Tuning may be required based on legitimate application
usage that may spawn scripts from an Office product.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="cscript.exe" OR process_file_name="wscript.exe")
AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name,
/(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true
OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name,
/(?i)winword.exe/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Office Product Spawning Windows Script Host has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 3,
"risk_score", 63,
"severity_id", 0,
"rule", create_map("name", "Office Product Spawning Windows Script Host", "uid", "3ea3851a-8736-41a0-bc09-7e4485b48fa6", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="cscript.exe"
OR process_file_name="wscript.exe") AND (match(actor_process_file_name, /(?i)visio.exe/)=true
OR match(actor_process_file_name, /(?i)mspub.exe/)=true OR match(actor_process_file_name,
/(?i)powerpnt.exe/)=true OR match(actor_process_file_name, /(?i)excel.exe/)=true
OR match(actor_process_file_name, /(?i)winword.exe/)=true)
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Office Product Spawning Windows Script Host has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Spearphishing Attachments"],
class_name = "Detection Report",
confidence = 90,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Delivery", "phase_id": 3}],
nist = ["DE.AE"],
risk_level = "High",
category_uid = 2,
class_uid = 102001,
risk_level_id = 3,
risk_score = 63,
severity_id = 0,
rule = {"name": "Office Product Spawning Windows Script Host", "uid": "3ea3851a-8736-41a0-bc09-7e4485b48fa6", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -117,4 +109,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___resize_shadowstorage_volume.yml
Vendored
+40 -47
View File
@@ -6,53 +6,45 @@ description: The following analytic identifies the resizing of shadowstorage usi
vssadmin.exe to avoid the shadow volumes being made again. This technique is typically
found used by adversaries during a ransomware event and a precursor to deleting
the shadowstorage.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line,
"%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe"
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_cmd_line LIKE "%shadowstorage%"
AND process_cmd_line LIKE "%resize%" AND process_cmd_line LIKE "%maxsize%" AND process_file_name="vssadmin.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Resize Shadowstorage Volume has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 3,
"risk_score", 64,
"severity_id", 0,
"rule", create_map("name", "Resize Shadowstorage Volume", "uid", "dbc30554-d27e-11eb-9e5e-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Resize Shadowstorage Volume has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Clop Ransomware", "Ransomware"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 80,
impact_id = 5,
kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}],
nist = ["DE.AE"],
risk_level = "High",
category_uid = 2,
class_uid = 102001,
risk_level_id = 3,
risk_score = 64,
severity_id = 0,
rule = {"name": "Resize Shadowstorage Volume", "uid": "dbc30554-d27e-11eb-9e5e-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -117,4 +109,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___sdelete_application_execution.yml
Vendored
+51 -57
View File
@@ -7,62 +7,55 @@ description: This analytic will detect the execution of sdelete.exe attempting t
to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
to securely delete files on disk. This tool is commonly used to clear tracks and
artifact on the targeted host.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%")
OR like(process_cmd_line, "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line,
"%.zip%") OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%")
OR like(process_cmd_line, "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line,
"%.jpg%") OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%")
OR like(process_cmd_line, "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line,
"%.rtf%") OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%")
OR like(process_cmd_line, "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR
like(process_cmd_line, "%/accepteula%") OR like(process_cmd_line, "%-z %") OR like(process_cmd_line,
"%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR
like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line,
"%-c %")) AND like(process_file_name, "%sdelete%")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Sdelete Application Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 42,
"severity_id", 0,
"rule", create_map("name", "Sdelete Application Execution", "uid", "fcc52b9a-4616-11ec-8454-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_cmd_line LIKE "%.xls%"
OR process_cmd_line LIKE "%.gz%" OR process_cmd_line LIKE "%.tar%" OR process_cmd_line
LIKE "%.rar%" OR process_cmd_line LIKE "%.zip%" OR process_cmd_line LIKE "%.7z%"
OR process_cmd_line LIKE "%.bmp%" OR process_cmd_line LIKE "%.gif%" OR process_cmd_line
LIKE "%.png%" OR process_cmd_line LIKE "%.jpg%" OR process_cmd_line LIKE "%.txt%"
OR process_cmd_line LIKE "%.log%" OR process_cmd_line LIKE "%.key%" OR process_cmd_line
LIKE "%.pdf%" OR process_cmd_line LIKE "%.rtf%" OR process_cmd_line LIKE "%.ppt%"
OR process_cmd_line LIKE "%.xls%" OR process_cmd_line LIKE "%.doc%" OR process_cmd_line
LIKE "%-nobanner%" OR process_cmd_line LIKE "%/accepteula%" OR process_cmd_line
LIKE "%-z %" OR process_cmd_line LIKE "%-s %" OR process_cmd_line LIKE "%-q %" OR
process_cmd_line LIKE "%-r %" OR process_cmd_line LIKE "%-p %" OR process_cmd_line
LIKE "%-f %" OR process_cmd_line LIKE "%-c %") AND process_file_name LIKE "%sdelete%"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Sdelete Application Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Information Sabotage", "Insider Threat"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 60,
impact_id = 4,
kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 42,
severity_id = 0,
rule = {"name": "Sdelete Application Execution", "uid": "fcc52b9a-4616-11ec-8454-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -130,4 +123,5 @@ test:
- file_name: security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml
Vendored
+150 -257
View File
@@ -8,262 +8,154 @@ description: An attacker tries might try to use different version of a system co
run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes
has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe"
OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe"
OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe"
OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" OR process_file_name="write.exe"
OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe"
OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe"
OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" OR process_file_name="winver.exe"
OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" OR process_file_name="winresume.exe"
OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" OR process_file_name="wininit.exe"
OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe"
OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" OR process_file_name="where.exe"
OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe"
OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe"
OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe"
OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe"
OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe"
OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe"
OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe"
OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe"
OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe"
OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" OR
process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe"
OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe"
OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe"
OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe"
OR process_file_name="systeminfo.exe" OR process_file_name="syskey.exe" OR process_file_name="sxstrace.exe"
OR process_file_name="svchost.exe" OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe"
OR process_file_name="spreview.exe" OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe"
OR process_file_name="spinstall.exe" OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe"
OR process_file_name="smss.exe" OR process_file_name="slui.exe" OR process_file_name="sihost.exe"
OR process_file_name="sigverif.exe" OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe"
OR process_file_name="shadow.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe"
OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe"
OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe"
OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe"
OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe" OR process_file_name="sc.exe"
OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe"
OR process_file_name="rundll32.exe" OR process_file_name="runas.exe" OR process_file_name="rstrui.exe"
OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe"
OR process_file_name="resmon.exe" OR process_file_name="reset.exe" OR process_file_name="replace.exe"
OR process_file_name="repair-bde.exe" OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe"
OR process_file_name="regsvr32.exe" OR process_file_name="regini.exe" OR process_file_name="regedt32.exe"
OR process_file_name="reg.exe" OR process_file_name="recover.exe" OR process_file_name="recdisc.exe"
OR process_file_name="rdrleakdiag.exe" OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe"
OR process_file_name="rasphone.exe" OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe"
OR process_file_name="rasautou.exe" OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe"
OR process_file_name="query.exe" OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe"
OR process_file_name="pwlauncher.exe" OR process_file_name="psr.exe" OR process_file_name="provtool.exe"
OR process_file_name="proquota.exe" OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe"
OR process_file_name="print.exe" OR process_file_name="prevhost.exe" OR process_file_name="powercfg.exe"
OR process_file_name="poqexec.exe" OR process_file_name="plasrv.exe" OR process_file_name="phoneactivate.exe"
OR process_file_name="perfmon.exe" OR process_file_name="pcwrun.exe" OR process_file_name="pcawrk.exe"
OR process_file_name="pcaui.exe" OR process_file_name="pcalua.exe" OR process_file_name="p2phost.exe"
OR process_file_name="osk.exe" OR process_file_name="openfiles.exe" OR process_file_name="omadmprc.exe"
OR process_file_name="omadmclient.exe" OR process_file_name="odbcconf.exe" OR process_file_name="odbcad32.exe"
OR process_file_name="ocsetup.exe" OR process_file_name="ntprint.exe" OR process_file_name="ntoskrnl.exe"
OR process_file_name="nslookup.exe" OR process_file_name="notepad.exe" OR process_file_name="nltest.exe"
OR process_file_name="newdev.exe" OR process_file_name="netsh.exe" OR process_file_name="netiougc.exe"
OR process_file_name="netcfg.exe" OR process_file_name="netbtugc.exe" OR process_file_name="net1.exe"
OR process_file_name="net.exe" OR process_file_name="ndadmin.exe" OR process_file_name="nbtstat.exe"
OR process_file_name="mtstocom.exe" OR process_file_name="mstsc.exe" OR process_file_name="msra.exe"
OR process_file_name="mspaint.exe" OR process_file_name="msinfo32.exe" OR process_file_name="msiexec.exe"
OR process_file_name="mshta.exe" OR process_file_name="msg.exe" OR process_file_name="msfeedssync.exe"
OR process_file_name="msdtc.exe" OR process_file_name="msdt.exe" OR process_file_name="msconfig.exe"
OR process_file_name="mpnotify.exe" OR process_file_name="mountvol.exe" OR process_file_name="mobsync.exe"
OR process_file_name="mmc.exe" OR process_file_name="mfpmp.exe" OR process_file_name="mctadmin.exe"
OR process_file_name="mcbuilder.exe" OR process_file_name="mblctr.exe" OR process_file_name="manage-bde.exe"
OR process_file_name="makecab.exe" OR process_file_name="lsm.exe" OR process_file_name="lsass.exe"
OR process_file_name="lpremove.exe" OR process_file_name="lpksetup.exe" OR process_file_name="lpkinstall.exe"
OR process_file_name="logoff.exe" OR process_file_name="logman.exe" OR process_file_name="logagent.exe"
OR process_file_name="lodctr.exe" OR process_file_name="licensingdiag.exe" OR process_file_name="label.exe"
OR process_file_name="ktmutil.exe" OR process_file_name="ksetup.exe" OR process_file_name="klist.exe"
OR process_file_name="isoburn.exe" OR process_file_name="iscsicpl.exe" OR process_file_name="iscsicli.exe"
OR process_file_name="irftp.exe" OR process_file_name="ipconfig.exe" OR process_file_name="immersivetpmvscmgrsvr.exe"
OR process_file_name="iexpress.exe" OR process_file_name="ieetwcollector.exe" OR
process_file_name="ieunatt.exe" OR process_file_name="ie4uinit.exe" OR process_file_name="icsunattend.exe"
OR process_file_name="icardagt.exe" OR process_file_name="icacls.exe" OR process_file_name="hwrreg.exe"
OR process_file_name="hwrcomp.exe" OR process_file_name="help.exe" OR process_file_name="hdwwiz.exe"
OR process_file_name="grpconv.exe" OR process_file_name="gpupdate.exe" OR process_file_name="gpscript.exe"
OR process_file_name="gpresult.exe" OR process_file_name="getmac.exe" OR process_file_name="fveprompt.exe"
OR process_file_name="fvenotify.exe" OR process_file_name="ftp.exe" OR process_file_name="fsutil.exe"
OR process_file_name="fsquirt.exe" OR process_file_name="fsavailux.exe" OR process_file_name="forfiles.exe"
OR process_file_name="fontview.exe" OR process_file_name="fontdrvhost.exe" OR process_file_name="fodhelper.exe"
OR process_file_name="fltmc.exe" OR process_file_name="fixmapi.exe" OR process_file_name="finger.exe"
OR process_file_name="findstr.exe" OR process_file_name="find.exe" OR process_file_name="fhmanagew.exe"
OR process_file_name="fc.exe" OR process_file_name="extrac32.exe" OR process_file_name="expand.exe"
OR process_file_name="eventvwr.exe" OR process_file_name="eventcreate.exe" OR process_file_name="eudcedit.exe"
OR process_file_name="esentutl.exe" OR process_file_name="embeddedapplauncher.exe"
OR process_file_name="efsui.exe" OR process_file_name="easinvoker.exe" OR process_file_name="dxdiag.exe"
OR process_file_name="dwm.exe" OR process_file_name="dvdupgrd.exe" OR process_file_name="dvdplay.exe"
OR process_file_name="dstokenclean.exe" OR process_file_name="dsregcmd.exe" OR process_file_name="drvinst.exe"
OR process_file_name="drvcfg.exe" OR process_file_name="driverquery.exe" OR process_file_name="dpnsvr.exe"
OR process_file_name="dpapimig.exe" OR process_file_name="doskey.exe" OR process_file_name="dnscacheugc.exe"
OR process_file_name="dmclient.exe" OR process_file_name="dmcfghost.exe" OR process_file_name="dmcertinst.exe"
OR process_file_name="dllhst3g.exe" OR process_file_name="dllhost.exe" OR process_file_name="djoin.exe"
OR process_file_name="dispdiag.exe" OR process_file_name="diskraid.exe" OR process_file_name="diskperf.exe"
OR process_file_name="diskpart.exe" OR process_file_name="dinotify.exe" OR process_file_name="diantz.exe"
OR process_file_name="dialer.exe" OR process_file_name="dfrgui.exe" OR process_file_name="ddodiag.exe"
OR process_file_name="dcomcnfg.exe" OR process_file_name="dccw.exe" OR process_file_name="dashost.exe"
OR process_file_name="cttunesvr.exe" OR process_file_name="cttune.exe" OR process_file_name="ctfmon.exe"
OR process_file_name="csrss.exe" OR process_file_name="cscript.exe" OR process_file_name="credwiz.exe"
OR process_file_name="convert.exe" OR process_file_name="control.exe" OR process_file_name="consent.exe"
OR process_file_name="conhost.exe" OR process_file_name="compact.exe" OR process_file_name="comp.exe"
OR process_file_name="colorcpl.exe" OR process_file_name="cofire.exe" OR process_file_name="cmstp.exe"
OR process_file_name="cmmon32.exe" OR process_file_name="cmdl32.exe" OR process_file_name="cmdkey.exe"
OR process_file_name="cmd.exe" OR process_file_name="clip.exe" OR process_file_name="cliconfg.exe"
OR process_file_name="cleanmgr.exe" OR process_file_name="cipher.exe" OR process_file_name="choice.exe"
OR process_file_name="chkntfs.exe" OR process_file_name="chkdsk.exe" OR process_file_name="chgusr.exe"
OR process_file_name="chgport.exe" OR process_file_name="chglogon.exe" OR process_file_name="charmap.exe"
OR process_file_name="changepk.exe" OR process_file_name="change.exe" OR process_file_name="certutil.exe"
OR process_file_name="certreq.exe" OR process_file_name="cdpreference.exe" OR process_file_name="calc.exe"
OR process_file_name="cacls.exe" OR process_file_name="bthudtask.exe" OR process_file_name="browser_broker.exe"
OR process_file_name="bridgeunattend.exe" OR process_file_name="bootsect.exe" OR
process_file_name="bootim.exe" OR process_file_name="bootcfg.exe" OR process_file_name="bitsadmin.exe"
OR process_file_name="bdeunlock.exe" OR process_file_name="bdechangepin.exe" OR
process_file_name="bcdedit.exe" OR process_file_name="bcdboot.exe" OR process_file_name="bcastdvr.exe"
OR process_file_name="backgroundtaskhost.exe" OR process_file_name="baaupdate.exe"
OR process_file_name="autofmt.exe" OR process_file_name="autoconv.exe" OR process_file_name="autochk.exe"
OR process_file_name="auditpol.exe" OR process_file_name="audiodg.exe" OR process_file_name="attrib.exe"
OR process_file_name="at.exe" OR process_file_name="appidpolicyconverter.exe" OR
process_file_name="appidcertstorecheck.exe" OR process_file_name="alg.exe" OR process_file_name="aitstatic.exe"
OR process_file_name="aitagent.exe" OR process_file_name="acu.exe" OR process_file_name="wpcmon.exe"
OR process_file_name="workfolders.exe" OR process_file_name="windowsupdateelevatedinstaller.exe"
OR process_file_name="windowsanytimeupgradeui.exe" OR process_file_name="windowsanytimeupgraderesults.exe"
OR process_file_name="windowsanytimeupgrade.exe" OR process_file_name="windowsactiondialog.exe"
OR process_file_name="windows.media.backgroundplayback.exe" OR process_file_name="winsat.exe"
OR process_file_name="werfaultsecure.exe" OR process_file_name="werfault.exe" OR
process_file_name="webcache.exe" OR process_file_name="wallpaperhost.exe" OR process_file_name="wwahost.exe"
OR process_file_name="wudfhost.exe" OR process_file_name="wsreset.exe" OR process_file_name="wsmanhttpconfig.exe"
OR process_file_name="wscollect.exe" OR process_file_name="wpdshextautoplay.exe"
OR process_file_name="wmpdmc.exe" OR process_file_name="wfs.exe" OR process_file_name="vaultsysui.exe"
OR process_file_name="vaultcmd.exe" OR process_file_name="vssvc.exe" OR process_file_name="utilman.exe"
OR process_file_name="usoclient.exe" OR process_file_name="useraccountcontrolsettings.exe"
OR process_file_name="useraccountbroker.exe" OR process_file_name="upgraderesultsui.exe"
OR process_file_name="ui0detect.exe" OR process_file_name="tswpfwrp.exe" OR process_file_name="tpminit.exe"
OR process_file_name="tokenbrokercookies.exe" OR process_file_name="thumbnailextractionhost.exe"
OR process_file_name="taskmgr.exe" OR process_file_name="tapiunattend.exe" OR process_file_name="tswbprxy.exe"
OR process_file_name="tstheme.exe" OR process_file_name="tracert.exe" OR process_file_name="tcpsvcs.exe"
OR process_file_name="systemsettingsremovedevice.exe" OR process_file_name="systemsettingsbroker.exe"
OR process_file_name="systemsettingsadminflows.exe" OR process_file_name="systempropertiesremote.exe"
OR process_file_name="systempropertiesprotection.exe" OR process_file_name="systempropertiesperformance.exe"
OR process_file_name="systempropertieshardware.exe" OR process_file_name="systempropertiesdataexecutionprevention.exe"
OR process_file_name="systempropertiescomputername.exe" OR process_file_name="systempropertiesadvanced.exe"
OR process_file_name="sysreseterr.exe" OR process_file_name="synchost.exe" OR process_file_name="stikynot.exe"
OR process_file_name="srtasks.exe" OR process_file_name="sppextcomobj.exe" OR process_file_name="spaceagent.exe"
OR process_file_name="soundrecorder.exe" OR process_file_name="snippingtool.exe"
OR process_file_name="sndvol.exe" OR process_file_name="smartscreensettings.exe"
OR process_file_name="slidetoshutdown.exe" OR process_file_name="settingsynchost.exe"
OR process_file_name="setieinstalleddate.exe" OR process_file_name="sensordataservice.exe"
OR process_file_name="secedit.exe" OR process_file_name="searchprotocolhost.exe"
OR process_file_name="searchindexer.exe" OR process_file_name="searchfilterhost.exe"
OR process_file_name="sihclient.exe" OR process_file_name="runtimebroker.exe" OR
process_file_name="runlegacycplelevated.exe" OR process_file_name="rpcping.exe"
OR process_file_name="rmclient.exe" OR process_file_name="remoteposworker.exe" OR
process_file_name="relpost.exe" OR process_file_name="registeriepkeys.exe" OR process_file_name="register-cimprovider.exe"
OR process_file_name="recoverydrive.exe" OR process_file_name="reagentc.exe" OR
process_file_name="rdpsauachelper.exe" OR process_file_name="rdpsaproxy.exe" OR
process_file_name="rdpsa.exe" OR process_file_name="route.exe" OR process_file_name="rmactivate_ssp_isv.exe"
OR process_file_name="rmactivate_ssp.exe" OR process_file_name="rmactivate_isv.exe"
OR process_file_name="rmactivate.exe" OR process_file_name="rdspnf.exe" OR process_file_name="proximityuxhost.exe"
OR process_file_name="printisolationhost.exe" OR process_file_name="printdialoghost3d.exe"
OR process_file_name="printdialoghost.exe" OR process_file_name="printbrmui.exe"
OR process_file_name="presentationsettings.exe" OR process_file_name="presentationhost.exe"
OR process_file_name="pnputil.exe" OR process_file_name="pnpunattend.exe" OR process_file_name="pkgmgr.exe"
OR process_file_name="pickerhost.exe" OR process_file_name="passwordonwakesettingflyout.exe"
OR process_file_name="ping.exe" OR process_file_name="pathping.exe" OR process_file_name="optionalfeatures.exe"
OR process_file_name="openwith.exe" OR process_file_name="networkuxbroker.exe" OR
process_file_name="netplwiz.exe" OR process_file_name="netproj.exe" OR process_file_name="netevtfwdr.exe"
OR process_file_name="netcfgnotifyobjecthost.exe" OR process_file_name="narrator.exe"
OR process_file_name="netstat.exe" OR process_file_name="napstat.exe" OR process_file_name="musnotificationux.exe"
OR process_file_name="musnotification.exe" OR process_file_name="multidigimon.exe"
OR process_file_name="muiunattend.exe" OR process_file_name="msspellcheckinghost.exe"
OR process_file_name="mpsigstub.exe" OR process_file_name="migautoplay.exe" OR process_file_name="mdsched.exe"
OR process_file_name="mdres.exe" OR process_file_name="mbaeparsertask.exe" OR process_file_name="magnify.exe"
OR process_file_name="mschedexe.exe" OR process_file_name="mrt.exe" OR process_file_name="mrinfo.exe"
OR process_file_name="mdmappinstaller.exe" OR process_file_name="mdmagent.exe" OR
process_file_name="mdeserver.exe" OR process_file_name="lsaiso.exe" OR process_file_name="logonui.exe"
OR process_file_name="lockscreencontentserver.exe" OR process_file_name="lockapphost.exe"
OR process_file_name="locator.exe" OR process_file_name="locationnotifications.exe"
OR process_file_name="locationnotificationwindows.exe" OR process_file_name="licensingui.exe"
OR process_file_name="licensemanagershellext.exe" OR process_file_name="legacynetuxhost.exe"
OR process_file_name="launchwinapp.exe" OR process_file_name="launchtm.exe" OR process_file_name="languagecomponentsinstallercomhandler.exe"
OR process_file_name="installagent.exe" OR process_file_name="infdefaultinstall.exe"
OR process_file_name="icsentitlementhost.exe" OR process_file_name="hostname.exe"
OR process_file_name="gettingstarted.exe" OR process_file_name="genvalobj.exe" OR
process_file_name="gamepanel.exe" OR process_file_name="fondue.exe" OR process_file_name="filehistory.exe"
OR process_file_name="fxsunatd.exe" OR process_file_name="fxssvc.exe" OR process_file_name="fxscover.exe"
OR process_file_name="ehstorauthn.exe" OR process_file_name="easeofaccessdialog.exe"
OR process_file_name="easpoliciesbrokerhost.exe" OR process_file_name="eap3host.exe"
OR process_file_name="eosnotify.exe" OR process_file_name="edpcleanup.exe" OR process_file_name="dxpserver.exe"
OR process_file_name="dsmusertask.exe" OR process_file_name="dpiscaling.exe" OR
process_file_name="dmomacpmo.exe" OR process_file_name="dmnotificationbroker.exe"
OR process_file_name="displayswitch.exe" OR process_file_name="dism.exe" OR process_file_name="disksnapshot.exe"
OR process_file_name="deviceproperties.exe" OR process_file_name="devicepairingwizard.exe"
OR process_file_name="deviceenroller.exe" OR process_file_name="deviceeject.exe"
OR process_file_name="devicedisplayobjectprovider.exe" OR process_file_name="defrag.exe"
OR process_file_name="dataexchangehost.exe" OR process_file_name="dwwin.exe" OR
process_file_name="dfdwiz.exe" OR process_file_name="credentialuibroker.exe" OR
process_file_name="computerdefaults.exe" OR process_file_name="compattelrunner.exe"
OR process_file_name="compmgmtlauncher.exe" OR process_file_name="cloudstoragewizard.exe"
OR process_file_name="cloudnotifications.exe" OR process_file_name="cloudexperiencehostbroker.exe"
OR process_file_name="clipup.exe" OR process_file_name="checknetisolation.exe" OR
process_file_name="certenrollctrl.exe" OR process_file_name="castsrv.exe" OR process_file_name="camerasettingsuihost.exe"
OR process_file_name="bytecodegenerator.exe" OR process_file_name="bitlockerwizardelev.exe"
OR process_file_name="bitlockerwizard.exe" OR process_file_name="bitlockerdeviceencryption.exe"
OR process_file_name="bdeunlockwizard.exe" OR process_file_name="bdeuisrv.exe" OR
process_file_name="bdehdcfg.exe" OR process_file_name="backgroundtransferhost.exe"
OR process_file_name="axinstui.exe" OR process_file_name="autoworkplace.exe" OR
process_file_name="authhost.exe" OR process_file_name="atbroker.exe" OR process_file_name="applicationframehost.exe"
OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe")
AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT
match_regex(process_file_path, /(?i)\\windows\\system32/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("System Process Running from Unexpected Location has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 56,
"severity_id", 0,
"rule", create_map("name", "System Process Running from Unexpected Location", "uid", "28179107-099a-464a-94d3-08301e6c055f", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name IN ("xwizard.exe",
"xpsrchvw.exe", "xcopy.exe", "wusa.exe", "wuauclt.exe", "wuapp.exe", "wuapihost.exe",
"wsqmcons.exe", "wsmprovhost.exe", "wscript.exe", "write.exe", "wpr.exe", "wpnpinst.exe",
"wowreg32.exe", "wlrmdr.exe", "wlanext.exe", "wksprt.exe", "wkspbroker.exe", "wisptis.exe",
"winver.exe", "winrshost.exe", "winrs.exe", "winresume.exe", "winlogon.exe", "winload.exe",
"wininit.exe", "wimserv.exe", "wifitask.exe", "wiawow64.exe", "wiaacmgr.exe", "whoami.exe",
"where.exe", "wextract.exe", "wevtutil.exe", "wermgr.exe", "wecutil.exe", "wbengine.exe",
"wbadmin.exe", "waitfor.exe", "w32tm.exe", "vssadmin.exe", "vmicsvc.exe", "verifiergui.exe",
"verifier.exe", "verclsid.exe", "vdsldr.exe", "vds.exe", "userinit.exe", "upnpcont.exe",
"unregmp2.exe", "unlodctr.exe", "ucsvc.exe", "tzutil.exe", "tzsync.exe", "typeperf.exe",
"tskill.exe", "tsdiscon.exe", "tscon.exe", "tracerpt.exe", "tpmvscmgrsvr.exe", "tpmvscmgr.exe",
"timeout.exe", "tcmsetup.exe", "taskmgr.exe", "tasklist.exe", "taskkill.exe", "taskhostw.exe",
"taskhost.exe", "taskeng.exe", "takeown.exe", "tabcal.exe", "systray.exe", "systemreset.exe",
"systeminfo.exe", "syskey.exe", "sxstrace.exe", "svchost.exe", "subst.exe", "srdelayed.exe",
"spreview.exe", "sppsvc.exe", "spoolsv.exe", "spinstall.exe", "sort.exe", "snmptrap.exe",
"smss.exe", "slui.exe", "sihost.exe", "sigverif.exe", "shutdown.exe", "shrpubw.exe",
"shadow.exe", "setx.exe", "setupugc.exe", "setupcl.exe", "setspn.exe", "sethc.exe",
"sessionmsg.exe", "services.exe", "secinit.exe", "sdiagnhost.exe", "sdclt.exe",
"sdchange.exe", "sdbinst.exe", "schtasks.exe", "sc.exe", "sbunattend.exe", "rwinsta.exe",
"runonce.exe", "rundll32.exe", "runas.exe", "rstrui.exe", "rrinstaller.exe", "rmttpmvscmgrsvr.exe",
"resmon.exe", "reset.exe", "replace.exe", "repair-bde.exe", "relog.exe", "rekeywiz.exe",
"regsvr32.exe", "regini.exe", "regedt32.exe", "reg.exe", "recover.exe", "recdisc.exe",
"rdrleakdiag.exe", "rdpinput.exe", "rdpclip.exe", "rasphone.exe", "raserver.exe",
"rasdial.exe", "rasautou.exe", "qwinsta.exe", "quser.exe", "query.exe", "qprocess.exe",
"qappsrv.exe", "pwlauncher.exe", "psr.exe", "provtool.exe", "proquota.exe", "printui.exe",
"printfilterpipelinesvc.exe", "print.exe", "prevhost.exe", "powercfg.exe", "poqexec.exe",
"plasrv.exe", "phoneactivate.exe", "perfmon.exe", "pcwrun.exe", "pcawrk.exe", "pcaui.exe",
"pcalua.exe", "p2phost.exe", "osk.exe", "openfiles.exe", "omadmprc.exe", "omadmclient.exe",
"odbcconf.exe", "odbcad32.exe", "ocsetup.exe", "ntprint.exe", "ntoskrnl.exe", "nslookup.exe",
"notepad.exe", "nltest.exe", "newdev.exe", "netsh.exe", "netiougc.exe", "netcfg.exe",
"netbtugc.exe", "net1.exe", "net.exe", "ndadmin.exe", "nbtstat.exe", "mtstocom.exe",
"mstsc.exe", "msra.exe", "mspaint.exe", "msinfo32.exe", "msiexec.exe", "mshta.exe",
"msg.exe", "msfeedssync.exe", "msdtc.exe", "msdt.exe", "msconfig.exe", "mpnotify.exe",
"mountvol.exe", "mobsync.exe", "mmc.exe", "mfpmp.exe", "mctadmin.exe", "mcbuilder.exe",
"mblctr.exe", "manage-bde.exe", "makecab.exe", "lsm.exe", "lsass.exe", "lpremove.exe",
"lpksetup.exe", "lpkinstall.exe", "logoff.exe", "logman.exe", "logagent.exe", "lodctr.exe",
"licensingdiag.exe", "label.exe", "ktmutil.exe", "ksetup.exe", "klist.exe", "isoburn.exe",
"iscsicpl.exe", "iscsicli.exe", "irftp.exe", "ipconfig.exe", "immersivetpmvscmgrsvr.exe",
"iexpress.exe", "ieetwcollector.exe", "ieunatt.exe", "ie4uinit.exe", "icsunattend.exe",
"icardagt.exe", "icacls.exe", "hwrreg.exe", "hwrcomp.exe", "help.exe", "hdwwiz.exe",
"grpconv.exe", "gpupdate.exe", "gpscript.exe", "gpresult.exe", "getmac.exe", "fveprompt.exe",
"fvenotify.exe", "ftp.exe", "fsutil.exe", "fsquirt.exe", "fsavailux.exe", "forfiles.exe",
"fontview.exe", "fontdrvhost.exe", "fodhelper.exe", "fltmc.exe", "fixmapi.exe",
"finger.exe", "findstr.exe", "find.exe", "fhmanagew.exe", "fc.exe", "extrac32.exe",
"expand.exe", "eventvwr.exe", "eventcreate.exe", "eudcedit.exe", "esentutl.exe",
"embeddedapplauncher.exe", "efsui.exe", "easinvoker.exe", "dxdiag.exe", "dwm.exe",
"dvdupgrd.exe", "dvdplay.exe", "dstokenclean.exe", "dsregcmd.exe", "drvinst.exe",
"drvcfg.exe", "driverquery.exe", "dpnsvr.exe", "dpapimig.exe", "doskey.exe", "dnscacheugc.exe",
"dmclient.exe", "dmcfghost.exe", "dmcertinst.exe", "dllhst3g.exe", "dllhost.exe",
"djoin.exe", "dispdiag.exe", "diskraid.exe", "diskperf.exe", "diskpart.exe", "dinotify.exe",
"diantz.exe", "dialer.exe", "dfrgui.exe", "ddodiag.exe", "dcomcnfg.exe", "dccw.exe",
"dashost.exe", "cttunesvr.exe", "cttune.exe", "ctfmon.exe", "csrss.exe", "cscript.exe",
"credwiz.exe", "convert.exe", "control.exe", "consent.exe", "conhost.exe", "compact.exe",
"comp.exe", "colorcpl.exe", "cofire.exe", "cmstp.exe", "cmmon32.exe", "cmdl32.exe",
"cmdkey.exe", "cmd.exe", "clip.exe", "cliconfg.exe", "cleanmgr.exe", "cipher.exe",
"choice.exe", "chkntfs.exe", "chkdsk.exe", "chgusr.exe", "chgport.exe", "chglogon.exe",
"charmap.exe", "changepk.exe", "change.exe", "certutil.exe", "certreq.exe", "cdpreference.exe",
"calc.exe", "cacls.exe", "bthudtask.exe", "browser_broker.exe", "bridgeunattend.exe",
"bootsect.exe", "bootim.exe", "bootcfg.exe", "bitsadmin.exe", "bdeunlock.exe", "bdechangepin.exe",
"bcdedit.exe", "bcdboot.exe", "bcastdvr.exe", "backgroundtaskhost.exe", "baaupdate.exe",
"autofmt.exe", "autoconv.exe", "autochk.exe", "auditpol.exe", "audiodg.exe", "attrib.exe",
"at.exe", "appidpolicyconverter.exe", "appidcertstorecheck.exe", "alg.exe", "aitstatic.exe",
"aitagent.exe", "acu.exe", "wpcmon.exe", "workfolders.exe", "windowsupdateelevatedinstaller.exe",
"windowsanytimeupgradeui.exe", "windowsanytimeupgraderesults.exe", "windowsanytimeupgrade.exe",
"windowsactiondialog.exe", "windows.media.backgroundplayback.exe", "winsat.exe",
"werfaultsecure.exe", "werfault.exe", "webcache.exe", "wallpaperhost.exe", "wwahost.exe",
"wudfhost.exe", "wsreset.exe", "wsmanhttpconfig.exe", "wscollect.exe", "wpdshextautoplay.exe",
"wmpdmc.exe", "wfs.exe", "vaultsysui.exe", "vaultcmd.exe", "vssvc.exe", "utilman.exe",
"usoclient.exe", "useraccountcontrolsettings.exe", "useraccountbroker.exe", "upgraderesultsui.exe",
"ui0detect.exe", "tswpfwrp.exe", "tpminit.exe", "tokenbrokercookies.exe", "thumbnailextractionhost.exe",
"taskmgr.exe", "tapiunattend.exe", "tswbprxy.exe", "tstheme.exe", "tracert.exe",
"tcpsvcs.exe", "systemsettingsremovedevice.exe", "systemsettingsbroker.exe", "systemsettingsadminflows.exe",
"systempropertiesremote.exe", "systempropertiesprotection.exe", "systempropertiesperformance.exe",
"systempropertieshardware.exe", "systempropertiesdataexecutionprevention.exe", "systempropertiescomputername.exe",
"systempropertiesadvanced.exe", "sysreseterr.exe", "synchost.exe", "stikynot.exe",
"srtasks.exe", "sppextcomobj.exe", "spaceagent.exe", "soundrecorder.exe", "snippingtool.exe",
"sndvol.exe", "smartscreensettings.exe", "slidetoshutdown.exe", "settingsynchost.exe",
"setieinstalleddate.exe", "sensordataservice.exe", "secedit.exe", "searchprotocolhost.exe",
"searchindexer.exe", "searchfilterhost.exe", "sihclient.exe", "runtimebroker.exe",
"runlegacycplelevated.exe", "rpcping.exe", "rmclient.exe", "remoteposworker.exe",
"relpost.exe", "registeriepkeys.exe", "register-cimprovider.exe", "recoverydrive.exe",
"reagentc.exe", "rdpsauachelper.exe", "rdpsaproxy.exe", "rdpsa.exe", "route.exe",
"rmactivate_ssp_isv.exe", "rmactivate_ssp.exe", "rmactivate_isv.exe", "rmactivate.exe",
"rdspnf.exe", "proximityuxhost.exe", "printisolationhost.exe", "printdialoghost3d.exe",
"printdialoghost.exe", "printbrmui.exe", "presentationsettings.exe", "presentationhost.exe",
"pnputil.exe", "pnpunattend.exe", "pkgmgr.exe", "pickerhost.exe", "passwordonwakesettingflyout.exe",
"ping.exe", "pathping.exe", "optionalfeatures.exe", "openwith.exe", "networkuxbroker.exe",
"netplwiz.exe", "netproj.exe", "netevtfwdr.exe", "netcfgnotifyobjecthost.exe", "narrator.exe",
"netstat.exe", "napstat.exe", "musnotificationux.exe", "musnotification.exe", "multidigimon.exe",
"muiunattend.exe", "msspellcheckinghost.exe", "mpsigstub.exe", "migautoplay.exe",
"mdsched.exe", "mdres.exe", "mbaeparsertask.exe", "magnify.exe", "mschedexe.exe",
"mrt.exe", "mrinfo.exe", "mdmappinstaller.exe", "mdmagent.exe", "mdeserver.exe",
"lsaiso.exe", "logonui.exe", "lockscreencontentserver.exe", "lockapphost.exe", "locator.exe",
"locationnotifications.exe", "locationnotificationwindows.exe", "licensingui.exe",
"licensemanagershellext.exe", "legacynetuxhost.exe", "launchwinapp.exe", "launchtm.exe",
"languagecomponentsinstallercomhandler.exe", "installagent.exe", "infdefaultinstall.exe",
"icsentitlementhost.exe", "hostname.exe", "gettingstarted.exe", "genvalobj.exe",
"gamepanel.exe", "fondue.exe", "filehistory.exe", "fxsunatd.exe", "fxssvc.exe",
"fxscover.exe", "ehstorauthn.exe", "easeofaccessdialog.exe", "easpoliciesbrokerhost.exe",
"eap3host.exe", "eosnotify.exe", "edpcleanup.exe", "dxpserver.exe", "dsmusertask.exe",
"dpiscaling.exe", "dmomacpmo.exe", "dmnotificationbroker.exe", "displayswitch.exe",
"dism.exe", "disksnapshot.exe", "deviceproperties.exe", "devicepairingwizard.exe",
"deviceenroller.exe", "deviceeject.exe", "devicedisplayobjectprovider.exe", "defrag.exe",
"dataexchangehost.exe", "dwwin.exe", "dfdwiz.exe", "credentialuibroker.exe", "computerdefaults.exe",
"compattelrunner.exe", "compmgmtlauncher.exe", "cloudstoragewizard.exe", "cloudnotifications.exe",
"cloudexperiencehostbroker.exe", "clipup.exe", "checknetisolation.exe", "certenrollctrl.exe",
"castsrv.exe", "camerasettingsuihost.exe", "bytecodegenerator.exe", "bitlockerwizardelev.exe",
"bitlockerwizard.exe", "bitlockerdeviceencryption.exe", "bdeunlockwizard.exe", "bdeuisrv.exe",
"bdehdcfg.exe", "backgroundtransferhost.exe", "axinstui.exe", "autoworkplace.exe",
"authhost.exe", "atbroker.exe", "applicationframehost.exe", "adaptertroubleshooter.exe",
"arp.exe")) AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND
(NOT match(process_file_path, /(?i)\\windows\\system32/)=true)
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "System Process Running from Unexpected Location has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Windows Defense Evasion Tactics", "Masquerading - Rename System Utilities"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 56,
severity_id = 0,
rule = {"name": "System Process Running from Unexpected Location", "uid": "28179107-099a-464a-94d3-08301e6c055f", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: None
references: []
@@ -322,4 +214,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
Vendored
+41 -47
View File
@@ -5,52 +5,45 @@ status: production
description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
Tool) that delete backup files. This is typically used by ransomware to prevent
recovery.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%")
OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%"))
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("WBAdmin Delete System Backups has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 0,
"risk_score", 15,
"severity_id", 0,
"rule", create_map("name", "WBAdmin Delete System Backups", "uid", "71efbf52-4dbb-4c00-a520-306aa546cbb7", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="wbadmin.exe"
AND (process_cmd_line LIKE "%systemstatebackup%" OR process_cmd_line LIKE "%catalog%"
OR process_cmd_line LIKE "%delete%")
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "WBAdmin Delete System Backups has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Ryuk Ransomware", "Ransomware"],
class_name = "Detection Report",
confidence = 50,
confidence_id = 2,
duration = 0,
impact = 30,
impact_id = 2,
kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}],
nist = ["DE.AE"],
risk_level = "Info",
category_uid = 2,
class_uid = 102001,
risk_level_id = 0,
risk_score = 15,
severity_id = 0,
rule = {"name": "WBAdmin Delete System Backups", "uid": "71efbf52-4dbb-4c00-a520-306aa546cbb7", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
@@ -115,4 +108,5 @@ test:
- file_name: windows-security_bcdedit_wbadmin.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml
Vendored
+43 -50
View File
@@ -5,55 +5,47 @@ status: production
description: The wevtutil.exe application is the windows event log utility. This searches
for wevtutil.exe with parameters for clearing the application, security, setup,
powershell, sysmon, or system event logs.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line,
/(?i)setup/)=true OR match_regex(process_cmd_line, /(?i)application/)=true OR match_regex(process_cmd_line,
/(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line,
/(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("WevtUtil Usage To Clear Logs has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 3,
"risk_score", 63,
"severity_id", 0,
"rule", create_map("name", "WevtUtil Usage To Clear Logs", "uid", "5438113c-cdd9-11eb-93b8-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)powershell/)=true
OR match(process_cmd_line, /(?i)setup/)=true OR match(process_cmd_line, /(?i)application/)=true
OR match(process_cmd_line, /(?i)sysmon/)=true OR match(process_cmd_line, /(?i)system/)=true
OR match(process_cmd_line, /(?i)security/)=true) AND process_cmd_line LIKE "% cl
%" AND process_file_name="wevtutil.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "WevtUtil Usage To Clear Logs has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware", "Insider Threat", "CISA AA22-264A"],
class_name = "Detection Report",
confidence = 90,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "High",
category_uid = 2,
class_uid = 102001,
risk_level_id = 3,
risk_score = 63,
severity_id = 0,
rule = {"name": "WevtUtil Usage To Clear Logs", "uid": "5438113c-cdd9-11eb-93b8-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
@@ -122,4 +114,5 @@ test:
- file_name: clear_evt.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml
Vendored
+40 -47
View File
@@ -5,52 +5,44 @@ status: production
description: This search is to detect execution of wevtutil.exe to disable logs. This
technique was seen in several ransomware to disable the event logs to evade alerts
and detections in compromised host.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "%
sl %") AND process_file_name="wevtutil.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Wevtutil Usage To Disable Logs has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 3,
"risk_score", 63,
"severity_id", 0,
"rule", create_map("name", "Wevtutil Usage To Disable Logs", "uid", "a4bdc944-cdd9-11eb-ac97-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_cmd_line LIKE "%/e:false%"
AND process_cmd_line LIKE "% sl %" AND process_file_name="wevtutil.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Wevtutil Usage To Disable Logs has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Windows Log Manipulation", "Ransomware", "Insider Threat", "Information Sabotage"],
class_name = "Detection Report",
confidence = 90,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "High",
category_uid = 2,
class_uid = 102001,
risk_level_id = 3,
risk_score = 63,
severity_id = 0,
rule = {"name": "Wevtutil Usage To Disable Logs", "uid": "a4bdc944-cdd9-11eb-ac97-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
@@ -118,4 +110,5 @@ test:
- file_name: disable_evt.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_bits_job_persistence.yml
Vendored
+43 -49
View File
@@ -9,54 +9,47 @@ description: The following query identifies Microsoft Background Intelligent Tra
the BITS job created and capture any files written to disk. It is possible for BITS
to be used to upload files and this may require further network data analysis to
identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%")
OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%")
OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%")
OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Bits Job Persistence has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 56,
"severity_id", 0,
"rule", create_map("name", "Windows Bits Job Persistence", "uid", "1e25e97a-8ea4-11ec-9767-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_cmd_line LIKE "%resume%"
OR process_cmd_line LIKE "%setcustomheaders%" OR process_cmd_line LIKE "%setminretrydelay%"
OR process_cmd_line LIKE "%setnotifycmdline%" OR process_cmd_line LIKE "%setnotifyflags%"
OR process_cmd_line LIKE "%addfile%" OR process_cmd_line LIKE "%create%") AND process_file_name="bitsadmin.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Bits Job Persistence has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["BITS Jobs", "Living Off The Land"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 56,
severity_id = 0,
rule = {"name": "Windows Bits Job Persistence", "uid": "1e25e97a-8ea4-11ec-9767-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -126,4 +119,5 @@ test:
- file_name: bits-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml
Vendored
+40 -47
View File
@@ -14,52 +14,44 @@ description: The following query identifies Microsoft Background Intelligent Tra
and child processes to capture any behaviors and artifacts. In some suspicious and
malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
to list out the jobs during investigation.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Bitsadmin Download File has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 49,
"severity_id", 0,
"rule", create_map("name", "Windows Bitsadmin Download File", "uid", "d76e8188-8f5a-11ec-ace4-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_cmd_line LIKE "%transfer%"
AND process_file_name="bitsadmin.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Bitsadmin Download File has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware", "Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 49,
severity_id = 0,
rule = {"name": "Windows Bitsadmin Download File", "uid": "d76e8188-8f5a-11ec-ace4-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -132,4 +124,5 @@ test:
- file_name: bits-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_certutil_decode_file.yml
Vendored
+40 -47
View File
@@ -10,52 +10,44 @@ description: CertUtil.exe may be used to `encode` and `decode` a file, including
and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
further execution. During triage, identify the source of the file being decoded.
Review its contents or execution behavior for further analysis.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows CertUtil Decode File has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 40,
"severity_id", 0,
"rule", create_map("name", "Windows CertUtil Decode File", "uid", "b06983f4-8f72-11ec-ab50-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_cmd_line LIKE "%decode%"
AND process_file_name="certutil.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows CertUtil Decode File has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Deobfuscate-Decode Files or Information", "Living Off The Land"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 50,
impact_id = 3,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 40,
severity_id = 0,
rule = {"name": "Windows CertUtil Decode File", "uid": "b06983f4-8f72-11ec-ab50-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -124,4 +116,5 @@ test:
- file_name: encode-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml
Vendored
+41 -48
View File
@@ -9,53 +9,45 @@ description: Certutil.exe may download a file from a remote destination using `-
However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
During triage, capture any files on disk and review. Review the reputation of the
remote IP or domain in question.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%")
AND like(process_cmd_line, "%urlcache%")) OR like(process_cmd_line, "%urlcache%")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows CertUtil URLCache Download has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 4,
"risk_score", 90,
"severity_id", 0,
"rule", create_map("name", "Windows CertUtil URLCache Download", "uid", "8cb1ad38-8f6d-11ec-87a3-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="certutil.exe"
AND process_cmd_line LIKE "%split%" AND process_cmd_line LIKE "%urlcache%") OR process_cmd_line
LIKE "%urlcache%"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows CertUtil URLCache Download has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"],
class_name = "Detection Report",
confidence = 100,
confidence_id = 3,
duration = 0,
impact = 90,
impact_id = 5,
kill_chain = [{"phase": "Command And Control", "phase_id": 6}],
nist = ["DE.AE"],
risk_level = "Critical",
category_uid = 2,
class_uid = 102001,
risk_level_id = 4,
risk_score = 90,
severity_id = 0,
rule = {"name": "Windows CertUtil URLCache Download", "uid": "8cb1ad38-8f6d-11ec-87a3-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -121,4 +113,5 @@ test:
- file_name: T1105-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml
Vendored
+41 -48
View File
@@ -9,53 +9,45 @@ description: 'Certutil.exe may download a file from a remote destination using `
\ During triage, capture any files on disk and review. Review the reputation of
the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%")
AND like(process_cmd_line, "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows CertUtil VerifyCtl Download has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 4,
"risk_score", 90,
"severity_id", 0,
"rule", create_map("name", "Windows CertUtil VerifyCtl Download", "uid", "9ac29c40-8f6b-11ec-b19a-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="certutil.exe"
AND process_cmd_line LIKE "%split%" AND process_cmd_line LIKE "%verifyctl%") OR
process_cmd_line LIKE "%verifyctl%"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows CertUtil VerifyCtl Download has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"],
class_name = "Detection Report",
confidence = 100,
confidence_id = 3,
duration = 0,
impact = 90,
impact_id = 5,
kill_chain = [{"phase": "Command And Control", "phase_id": 6}],
nist = ["DE.AE"],
risk_level = "Critical",
category_uid = 2,
class_uid = 102001,
risk_level_id = 4,
risk_score = 90,
severity_id = 0,
rule = {"name": "Windows CertUtil VerifyCtl Download", "uid": "9ac29c40-8f6b-11ec-b19a-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -122,4 +114,5 @@ test:
- file_name: T1105-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml
Vendored
+40 -47
View File
@@ -10,52 +10,44 @@ description: The following analytic identifies the use of reg.exe performing an
to a legitimate system component which may cause that component to not work when
executed. When that system component is executed through normal system operation
the adversary's code will be executed instead.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows COM Hijacking InprocServer32 Modification has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 3,
"risk_score", 64,
"severity_id", 0,
"rule", create_map("name", "Windows COM Hijacking InprocServer32 Modification", "uid", "0ae05a0f-bc84-456b-822a-a5b9c081c7ca", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where match(process_cmd_line, /(?i)inprocserver32/)=true
AND process_file_name="reg.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows COM Hijacking InprocServer32 Modification has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Living Off The Land"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 80,
impact_id = 5,
kill_chain = [{"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "High",
category_uid = 2,
class_uid = 102001,
risk_level_id = 3,
risk_score = 64,
severity_id = 0,
rule = {"name": "Windows COM Hijacking InprocServer32 Modification", "uid": "0ae05a0f-bc84-456b-822a-a5b9c081c7ca", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -121,4 +113,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml
Vendored
+42 -49
View File
@@ -20,54 +20,46 @@ description: 'The following analytic identifies the use of Windows Curl.exe uplo
what they are attempting to upload (zip vs txt). During triage, review parallel
processes for further behavior. In addition, identify if the upload was successful
in network logs. If a file was uploaded, isolate the endpoint and review.'
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data
%") OR like(process_cmd_line, "%-d %") OR like(process_cmd_line, "%--upload-file
%") OR like(process_cmd_line, "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Curl Upload to Remote Destination has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 4,
"risk_score", 80,
"severity_id", 0,
"rule", create_map("name", "Windows Curl Upload to Remote Destination", "uid", "cc8d046a-543b-11ec-b864-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-F %"
OR process_cmd_line LIKE "%--data %" OR process_cmd_line LIKE "%-d %" OR process_cmd_line
LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match(process_file_name,
/(?i)curl.exe/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Curl Upload to Remote Destination has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Ingress Tool Transfer", "Insider Threat"],
class_name = "Detection Report",
confidence = 100,
confidence_id = 3,
duration = 0,
impact = 80,
impact_id = 5,
kill_chain = [{"phase": "Command And Control", "phase_id": 6}],
nist = ["DE.AE"],
risk_level = "Critical",
category_uid = 2,
class_uid = 102001,
risk_level_id = 4,
risk_score = 80,
severity_id = 0,
rule = {"name": "Windows Curl Upload to Remote Destination", "uid": "cc8d046a-543b-11ec-b864-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
@@ -132,4 +124,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml
Vendored
+41 -48
View File
@@ -12,53 +12,45 @@ description: The following analytic identifies the potential edition of a defaul
default group policy objects to obtain further access, deploy persistence or execute
malware across a large number of hosts. Security teams should monitor the edition
of the default GPOs.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="mmc.exe" AND like(process_cmd_line, "%gpme.msc%"))
OR like(process_cmd_line, "%31B2F340-016D-11D2-945F-00C04FB984F9%") OR like(process_cmd_line,
"%6AC1786C-016F-11D2-945F-00C04fB984F9%")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Default Group Policy Object Modified with GPME has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 50,
"severity_id", 0,
"rule", create_map("name", "Windows Default Group Policy Object Modified with GPME", "uid", "bcb55c13-067b-4648-98f3-627010f72520", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="mmc.exe" AND
process_cmd_line LIKE "%gpme.msc%") OR process_cmd_line LIKE "%31B2F340-016D-11D2-945F-00C04FB984F9%"
OR process_cmd_line LIKE "%6AC1786C-016F-11D2-945F-00C04fB984F9%"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Default Group Policy Object Modified with GPME has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Active Directory Privilege Escalation"],
class_name = "Detection Report",
confidence = 50,
confidence_id = 2,
duration = 0,
impact = 100,
impact_id = 5,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 50,
severity_id = 0,
rule = {"name": "Windows Default Group Policy Object Modified with GPME", "uid": "bcb55c13-067b-4648-98f3-627010f72520", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -126,4 +118,5 @@ test:
- file_name: security-4688.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/security-4688.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml
Vendored
+41 -48
View File
@@ -4,53 +4,45 @@ version: 1
status: production
description: The following analytic identifies usage of the MPCmdRun utility that
can be abused by adversaries by moving it to a new directory.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path,
/(?i)\\windows defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows
defender\\platform/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Defender Tools in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 56,
"severity_id", 0,
"rule", create_map("name", "Windows Defender Tools in Non Standard Path", "uid", "c205bd2e-cd5b-4224-8510-578a2a1f83d7", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where match(process_file_name, /(?i)mpcmdrun.exe/)=true
AND (NOT match(process_file_path, /(?i)\\windows defender/)=true) AND (NOT match(process_file_path,
/(?i)\\microsoft\\windows defender\\platform/)=true)
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Defender Tools in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Living Off The Land"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 56,
severity_id = 0,
rule = {"name": "Windows Defender Tools in Non Standard Path", "uid": "c205bd2e-cd5b-4224-8510-578a2a1f83d7", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
references:
@@ -111,4 +103,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml
Vendored
+40 -47
View File
@@ -8,52 +8,44 @@ description: DiskShadow.exe is a Microsoft Signed binary present on Windows Serv
usage of the scripting mode flags in executions of DiskShadow. During triage, compare
to known backup behavior in your environment and then review the scripts called
by diskshadow.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%"))
AND process_file_name="diskshadow.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Diskshadow Proxy Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 49,
"severity_id", 0,
"rule", create_map("name", "Windows Diskshadow Proxy Execution", "uid", "aa502688-9037-11ec-842d-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_cmd_line LIKE "%/s%" OR
process_cmd_line LIKE "%-S%") AND process_file_name="diskshadow.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Diskshadow Proxy Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 49,
severity_id = 0,
rule = {"name": "Windows Diskshadow Proxy Execution", "uid": "aa502688-9037-11ec-842d-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on processes that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
@@ -115,4 +107,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml
Vendored
+70 -79
View File
@@ -8,84 +8,74 @@ description: The following analytic identifies native .net binaries within the W
an alert will be generated. Adversaries abuse these binaries as they are native
to Windows and native DotNet. Note that not all SDK (post install of Windows) are
captured in the list. Lookup - https://github.com/splunk/security_content/blob/develop/lookups/is_net_windows_file.csv.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name,
/(?i)comsvcconfig.exe/)=true OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true
OR match_regex(process_file_name, /(?i)dfsvc.exe/)=true OR match_regex(process_file_name,
/(?i)microsoft.workflow.compiler.exe/)=true OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true
OR match_regex(process_file_name, /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name,
/(?i)addinprocess.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true
OR match_regex(process_file_name, /(?i)addinutil.exe/)=true OR match_regex(process_file_name,
/(?i)aspnet_compiler.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true
OR match_regex(process_file_name, /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name,
/(?i)caspol.exe/)=true OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true
OR match_regex(process_file_name, /(?i)edmgen.exe/)=true OR match_regex(process_file_name,
/(?i)installutil.exe/)=true OR match_regex(process_file_name, /(?i)jsc.exe/)=true
OR match_regex(process_file_name, /(?i)ngentask.exe/)=true OR match_regex(process_file_name,
/(?i)regasm.exe/)=true OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true
OR match_regex(process_file_name, /(?i)sdnbr.exe/)=true OR match_regex(process_file_name,
/(?i)acu.exe/)=true OR match_regex(process_file_name, /(?i)appvstreamingux.exe/)=true
OR match_regex(process_file_name, /(?i)dsac.exe/)=true OR match_regex(process_file_name,
/(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.uev.synccontroller.exe/)=true
OR match_regex(process_file_name, /(?i)mtedit.exe/)=true OR match_regex(process_file_name,
/(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, /(?i)servermanager.exe/)=true
OR match_regex(process_file_name, /(?i)stordiag.exe/)=true OR match_regex(process_file_name,
/(?i)tzsync.exe/)=true OR match_regex(process_file_name, /(?i)uevagentpolicygenerator.exe/)=true
OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true OR match_regex(process_file_name,
/(?i)uevtemplatebaselinegenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true
OR match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name,
/(?i)iediagcmd.exe/)=true OR match_regex(process_file_name, /(?i)xbox.tcui.exe/)=true
OR match_regex(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true
OR match_regex(process_file_name, /(?i)iisual.exe/)=true OR match_regex(process_file_name,
/(?i)filehistory.exe/)=true OR match_regex(process_file_name, /(?i)secureassessmentbrowser.exe/)=true)
AND (NOT (match_regex(process_file_path, /(?i)\\windows\\system32/)=true OR match_regex(process_file_path,
/(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path, /(?i)\\windows\\adws/)=true
OR match_regex(process_file_path, /(?i)\\windows\\networkcontroller/)=true OR match_regex(process_file_path,
/(?i)\\windows\\systemapps/)=true OR match_regex(process_file_path, /(?i)\\winsxs/)=true
OR match_regex(process_file_path, /(?i)\\microsoft.net/)=true))
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows DotNet Binary in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 49,
"severity_id", 0,
"rule", create_map("name", "Windows DotNet Binary in Non Standard Path", "uid", "21179107-099a-324a-94d3-08301e6c065f", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (match(process_file_name, /(?i)MSBuild.exe/)=true
OR match(process_file_name, /(?i)comsvcconfig.exe/)=true OR match(process_file_name,
/(?i)dfsradmin.exe/)=true OR match(process_file_name, /(?i)dfsvc.exe/)=true OR match(process_file_name,
/(?i)microsoft.workflow.compiler.exe/)=true OR match(process_file_name, /(?i)smsvchost.exe/)=true
OR match(process_file_name, /(?i)wsatconfig.exe/)=true OR match(process_file_name,
/(?i)addinprocess.exe/)=true OR match(process_file_name, /(?i)addinprocess32.exe/)=true
OR match(process_file_name, /(?i)addinutil.exe/)=true OR match(process_file_name,
/(?i)aspnet_compiler.exe/)=true OR match(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true
OR match(process_file_name, /(?i)aspnet_regsql.exe/)=true OR match(process_file_name,
/(?i)caspol.exe/)=true OR match(process_file_name, /(?i)datasvcutil.exe/)=true OR
match(process_file_name, /(?i)edmgen.exe/)=true OR match(process_file_name, /(?i)installutil.exe/)=true
OR match(process_file_name, /(?i)jsc.exe/)=true OR match(process_file_name, /(?i)ngentask.exe/)=true
OR match(process_file_name, /(?i)regasm.exe/)=true OR match(process_file_name, /(?i)regsvcs.exe/)=true
OR match(process_file_name, /(?i)sdnbr.exe/)=true OR match(process_file_name, /(?i)acu.exe/)=true
OR match(process_file_name, /(?i)appvstreamingux.exe/)=true OR match(process_file_name,
/(?i)dsac.exe/)=true OR match(process_file_name, /(?i)lbfoadmin.exe/)=true OR match(process_file_name,
/(?i)microsoft.uev.synccontroller.exe/)=true OR match(process_file_name, /(?i)mtedit.exe/)=true
OR match(process_file_name, /(?i)scriptrunner.exe/)=true OR match(process_file_name,
/(?i)servermanager.exe/)=true OR match(process_file_name, /(?i)stordiag.exe/)=true
OR match(process_file_name, /(?i)tzsync.exe/)=true OR match(process_file_name, /(?i)uevagentpolicygenerator.exe/)=true
OR match(process_file_name, /(?i)uevappmonitor.exe/)=true OR match(process_file_name,
/(?i)uevtemplatebaselinegenerator.exe/)=true OR match(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true
OR match(process_file_name, /(?i)powershell_ise.exe/)=true OR match(process_file_name,
/(?i)iediagcmd.exe/)=true OR match(process_file_name, /(?i)xbox.tcui.exe/)=true
OR match(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true
OR match(process_file_name, /(?i)iisual.exe/)=true OR match(process_file_name, /(?i)filehistory.exe/)=true
OR match(process_file_name, /(?i)secureassessmentbrowser.exe/)=true) AND (NOT (match(process_file_path,
/(?i)\\windows\\system32/)=true OR match(process_file_path, /(?i)\\windows\\syswow64/)=true
OR match(process_file_path, /(?i)\\windows\\adws/)=true OR match(process_file_path,
/(?i)\\windows\\networkcontroller/)=true OR match(process_file_path, /(?i)\\windows\\systemapps/)=true
OR match(process_file_path, /(?i)\\winsxs/)=true OR match(process_file_path, /(?i)\\microsoft.net/)=true))
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows DotNet Binary in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Masquerading - Rename System Utilities", "Unusual Processes", "Ransomware", "Signed Binary Proxy Execution InstallUtil", "WhisperGate"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 49,
severity_id = 0,
rule = {"name": "Windows DotNet Binary in Non Standard Path", "uid": "21179107-099a-324a-94d3-08301e6c065f", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
@@ -156,4 +146,5 @@ test:
- file_name: dotnet_lolbin-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml
Vendored
+38 -42
View File
@@ -24,47 +24,42 @@ description: 'The following analytic identifies the usage of Exchange PowerShell
- Get-Recipient cmdlet to view existing recipient objects in your organization.
This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users,
mail contacts, and distribution groups).'
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
device=ucast(map_get(input_event,"device"), "map<string, any>", null) | eval device_hostname=ucast(map_get(device,"hostname"),
"string", null) | eval process=ucast(map_get(input_event,"process"), "map<string,
any>", null) | eval process_file=ucast(map_get(process,"file"), "map<string, any>",
null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null)
| eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_user=ucast(map_get(actor,"user"), "map<string, any>", null) |
eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line,
/(?i)get-recipient/)=true OR match_regex(process_cmd_line, /(?i)new-mailboxsearch/)=true
OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true OR match_regex(process_cmd_line,
/(?i)new-mailboxexportrequest/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid),
"message", concat("Windows Exchange PowerShell Module Usage has been triggered on ", device_hostname, " by ", "Unknown", "."),
"users", [
create_map(
"name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 1,
"risk_score", 32,
"severity_id", 0,
"rule", create_map("name", "Windows Exchange PowerShell Module Usage", "uid", "1118bc65-b0c7-4589-bc2f-ad6802fd0909", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval device_hostname = device.hostname | eval process_file = process.file | eval
process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid
| where match(process_cmd_line, /(?i)get-recipient/)=true OR match(process_cmd_line,
/(?i)new-mailboxsearch/)=true OR match(process_cmd_line, /(?i)new-managementroleassignment/)=true
OR match(process_cmd_line, /(?i)new-mailboxexportrequest/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid},
message = "Windows Exchange PowerShell Module Usage has been triggered on " + device_hostname + " by " + "Unknown" + ".",
users = [{"name": "Unknown", "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["ProxyShell", "CISA AA22-264A"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 40,
impact_id = 3,
kill_chain = [{"phase": "Installation", "phase_id": 5}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 32,
severity_id = 0,
rule = {"name": "Windows Exchange PowerShell Module Usage", "uid": "1118bc65-b0c7-4589-bc2f-ad6802fd0909", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -124,4 +119,5 @@ test:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml
Vendored
+44 -51
View File
@@ -7,56 +7,48 @@ description: The following analytic identifies a recently disclosed arbitraty co
identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve
a remote payload. During triage, review file modifications for html. Identify parallel
process execution that may be related, including an Office Product.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where ((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line,
"%ms-msdt:-id%") OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line,
"%ms-msdt:%") OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe")
AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line,
/(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true)
AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Execute Arbitrary Commands with MSDT has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 4,
"risk_score", 100,
"severity_id", 0,
"rule", create_map("name", "Windows Execute Arbitrary Commands with MSDT", "uid", "f253f9c2-10f0-4cc8-b469-f505ba8c2038", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%ms-msdt:/id%"
OR process_cmd_line LIKE "%ms-msdt:-id%" OR process_cmd_line LIKE "%ms-msdt:/id%"
OR process_cmd_line LIKE "%ms-msdt:%" OR process_cmd_line LIKE "%msdt%") AND process_file_name="msdt.exe")
AND (match(process_cmd_line, /(?i).xml/)=true OR match(process_cmd_line, /(?i)it_rebrowseforfile=/)=true
OR match(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match(process_cmd_line,
/(?i)pcwdiagnostic/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Execute Arbitrary Commands with MSDT has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"],
class_name = "Detection Report",
confidence = 100,
confidence_id = 3,
duration = 0,
impact = 100,
impact_id = 5,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Critical",
category_uid = 2,
class_uid = 102001,
risk_level_id = 4,
risk_score = 100,
severity_id = 0,
rule = {"name": "Windows Execute Arbitrary Commands with MSDT", "uid": "f253f9c2-10f0-4cc8-b469-f505ba8c2038", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -124,4 +116,5 @@ test:
- file_name: msdt-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml
Vendored
+36 -40
View File
@@ -9,45 +9,40 @@ description: The following analytic identifies the use of the Invoke-ShareFinder
credentials, etc. Adversaries who have obtained a foothold in an AD network may
leverage PowerView to identify secrets and leverage them for Privilege Escalation
or Lateral Movement.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
device=ucast(map_get(input_event,"device"), "map<string, any>", null) | eval device_hostname=ucast(map_get(device,"hostname"),
"string", null) | eval process=ucast(map_get(input_event,"process"), "map<string,
any>", null) | eval process_file=ucast(map_get(process,"file"), "map<string, any>",
null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null)
| eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_user=ucast(map_get(actor,"user"), "map<string, any>", null) |
eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line,
/(?i)invoke-sharefinder/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid),
"message", concat("Windows File Share Discovery With Powerview has been triggered on ", device_hostname, " by ", "Unknown", "."),
"users", [
create_map(
"name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 48,
"severity_id", 0,
"rule", create_map("name", "Windows File Share Discovery With Powerview", "uid", "ec4f671e-c736-4f78-a4c0-8fe809e952e5", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval device_hostname = device.hostname | eval process_file = process.file | eval
process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid
| where match(process_cmd_line, /(?i)invoke-sharefinder/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid},
message = "Windows File Share Discovery With Powerview has been triggered on " + device_hostname + " by " + "Unknown" + ".",
users = [{"name": "Unknown", "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Active Directory Privilege Escalation"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 60,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 48,
severity_id = 0,
rule = {"name": "Windows File Share Discovery With Powerview", "uid": "ec4f671e-c736-4f78-a4c0-8fe809e952e5", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -99,4 +94,5 @@ test:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml
Vendored
+40 -47
View File
@@ -10,52 +10,44 @@ description: The following analytic identifies the use of the findstr command em
share and decrypt the password (using the AES key that has been made public). While
Microsoft released a patch that impedes Administrators to create unsecure credentials,
existing Group Policy Preferences files with passwords are not removed from SYSVOL.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="findstr.exe" AND like(process_cmd_line, "%cpassword%")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Findstr GPP Discovery has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 56,
"severity_id", 0,
"rule", create_map("name", "Windows Findstr GPP Discovery", "uid", "73ed0f19-080e-4917-b7c6-56e1760a50d4", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="findstr.exe"
AND process_cmd_line LIKE "%cpassword%"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Findstr GPP Discovery has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Active Directory Privilege Escalation"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 56,
severity_id = 0,
rule = {"name": "Windows Findstr GPP Discovery", "uid": "73ed0f19-080e-4917-b7c6-56e1760a50d4", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -123,4 +115,5 @@ test:
- file_name: windows-4688.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-4688.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml
Vendored
+40 -47
View File
@@ -10,52 +10,44 @@ description: The following analytic identifies the Windows Explorer process with
anomaly detection might be a good pivot to check which user and how this process
was executed, what is the parent process and what is the URL link. This technique
is not commonly used to open an URL.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%"))
AND process_file_name="explorer.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Ingress Tool Transfer Using Explorer has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 1,
"risk_score", 25,
"severity_id", 0,
"rule", create_map("name", "Windows Ingress Tool Transfer Using Explorer", "uid", "695bfad6-9662-4f9e-a576-bf02a951aa60", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%"
OR process_cmd_line LIKE "%http://%") AND process_file_name="explorer.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Ingress Tool Transfer Using Explorer has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["DarkCrystal RAT"],
class_name = "Detection Report",
confidence = 50,
confidence_id = 2,
duration = 0,
impact = 50,
impact_id = 3,
kill_chain = [{"phase": "Command And Control", "phase_id": 6}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 25,
severity_id = 0,
rule = {"name": "Windows Ingress Tool Transfer Using Explorer", "uid": "695bfad6-9662-4f9e-a576-bf02a951aa60", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints.
@@ -117,4 +109,5 @@ test:
- file_name: T1105_explorer-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
Vendored
+57 -63
View File
@@ -7,36 +7,27 @@ description: The following analytic identifies native living off the land binari
it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io
site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe,
regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe"
OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe"
OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe"
OR process_file_name="control.exe" OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe"
OR process_file_name="desktopimgdownldr.exe" OR process_file_name="dfsvc.exe" OR
process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" OR process_file_name="dllhost.exe"
OR process_file_name="dnscmd.exe" OR process_file_name="esentutl.exe" OR process_file_name="eventvwr.exe"
OR process_file_name="expand.exe" OR process_file_name="extexport.exe" OR process_file_name="extrac32.exe"
OR process_file_name="findstr.exe" OR process_file_name="finger.exe" OR process_file_name="fltmc.exe"
OR process_file_name="forfiles.exe" OR process_file_name="ftp.exe" OR process_file_name="gfxdownloadwrapper.exe"
OR process_file_name="gpscript.exe" OR process_file_name="imewdbld.exe" OR process_file_name="ie4uinit.exe"
OR process_file_name="ieexec.exe" OR process_file_name="ilasm.exe" OR process_file_name="infdefaultinstall.exe"
OR process_file_name="makecab.exe" OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe"
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="bitsadmin.exe"
OR process_file_name="certoc.exe" OR process_file_name="certreq.exe" OR process_file_name="certutil.exe"
OR process_file_name="cmdkey.exe" OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe"
OR process_file_name="configsecuritypolicy.exe" OR process_file_name="control.exe"
OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe" OR process_file_name="desktopimgdownldr.exe"
OR process_file_name="dfsvc.exe" OR process_file_name="diantz.exe" OR process_file_name="diskshadow.exe"
OR process_file_name="dllhost.exe" OR process_file_name="dnscmd.exe" OR process_file_name="esentutl.exe"
OR process_file_name="eventvwr.exe" OR process_file_name="expand.exe" OR process_file_name="extexport.exe"
OR process_file_name="extrac32.exe" OR process_file_name="findstr.exe" OR process_file_name="finger.exe"
OR process_file_name="fltmc.exe" OR process_file_name="forfiles.exe" OR process_file_name="ftp.exe"
OR process_file_name="gfxdownloadwrapper.exe" OR process_file_name="gpscript.exe"
OR process_file_name="imewdbld.exe" OR process_file_name="ie4uinit.exe" OR process_file_name="ieexec.exe"
OR process_file_name="ilasm.exe" OR process_file_name="infdefaultinstall.exe" OR
process_file_name="makecab.exe" OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe"
OR process_file_name="mmc.exe" OR process_file_name="msconfig.exe" OR process_file_name="msdt.exe"
OR process_file_name="mshta.exe" OR process_file_name="msiexec.exe" OR process_file_name="netsh.exe"
OR process_file_name="odbcconf.exe" OR process_file_name="offlinescannershell.exe"
@@ -53,38 +44,40 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
OR process_file_name="verclsid.exe" OR process_file_name="wab.exe" OR process_file_name="wlrmdr.exe"
OR process_file_name="wmic.exe" OR process_file_name="workfolders.exe" OR process_file_name="wscript.exe"
OR process_file_name="wsreset.exe" OR process_file_name="wuauclt.exe" OR process_file_name="xwizard.exe")
AND (NOT (match_regex(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR
match_regex(process_file_path, /(?i)(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path,
/(?i)(?i)\\windows\\networkcontrolle/)=true OR match_regex(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true
OR match_regex(process_file_path, /(?i)(?i)\\winsxs/)=true OR match_regex(process_file_path,
/(?i)(?i)\\microsoft.net/)=true))
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows LOLBin Binary in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 49,
"severity_id", 0,
"rule", create_map("name", "Windows LOLBin Binary in Non Standard Path", "uid", "25689101-012a-324a-94d3-08301e6c065a", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
AND (NOT (match(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR match(process_file_path,
/(?i)(?i)\\windows\\syswow64/)=true OR match(process_file_path, /(?i)(?i)\\windows\\networkcontrolle/)=true
OR match(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true OR match(process_file_path,
/(?i)(?i)\\winsxs/)=true OR match(process_file_path, /(?i)(?i)\\microsoft.net/)=true))
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows LOLBin Binary in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Unusual Processes", "Ransomware", "WhisperGate"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 49,
severity_id = 0,
rule = {"name": "Windows LOLBin Binary in Non Standard Path", "uid": "25689101-012a-324a-94d3-08301e6c065a", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
@@ -153,4 +146,5 @@ test:
- file_name: dotnet_lolbin-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_mshta_child_process.yml
Vendored
+44 -50
View File
@@ -6,55 +6,48 @@ description: The following analytic identifies child processes spawning from "m
The search will return the first time and last time these command-line arguments
were used for these executions, as well as the target system, the user, parent process
"mshta.exe" and its child process.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="wscript.exe" OR process_file_name="cscript.exe"
OR process_file_name="searchprotocolhost.exe" OR process_file_name="microsoft.workflow.compiler.exe"
OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe"
OR process_file_name="cmd.exe" OR process_file_name="powershell.exe") AND like(actor_process_file_name,
"%mshta.exe")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows MSHTA Child Process has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 4,
"risk_score", 80,
"severity_id", 0,
"rule", create_map("name", "Windows MSHTA Child Process", "uid", "f63f7e9c-9526-11ec-9fc7-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="wscript.exe"
OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe"
OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe"
OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe"
OR process_file_name="powershell.exe") AND actor_process_file_name LIKE "%mshta.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows MSHTA Child Process has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Suspicious MSHTA Activity", "Living Off The Land"],
class_name = "Detection Report",
confidence = 100,
confidence_id = 3,
duration = 0,
impact = 80,
impact_id = 5,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Critical",
category_uid = 2,
class_uid = 102001,
risk_level_id = 4,
risk_score = 80,
severity_id = 0,
rule = {"name": "Windows MSHTA Child Process", "uid": "f63f7e9c-9526-11ec-9fc7-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -120,4 +113,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_mshta_command_line_url.yml
Vendored
+40 -47
View File
@@ -9,52 +9,44 @@ description: This analytic identifies when Microsoft HTML Application Host (msht
malicious software to bypass preventative controls. The search will return the first
time and last time these command-line arguments were used for these executions,
as well as the target system, the user, process "rundll32.exe" and its parent process.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%"))
AND process_file_name="mshta.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows MSHTA Command-Line URL has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 4,
"risk_score", 80,
"severity_id", 0,
"rule", create_map("name", "Windows MSHTA Command-Line URL", "uid", "9b35c538-94ef-11ec-9439-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%"
OR process_cmd_line LIKE "%http://%") AND process_file_name="mshta.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows MSHTA Command-Line URL has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Suspicious MSHTA Activity", "Living Off The Land"],
class_name = "Detection Report",
confidence = 100,
confidence_id = 3,
duration = 0,
impact = 80,
impact_id = 5,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Critical",
category_uid = 2,
class_uid = 102001,
risk_level_id = 4,
risk_score = 80,
severity_id = 0,
rule = {"name": "Windows MSHTA Command-Line URL", "uid": "9b35c538-94ef-11ec-9439-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -122,4 +114,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml
Vendored
+41 -47
View File
@@ -7,52 +7,45 @@ description: The following analytic identifies "mshta.exe" execution with inline
invoking HTA content directly on the command-line. The search will return the first
time and last time these command-line arguments were used for these executions,
as well as the target system, the user, process "mshta.exe" and its parent process.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%")
OR like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows MSHTA Inline HTA Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 4,
"risk_score", 80,
"severity_id", 0,
"rule", create_map("name", "Windows MSHTA Inline HTA Execution", "uid", "24962154-9524-11ec-9333-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_cmd_line LIKE "%about%"
OR process_cmd_line LIKE "%javascript%" OR process_cmd_line LIKE "%vbscript%") AND
process_file_name="mshta.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows MSHTA Inline HTA Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Suspicious MSHTA Activity", "Living Off The Land"],
class_name = "Detection Report",
confidence = 100,
confidence_id = 3,
duration = 0,
impact = 80,
impact_id = 5,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Critical",
category_uid = 2,
class_uid = 102001,
risk_level_id = 4,
risk_score = 80,
severity_id = 0,
rule = {"name": "Windows MSHTA Inline HTA Execution", "uid": "24962154-9524-11ec-9333-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -120,4 +113,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml
Vendored
+41 -47
View File
@@ -7,52 +7,45 @@ description: The following analytic identifies the odbcconf.exe, Windows Open Da
and may be named anything. The resource file itself may have different commands
supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands.
During triage, review file modifications and parallel processes.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %"))
AND process_file_name="odbcconf.exe") AND like(process_cmd_line, "%.rsp%")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Odbcconf Load Response File has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 42,
"severity_id", 0,
"rule", create_map("name", "Windows Odbcconf Load Response File", "uid", "7b6c3fac-0c37-4efc-a85e-de88f42b6763", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%/f %"
OR process_cmd_line LIKE "%-f %") AND process_file_name="odbcconf.exe") AND process_cmd_line
LIKE "%.rsp%"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Odbcconf Load Response File has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 60,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 42,
severity_id = 0,
rule = {"name": "Windows Odbcconf Load Response File", "uid": "7b6c3fac-0c37-4efc-a85e-de88f42b6763", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -117,4 +110,5 @@ test:
- file_name: odbcconf-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
Vendored
+40 -47
View File
@@ -13,52 +13,44 @@ description: 'Monitor for signs that Ntdsutil is being used to Extract Active Di
This technique uses "Install from Media" (IFM), which will extract a copy of the
Active Directory database. A successful export of the Active Directory database
will yield a file modification named ntds.dit to the destination.'
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%")
AND like(process_cmd_line, "%ntds%"))
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows OS Credential Dumping with Ntdsutil Export NTDS has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 50,
"severity_id", 0,
"rule", create_map("name", "Windows OS Credential Dumping with Ntdsutil Export NTDS", "uid", "dad9ddec-a72a-47be-87b6-a0f7ba98ed6e", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="ntdsutil.exe"
AND (process_cmd_line LIKE "%create%" AND process_cmd_line LIKE "%ntds%")
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows OS Credential Dumping with Ntdsutil Export NTDS has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Credential Dumping", "HAFNIUM Group", "Living Off The Land", "Volt Typhoon"],
class_name = "Detection Report",
confidence = 50,
confidence_id = 2,
duration = 0,
impact = 100,
impact_id = 5,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 50,
severity_id = 0,
rule = {"name": "Windows OS Credential Dumping with Ntdsutil Export NTDS", "uid": "dad9ddec-a72a-47be-87b6-a0f7ba98ed6e", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -129,4 +121,5 @@ test:
- file_name: 4688_windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml
Vendored
+41 -48
View File
@@ -12,53 +12,45 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo
Sysinternals utility has been ran, it is possible there will be a -accepteula on
the command line. Review other endpoint data sources for cross process (injection)
into lsass.exe.'
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm
%")) AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe"))
AND like(process_cmd_line, "%lsass%")
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows OS Credential Dumping with Procdump has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 4,
"risk_score", 80,
"severity_id", 0,
"rule", create_map("name", "Windows OS Credential Dumping with Procdump", "uid", "e102e297-dbe6-4a19-b319-5c08f4c19a06", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%-ma %"
OR process_cmd_line LIKE "%-mm %") AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe"))
AND process_cmd_line LIKE "%lsass%"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows OS Credential Dumping with Procdump has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Credential Dumping", "HAFNIUM Group"],
class_name = "Detection Report",
confidence = 100,
confidence_id = 3,
duration = 0,
impact = 80,
impact_id = 5,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Critical",
category_uid = 2,
class_uid = 102001,
risk_level_id = 4,
risk_score = 80,
severity_id = 0,
rule = {"name": "Windows OS Credential Dumping with Procdump", "uid": "e102e297-dbe6-4a19-b319-5c08f4c19a06", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -125,4 +117,5 @@ test:
- file_name: procdump_windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
Vendored
+42 -49
View File
@@ -11,54 +11,46 @@ description: The following hunting analytic identifies PowerShell commands utili
For example w, win, windowsty and so forth. In addition, through our research it
was identified that PowerShell will interpret different command switch types beyond
the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe"
OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe")
AND match_regex(process_cmd_line, /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Powershell Connect to Internet With Hidden Window has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 1,
"risk_score", 35,
"severity_id", 0,
"rule", create_map("name", "Windows Powershell Connect to Internet With Hidden Window", "uid", "477e068e-8b6d-11ec-b6c1-81af21670352", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe"
OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe"
OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line,
/(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Powershell Connect to Internet With Hidden Window has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group", "Log4Shell CVE-2021-44228"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 50,
impact_id = 3,
kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 35,
severity_id = 0,
rule = {"name": "Windows Powershell Connect to Internet With Hidden Window", "uid": "477e068e-8b6d-11ec-b6c1-81af21670352", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
@@ -129,4 +121,5 @@ test:
- file_name: hidden_windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml
Vendored
+37 -40
View File
@@ -10,45 +10,41 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries
alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack
their passwords offline.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
device=ucast(map_get(input_event,"device"), "map<string, any>", null) | eval device_hostname=ucast(map_get(device,"hostname"),
"string", null) | eval process=ucast(map_get(input_event,"process"), "map<string,
any>", null) | eval process_file=ucast(map_get(process,"file"), "map<string, any>",
null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null)
| eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_user=ucast(map_get(actor,"user"), "map<string, any>", null) |
eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where like(process_cmd_line,
"%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid),
"message", concat("Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on ", device_hostname, " by ", "Unknown", "."),
"users", [
create_map(
"name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 54,
"severity_id", 0,
"rule", create_map("name", "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser", "uid", "d57b4d91-fc91-4482-a325-47693cced1eb", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval device_hostname = device.hostname | eval process_file = process.file | eval
process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid
| where process_cmd_line LIKE "%4194304%" AND match(process_cmd_line, /(?i)get-aduser/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid},
message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on " + device_hostname + " by " + "Unknown" + ".",
users = [{"name": "Unknown", "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Active Directory Kerberos Attacks"],
class_name = "Detection Report",
confidence = 90,
confidence_id = 3,
duration = 0,
impact = 60,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 54,
severity_id = 0,
rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser", "uid": "d57b4d91-fc91-4482-a325-47693cced1eb", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -102,4 +98,5 @@ test:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
source: WinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml
Vendored
+37 -41
View File
@@ -10,46 +10,41 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts
and attempt to crack their passwords offline.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
device=ucast(map_get(input_event,"device"), "map<string, any>", null) | eval device_hostname=ucast(map_get(device,"hostname"),
"string", null) | eval process=ucast(map_get(input_event,"process"), "map<string,
any>", null) | eval process_file=ucast(map_get(process,"file"), "map<string, any>",
null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null)
| eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_user=ucast(map_get(actor,"user"), "map<string, any>", null) |
eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line,
/(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, /(?i)get-domainuser/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid),
"message", concat("Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on ", device_hostname, " by ", "Unknown", "."),
"users", [
create_map(
"name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 54,
"severity_id", 0,
"rule", create_map("name", "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView", "uid", "dc3f2af7-ca69-47ce-a122-9f9787e19417", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval device_hostname = device.hostname | eval process_file = process.file | eval
process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid
| where match(process_cmd_line, /(?i)preauthnotrequired/)=true AND match(process_cmd_line,
/(?i)get-domainuser/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid},
message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on " + device_hostname + " by " + "Unknown" + ".",
users = [{"name": "Unknown", "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Active Directory Kerberos Attacks"],
class_name = "Detection Report",
confidence = 90,
confidence_id = 3,
duration = 0,
impact = 60,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 54,
severity_id = 0,
rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView", "uid": "dc3f2af7-ca69-47ce-a122-9f9787e19417", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -102,4 +97,5 @@ test:
- file_name: getdomainuser.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
Vendored
+42 -49
View File
@@ -7,54 +7,46 @@ description: The following analytic identifies the use of PowerShell downloading
PowerShell frameworks to download files and output to disk. Identify the source
(IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
transaction logs are available, review for further details of the implant.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe"
OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)downloadfile/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Powershell DownloadFile has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 1,
"risk_score", 35,
"severity_id", 0,
"rule", create_map("name", "Windows Powershell DownloadFile", "uid", "46440222-81d5-44b1-a376-19dcd70d1b08", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe"
OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe"
OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line,
/(?i)downloadfile/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Powershell DownloadFile has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Malicious PowerShell", "Ingress Tool Transfer", "Log4Shell CVE-2021-44228"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 50,
impact_id = 3,
kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 35,
severity_id = 0,
rule = {"name": "Windows Powershell DownloadFile", "uid": "46440222-81d5-44b1-a376-19dcd70d1b08", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -123,4 +115,5 @@ test:
- file_name: downloadfile_windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml
Vendored
+42 -49
View File
@@ -9,54 +9,46 @@ description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Si
is used, it is highly possible files will be archived. During triage, review parallel
processes and process lineage. Capture any files on disk and review. For the remote
domain or IP, what is the reputation?
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe"
OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)start-bitstransfer/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows PowerShell Start-BitsTransfer has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 49,
"severity_id", 0,
"rule", create_map("name", "Windows PowerShell Start-BitsTransfer", "uid", "0bafd086-8f61-11ec-996e-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe"
OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe"
OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line,
/(?i)start-bitstransfer/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows PowerShell Start-BitsTransfer has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["BITS Jobs", "Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 49,
severity_id = 0,
rule = {"name": "Windows PowerShell Start-BitsTransfer", "uid": "0bafd086-8f61-11ec-996e-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
@@ -124,4 +116,5 @@ test:
- file_name: T1197_windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml
Vendored
+36 -40
View File
@@ -11,45 +11,40 @@ description: The following analytic identifies the use of the Get-GPPPassword Po
has been made public). While Microsoft released a patch that impedes Administrators
to create unsecure credentials, existing Group Policy Preferences files with passwords
are not removed from SYSVOL.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
device=ucast(map_get(input_event,"device"), "map<string, any>", null) | eval device_hostname=ucast(map_get(device,"hostname"),
"string", null) | eval process=ucast(map_get(input_event,"process"), "map<string,
any>", null) | eval process_file=ucast(map_get(process,"file"), "map<string, any>",
null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null)
| eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_user=ucast(map_get(actor,"user"), "map<string, any>", null) |
eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line,
/(?i)get-gpppassword/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid),
"message", concat("Windows PowerSploit GPP Discovery has been triggered on ", device_hostname, " by ", "Unknown", "."),
"users", [
create_map(
"name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 56,
"severity_id", 0,
"rule", create_map("name", "Windows PowerSploit GPP Discovery", "uid", "fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval device_hostname = device.hostname | eval process_file = process.file | eval
process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid
| where match(process_cmd_line, /(?i)get-gpppassword/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid},
message = "Windows PowerSploit GPP Discovery has been triggered on " + device_hostname + " by " + "Unknown" + ".",
users = [{"name": "Unknown", "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Active Directory Privilege Escalation"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 56,
severity_id = 0,
rule = {"name": "Windows PowerSploit GPP Discovery", "uid": "fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -104,4 +99,5 @@ test:
- file_name: win-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log
source: XmlWinEventLog
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml
Vendored
+41 -47
View File
@@ -6,52 +6,45 @@ description: The following analytic identifies the Windows Windows Remote Auto D
rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary
shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review
parent and child process behavior including file and image loads.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="rasautou.exe" AND match_regex(process_cmd_line,
/(?i)-p /)=true AND match_regex(process_cmd_line, /(?i)-d /)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Rasautou DLL Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 4,
"risk_score", 80,
"severity_id", 0,
"rule", create_map("name", "Windows Rasautou DLL Execution", "uid", "6f42b8ce-1e15-11ec-ad5a-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="rasautou.exe"
AND match(process_cmd_line, /(?i)-p /)=true AND match(process_cmd_line, /(?i)-d
/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Rasautou DLL Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Windows Defense Evasion Tactics", "Living Off The Land"],
class_name = "Detection Report",
confidence = 100,
confidence_id = 3,
duration = 0,
impact = 80,
impact_id = 5,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Critical",
category_uid = 2,
class_uid = 102001,
risk_level_id = 4,
risk_score = 80,
severity_id = 0,
rule = {"name": "Windows Rasautou DLL Execution", "uid": "6f42b8ce-1e15-11ec-ad5a-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -121,4 +114,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml
Vendored
+40 -47
View File
@@ -6,53 +6,45 @@ description: The following analytic identifies AccCheckConsole.exe which is a na
living off the land binary or script (LOLBAS) within the Windows operating system
that may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path,
/(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true)
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="acccheckconsole.exe"
AND (NOT match(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 0,
"risk_score", 14,
"severity_id", 0,
"rule", create_map("name", "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path", "uid", "c842931e-661f-42bc-a4df-0460d93cfb69", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Unusual Processes", "Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 20,
impact_id = 2,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Info",
category_uid = 2,
class_uid = 102001,
risk_level_id = 0,
risk_score = 14,
severity_id = 0,
rule = {"name": "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path", "uid": "c842931e-661f-42bc-a4df-0460d93cfb69", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -121,4 +113,5 @@ test:
- file_name: lolbas_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml
Vendored
+41 -47
View File
@@ -6,52 +6,45 @@ description: The following analytic identifies adplus.exe which is a native livi
off the land binary or script (LOLBAS) within the Windows operating system that
may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="adplus.exe" AND (NOT match_regex(process_file_path,
/(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 0,
"risk_score", 14,
"severity_id", 0,
"rule", create_map("name", "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path", "uid", "ecaaf956-c516-4980-b08e-8c01c19614ca", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="adplus.exe"
AND (NOT match(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true)
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Unusual Processes", "Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 20,
impact_id = 2,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Info",
category_uid = 2,
class_uid = 102001,
risk_level_id = 0,
risk_score = 14,
severity_id = 0,
rule = {"name": "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path", "uid": "ecaaf956-c516-4980-b08e-8c01c19614ca", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -119,4 +112,5 @@ test:
- file_name: lolbas_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml
Vendored
+40 -47
View File
@@ -6,52 +6,44 @@ description: The following analytic identifies Advpack.dll which is a native liv
off the land binary or script (LOLBAS) within the Windows operating system that
may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="advpack.dll" AND (NOT match_regex(process_file_path,
/(?i)\\windows\\syswow64/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 0,
"risk_score", 14,
"severity_id", 0,
"rule", create_map("name", "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path", "uid", "3284e4f4-67f7-49b6-ad5e-a8fcead2eef8", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="advpack.dll"
AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true)
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Unusual Processes", "Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 20,
impact_id = 2,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Info",
category_uid = 2,
class_uid = 102001,
risk_level_id = 0,
risk_score = 14,
severity_id = 0,
rule = {"name": "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path", "uid": "3284e4f4-67f7-49b6-ad5e-a8fcead2eef8", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -119,4 +111,5 @@ test:
- file_name: lolbas_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml
Vendored
+40 -47
View File
@@ -6,52 +6,44 @@ description: The following analytic identifies AgentExecutor.exe which is a nati
living off the land binary or script (LOLBAS) within the Windows operating system
that may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path,
/(?i)\\program files (x86)/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 0,
"risk_score", 14,
"severity_id", 0,
"rule", create_map("name", "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path", "uid", "e124f71f-11bc-47e4-9931-6046d256005d", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="agentexecutor.exe"
AND (NOT match(process_file_path, /(?i)\\program files (x86)/)=true)
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Unusual Processes", "Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 20,
impact_id = 2,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Info",
category_uid = 2,
class_uid = 102001,
risk_level_id = 0,
risk_score = 14,
severity_id = 0,
rule = {"name": "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path", "uid": "e124f71f-11bc-47e4-9931-6046d256005d", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -120,4 +112,5 @@ test:
- file_name: lolbas_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml
Vendored
+40 -47
View File
@@ -6,53 +6,45 @@ description: The following analytic identifies AppInstaller.exe which is a nativ
living off the land binary or script (LOLBAS) within the Windows operating system
that may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path,
/(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true)
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="appinstaller.exe"
AND (NOT match(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 0,
"risk_score", 14,
"severity_id", 0,
"rule", create_map("name", "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path", "uid", "057c06c7-ef31-4749-b5c9-199152e53a06", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Unusual Processes", "Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 20,
impact_id = 2,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Info",
category_uid = 2,
class_uid = 102001,
risk_level_id = 0,
risk_score = 14,
severity_id = 0,
rule = {"name": "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path", "uid": "057c06c7-ef31-4749-b5c9-199152e53a06", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -121,4 +113,5 @@ test:
- file_name: lolbas_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml
Vendored
+41 -47
View File
@@ -6,52 +6,45 @@ description: The following analytic identifies Appvlp.exe which is a native livi
off the land binary or script (LOLBAS) within the Windows operating system that
may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path,
/(?i)\\program files (x86)\\microsoft office\\root\\client/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 0,
"risk_score", 14,
"severity_id", 0,
"rule", create_map("name", "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path", "uid", "93862a89-abe0-4094-909a-08ec390aa5e3", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="appvlp.exe"
AND (NOT match(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true)
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Unusual Processes", "Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 20,
impact_id = 2,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Info",
category_uid = 2,
class_uid = 102001,
risk_level_id = 0,
risk_score = 14,
severity_id = 0,
rule = {"name": "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path", "uid": "93862a89-abe0-4094-909a-08ec390aa5e3", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -119,4 +112,5 @@ test:
- file_name: lolbas_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml
Vendored
+41 -47
View File
@@ -6,52 +6,45 @@ description: The following analytic identifies Aspnet_Compiler.exe which is a na
living off the land binary or script (LOLBAS) within the Windows operating system
that may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path,
/(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 0,
"risk_score", 14,
"severity_id", 0,
"rule", create_map("name", "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path", "uid", "d75cc561-3828-4d0a-92c4-0eb93bfe0929", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="aspnet_compiler.exe"
AND (NOT match(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true)
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Unusual Processes", "Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 20,
impact_id = 2,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Info",
category_uid = 2,
class_uid = 102001,
risk_level_id = 0,
risk_score = 14,
severity_id = 0,
rule = {"name": "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path", "uid": "d75cc561-3828-4d0a-92c4-0eb93bfe0929", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -120,4 +113,5 @@ test:
- file_name: lolbas_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml
Vendored
+40 -47
View File
@@ -6,52 +6,44 @@ description: The following analytic identifies At.exe which is a native living o
the land binary or script (LOLBAS) within the Windows operating system that may
be abused by adversaries by moving it to a new directory. The list of binaries was
derived from the https://lolbas-project.github.io site.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="at.exe" AND (NOT match_regex(process_file_path,
/(?i)\\windows\\syswow64/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Rename System Utilities At exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 0,
"risk_score", 14,
"severity_id", 0,
"rule", create_map("name", "Windows Rename System Utilities At exe LOLBAS in Non Standard Path", "uid", "6401d583-0052-4dc5-a713-68b510826d2b", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="at.exe" AND
(NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true)
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Rename System Utilities At exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Unusual Processes", "Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 20,
impact_id = 2,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Info",
category_uid = 2,
class_uid = 102001,
risk_level_id = 0,
risk_score = 14,
severity_id = 0,
rule = {"name": "Windows Rename System Utilities At exe LOLBAS in Non Standard Path", "uid": "6401d583-0052-4dc5-a713-68b510826d2b", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -118,4 +110,5 @@ test:
- file_name: lolbas_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml
Vendored
+40 -47
View File
@@ -6,52 +6,44 @@ description: The following analytic identifies Atbroker.exe which is a native li
off the land binary or script (LOLBAS) within the Windows operating system that
may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path,
/(?i)\\windows\\syswow64/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 0,
"risk_score", 14,
"severity_id", 0,
"rule", create_map("name", "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path", "uid", "b8da7ea5-8c16-4eff-9787-54ec271159e0", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="atbroker.exe"
AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true)
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Unusual Processes", "Living Off The Land"],
class_name = "Detection Report",
confidence = 70,
confidence_id = 3,
duration = 0,
impact = 20,
impact_id = 2,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Info",
category_uid = 2,
class_uid = 102001,
risk_level_id = 0,
risk_score = 14,
severity_id = 0,
rule = {"name": "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path", "uid": "b8da7ea5-8c16-4eff-9787-54ec271159e0", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -119,4 +111,5 @@ test:
- file_name: lolbas_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml
Vendored
+41 -47
View File
@@ -5,52 +5,45 @@ status: production
description: The following analytic identifies memory dumping using comsvcs.dll with
the minidump function with `rundll32.exe`. This technique is common with adversaries
who would like to dump the memory of lsass.exe.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe")
AND match_regex(process_cmd_line, /(?i)comsvcs.dll/)=true
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Rundll32 Comsvcs Memory Dump has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 40,
"severity_id", 0,
"rule", create_map("name", "Windows Rundll32 Comsvcs Memory Dump", "uid", "76bb9e35-f314-4c3d-a385-83c72a13ce4e", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)minidump/)=true
AND process_file_name="rundll32.exe") AND match(process_cmd_line, /(?i)comsvcs.dll/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Rundll32 Comsvcs Memory Dump has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Credential Dumping", "Suspicious Rundll32 Activity"],
class_name = "Detection Report",
confidence = 100,
confidence_id = 3,
duration = 0,
impact = 40,
impact_id = 3,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 40,
severity_id = 0,
rule = {"name": "Windows Rundll32 Comsvcs Memory Dump", "uid": "76bb9e35-f314-4c3d-a385-83c72a13ce4e", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including Windows command line logging. You can see how we test this with [Event
Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
@@ -115,4 +108,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml
Vendored
+41 -47
View File
@@ -9,52 +9,45 @@ description: The following analytic identifies "rundll32.exe" execution with inl
The search will return the first time and last time these command-line arguments
were used for these executions, as well as the target system, the user, process
"rundll32.exe" and its parent process.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%")
OR like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe"
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Rundll32 Inline HTA Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 2,
"risk_score", 56,
"severity_id", 0,
"rule", create_map("name", "Windows Rundll32 Inline HTA Execution", "uid", "0caa1dd6-94f5-11ec-9786-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_cmd_line LIKE "%about%"
OR process_cmd_line LIKE "%javascript%" OR process_cmd_line LIKE "%vbscript%") AND
process_file_name="rundll32.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Rundll32 Inline HTA Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Suspicious MSHTA Activity", "NOBELIUM Group", "Living Off The Land"],
class_name = "Detection Report",
confidence = 80,
confidence_id = 3,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Medium",
category_uid = 2,
class_uid = 102001,
risk_level_id = 2,
risk_score = 56,
severity_id = 0,
rule = {"name": "Windows Rundll32 Inline HTA Execution", "uid": "0caa1dd6-94f5-11ec-9786-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -123,4 +116,5 @@ test:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml
Vendored
+41 -48
View File
@@ -8,53 +8,45 @@ description: This analytic is to detect a suspicious child process of MSBuild sp
malicious script in the compromised host. During triage, review parallel processes
and identify any file modifications. MSBuild may load a script from the same path
without having command-line arguments.
search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
"map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
"string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
"string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name,
/(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true)
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
"message", concat("Windows Script Host Spawn MSBuild has been triggered on ", device_hostname, " by ", actor_user_name, "."),
"users", [
create_map(
"name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", 4,
"risk_score", 80,
"severity_id", 0,
"rule", create_map("name", "Windows Script Host Spawn MSBuild", "uid", "92886f1c-9b11-11ec-848a-acde48001122", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();'
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_file_name="MSBuild.exe"
AND (match(actor_process_file_name, /(?i)cscript.exe/)=true OR match(actor_process_file_name,
/(?i)wscript.exe/)=true)
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Windows Script Host Spawn MSBuild has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Trusted Developer Utilities Proxy Execution MSBuild", "Living Off The Land"],
class_name = "Detection Report",
confidence = 100,
confidence_id = 3,
duration = 0,
impact = 80,
impact_id = 5,
kill_chain = [{"phase": "Exploitation", "phase_id": 4}],
nist = ["DE.AE"],
risk_level = "Critical",
category_uid = 2,
class_uid = 102001,
risk_level_id = 4,
risk_score = 80,
severity_id = 0,
rule = {"name": "Windows Script Host Spawn MSBuild", "uid": "92886f1c-9b11-11ec-848a-acde48001122", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -121,4 +113,5 @@ test:
- file_name: msbuild-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log
source: WinEventLog:Security
runtime: SPL-DSP
runtime: SPL2
internalVersion: 2

Some files were not shown because too many files have changed in this diff Show More