From 1b26692ee2a2d9691e196166fc66926119929ccb Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 8 Aug 2023 14:54:08 +0200 Subject: [PATCH 01/14] converted detections to SPL2 --- .../domain/entities/detection.py | 1 + .../domain/entities/detection_tags.py | 2 + .../adapter/finding_report_writer.py | 46 ++++++++- .../adapter/obj_to_yml_adapter.py | 4 +- .../adapter/templates/finding_report.j2 | 50 +++++----- .../builder/backend_splunk_ba.py | 21 ++-- ...ssa___anomalous_usage_of_archive_tools.yml | 83 +++++++--------- .../srs/ssa___attempt_to_delete_services.yml | 53 +++++----- .../srs/ssa___attempt_to_disable_services.yml | 53 +++++----- ...dential_dump_from_registry_via_reg_exe.yml | 53 +++++----- ..._bcdedit_failure_recovery_modification.yml | 53 +++++----- ...ar_unallocated_sector_using_cipher_app.yml | 53 +++++----- dist/ssa/srs/ssa___delete_a_net_user.yml | 53 +++++----- ...___deny_permission_using_cacls_utility.yml | 53 +++++----- ...ohibited_applications_spawning_cmd_exe.yml | 53 +++++----- ...ssa___detect_rclone_command_line_usage.yml | 53 +++++----- .../srs/ssa___disable_net_user_account.yml | 53 +++++----- ...___dns_exfiltration_using_nslookup_app.yml | 53 +++++----- dist/ssa/srs/ssa___fsutil_zeroing_file.yml | 53 +++++----- ...__grant_permission_using_cacls_utility.yml | 53 +++++----- ..._files_and_directories_with_attrib_exe.yml | 53 +++++----- ...fy_acls_permission_of_files_or_folders.yml | 53 +++++----- ...e_product_spawning_windows_script_host.yml | 53 +++++----- .../srs/ssa___resize_shadowstorage_volume.yml | 53 +++++----- .../ssa___sdelete_application_execution.yml | 53 +++++----- ...ocess_running_from_unexpected_location.yml | 53 +++++----- .../ssa___wbadmin_delete_system_backups.yml | 53 +++++----- .../ssa___wevtutil_usage_to_clear_logs.yml | 53 +++++----- .../ssa___wevtutil_usage_to_disable_logs.yml | 53 +++++----- .../ssa___windows_bits_job_persistence.yml | 53 +++++----- .../ssa___windows_bitsadmin_download_file.yml | 53 +++++----- .../ssa___windows_certutil_decode_file.yml | 53 +++++----- ...a___windows_certutil_urlcache_download.yml | 53 +++++----- ...___windows_certutil_verifyctl_download.yml | 53 +++++----- ..._hijacking_inprocserver32_modification.yml | 53 +++++----- ...dows_curl_upload_to_remote_destination.yml | 53 +++++----- ...group_policy_object_modified_with_gpme.yml | 53 +++++----- ...ws_defender_tools_in_non_standard_path.yml | 53 +++++----- ...a___windows_diskshadow_proxy_execution.yml | 53 +++++----- ...ows_dotnet_binary_in_non_standard_path.yml | 53 +++++----- ...ndows_exchange_powershell_module_usage.yml | 53 +++++----- ...s_execute_arbitrary_commands_with_msdt.yml | 53 +++++----- ...ws_file_share_discovery_with_powerview.yml | 53 +++++----- .../ssa___windows_findstr_gpp_discovery.yml | 53 +++++----- ...s_ingress_tool_transfer_using_explorer.yml | 53 +++++----- ...ows_lolbin_binary_in_non_standard_path.yml | 53 +++++----- .../srs/ssa___windows_mshta_child_process.yml | 53 +++++----- .../ssa___windows_mshta_command_line_url.yml | 53 +++++----- ...a___windows_mshta_inline_hta_execution.yml | 53 +++++----- ...___windows_odbcconf_load_response_file.yml | 53 +++++----- ...tial_dumping_with_ntdsutil_export_ntds.yml | 53 +++++----- ...ws_os_credential_dumping_with_procdump.yml | 53 +++++----- ...connect_to_internet_with_hidden_window.yml | 53 +++++----- ...re_authentication_discovery_get_aduser.yml | 53 +++++----- ...uthentication_discovery_with_powerview.yml | 53 +++++----- .../ssa___windows_powershell_downloadfile.yml | 53 +++++----- ..._windows_powershell_start_bitstransfer.yml | 53 +++++----- ...sa___windows_powersploit_gpp_discovery.yml | 53 +++++----- .../ssa___windows_rasautou_dll_execution.yml | 53 +++++----- ...onsole_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...adplus_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...dvpack_dll_lolbas_in_non_standard_path.yml | 53 +++++----- ...ecutor_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...taller_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...appvlp_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...mpiler_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...ies_at_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...broker_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...__windows_rundll32_comsvcs_memory_dump.yml | 53 +++++----- ..._windows_rundll32_inline_hta_execution.yml | 53 +++++----- ...sa___windows_script_host_spawn_msbuild.yml | 53 +++++----- ...execution_compiled_html_file_decompile.yml | 53 +++++----- ...compiled_html_file_url_in_command_line.yml | 53 +++++----- ...l_file_using_infotech_storage_handlers.yml | 53 +++++----- ...xy_execution_msiexec_dllregisterserver.yml | 53 +++++----- ...roxy_execution_msiexec_remote_download.yml | 53 +++++----- ...proxy_execution_msiexec_unregister_dll.yml | 53 +++++----- .../ssa___windows_wmiprvse_spawn_msbuild.yml | 53 +++++----- ...ssa___anomalous_usage_of_archive_tools.yml | 30 ++---- ...ssa___anomalous_usage_of_archive_tools.yml | 99 +++++++++++++++++++ 80 files changed, 2218 insertions(+), 1881 deletions(-) create mode 100644 tmp/ssa___anomalous_usage_of_archive_tools.yml diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index 57d1c1a02a..23a3dcdf15 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -75,6 +75,7 @@ class Detection(BaseModel, SecurityContentObject): nes_fields: str = None providing_technologies: list = None runtime: str = None + internalVersion: str = None # @validator('name')v # def name_max_length(cls, v, values): diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py index 16490246e8..400db14246 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py @@ -40,7 +40,9 @@ class DetectionTags(BaseModel): risk_level: str = None observable_str: str = None evidence_str: str = None + analytics_story_str: str = None kill_chain_phases_id: list = None + kill_chain_phases_str: str = None research_site_url: str = None event_schema: str = None mappings: list = None diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py index 44cea37840..6ca32f2d6a 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py @@ -10,6 +10,38 @@ class FindingReportObject(): @staticmethod def writeFindingReport(detection : Detection) -> None: + if detection.tags.confidence < 33: + detection.tags.confidence_id = 1 + elif detection.tags.confidence < 66: + detection.tags.confidence_id = 2 + else: + detection.tags.confidence_id = 3 + + if detection.tags.impact < 20: + detection.tags.impact_id = 1 + elif detection.tags.impact < 40: + detection.tags.impact_id = 2 + elif detection.tags.impact < 60: + detection.tags.impact_id = 3 + elif detection.tags.impact < 80: + detection.tags.impact_id = 4 + else: + detection.tags.impact_id = 5 + + detection.tags.kill_chain_phases_id = dict() + for kill_chain_phase in detection.tags.kill_chain_phases: + detection.tags.kill_chain_phases_id[kill_chain_phase] = SES_KILL_CHAIN_MAPPINGS[kill_chain_phase] + + kill_chain_phase_str = "[" + i = 0 + for kill_chain_phase in detection.tags.kill_chain_phases_id.keys(): + kill_chain_phase_str = '{"phase": "' + kill_chain_phase + '", "phase_id": ' + str(detection.tags.kill_chain_phases_id[kill_chain_phase]) + "}" + if not i == (len(detection.tags.kill_chain_phases_id.keys()) - 1): + kill_chain_phase_str = kill_chain_phase_str + ', ' + else: + i = i + 1 + kill_chain_phase_str = kill_chain_phase_str + ']' + detection.tags.kill_chain_phases_str = kill_chain_phase_str if detection.tags.risk_score < 20: detection.tags.risk_level_id = 0 @@ -27,15 +59,23 @@ class FindingReportObject(): detection.tags.risk_level_id = 4 detection.tags.risk_level = "Critical" - evidence_str = "create_map(" + evidence_str = "[" for i in range(len(detection.tags.observable)): - evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '", ' + detection.tags.observable[i]["name"].replace(".", "_") + evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '": ' + detection.tags.observable[i]["name"].replace(".", "_") if not i == (len(detection.tags.observable) - 1): evidence_str = evidence_str + ', ' - evidence_str = evidence_str + ')' + evidence_str = evidence_str + ']' detection.tags.evidence_str = evidence_str + analytics_story_str = "[" + for i in range(len(detection.tags.analytic_story)): + analytics_story_str = analytics_story_str + '"' + detection.tags.analytic_story[i] + '"' + if not i == (len(detection.tags.analytic_story) - 1): + analytics_story_str = analytics_story_str + ', ' + analytics_story_str = analytics_story_str + ']' + detection.tags.analytics_story_str = analytics_story_str + if "actor.user.name" in detection.tags.required_fields: actor_user_name = "actor_user_name" else: diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index 9fc187ce80..0b6b3ec063 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -66,7 +66,8 @@ class ObjToYmlAdapter(Adapter): "nist": obj.tags.nist } - obj.runtime = "SPL-DSP" + obj.runtime = "SPL2" + obj.internalVersion = 2 # remove unncessary fields YmlWriter.writeYmlFile(file_path, obj.dict( @@ -83,6 +84,7 @@ class ObjToYmlAdapter(Adapter): "known_false_positives": True, "references": True, "runtime": True, + "internalVersion": True, "tags": { #"analytic_story": True, diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 index 80d533ffb9..f4b933f288 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 @@ -1,28 +1,30 @@ - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", {{ detection.tags.evidence_str }}, - "message", concat("{{ detection.name }} has been triggered on ", device_hostname, " by ", {{ actor_user_name }}, "."), - "users", [ - create_map( - "name", {{ actor_user_name }}, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", {{ detection.tags.risk_level_id }}, - "risk_score", {{ detection.tags.risk_score }}, - "severity_id", 0, - "rule", create_map("name", "{{ detection.name }}", "uid", "{{ detection.id }}", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = {{ detection.tags.evidence_str }}, + message = "{{ detection.name }} has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = {{ detection.tags.analytics_story_str }}, + class_name = "Detection Report", + confidence = {{ detection.tags.confidence }}, + confidence_id = {{ detection.tags.confidence_id }}, + duration = 0, + impact = {{ detection.tags.impact }}, + impact_id = {{ detection.tags.impact_id }}, + kill_chain = {{ detection.tags.kill_chain_phases_str }}, + nist = ["DE.AE"], + risk_level = "{{ detection.tags.risk_level }}", + category_uid = 2, + class_uid = 102001, + risk_level_id = {{ detection.tags.risk_level_id }}, + risk_score = {{ detection.tags.risk_score }}, + severity_id = 0, + rule = {"name": "{{ detection.name }}", "uid": "{{ detection.id }}", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events(); \ No newline at end of file + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index cc632c4668..f90a9277eb 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -88,32 +88,29 @@ class SplunkBABackend(TextQueryBackend): # fields_input_parsing = fields_input_parsing + ', ' detection_str = """ -| from read_ba_enriched_events() -| eval timestamp = ucast(map_get(input_event,"time"),"long", null) -| eval metadata = ucast(map_get(input_event, "metadata"),"map", null) -| eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) +$main = from source +| eval timestamp = time +| eval metadata_uid = metadata.uid """.replace("\n", " ") parsed_fields = [] for field in self.field_mapping["mapping"].keys(): mapped_field = self.field_mapping["mapping"][field] - parent = 'input_event' + parent = 'parent' i = 1 values = mapped_field.split('.') for val in values: - if parent == "input_event": - new_val = val + if parent == "parent": + parent = val + continue else: new_val = parent + '_' + val if new_val in parsed_fields: parent = new_val i = i + 1 continue - if i == len(values): - parser_str = '| eval ' + new_val + '' + '=ucast(map_get(' + parent + ',"' + val + '"), "string", null) ' - else: - parser_str = '| eval ' + new_val + '' + '=ucast(map_get(' + parent + ',"' + val + '"), "map", null) ' + parser_str = '| eval ' + new_val + ' = ' + parent + '.' + val + ' ' detection_str = detection_str + parser_str parsed_fields.append(new_val) parent = new_val @@ -121,8 +118,6 @@ class SplunkBABackend(TextQueryBackend): detection_str = detection_str + "| where " + query detection_str = detection_str.replace("\\\\\\\\", "\\\\") - - return detection_str def finalize_output_data_model(self, queries: List[str]) -> List[str]: diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index 89a9d006aa..3a684bb988 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -3,53 +3,45 @@ id: 63614a58-10e2-4c6c-ae81-ea1113681439 version: 1 description: The following detection identifies the usage of archive tools from the command line. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") - OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") - OR like(actor_process_file_name, "%cmd.exe")) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Anomalous usage of Archive Tools has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 42, - "severity_id", 0, - "rule", create_map("name", "Anomalous usage of Archive Tools", "uid", "63614a58-10e2-4c6c-ae81-ea1113681439", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="WinRAR.exe" + OR like(process_file_name, "7z%") OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, + "%powershell.exe") OR like(actor_process_file_name, "%cmd.exe")) + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Anomalous usage of Archive Tools has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Cobalt Strike", "NOBELIUM Group", "Insider Threat"], + class_name = "Detection Report", + confidence = 60, + confidence_id = 2, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 42, + severity_id = 0, + rule = {"name": "Anomalous usage of Archive Tools", "uid": "63614a58-10e2-4c6c-ae81-ea1113681439", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -114,4 +106,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index a67dfcb554..2159ac7a1d 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Attempt To Delete Services has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 36, - "severity_id", 0, - "rule", create_map("name", "Attempt To Delete Services", "uid", "a0c8c292-d01a-11eb-aa18-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Attempt To Delete Services has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig", "Ransomware"], + class_name = "Detection Report", + confidence = 60, + confidence_id = 2, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}, ], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 36, + severity_id = 0, + rule = {"name": "Attempt To Delete Services", "uid": "a0c8c292-d01a-11eb-aa18-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -120,4 +122,5 @@ test: - file_name: sc_del.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index 0babd2c2c8..5239896158 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") AND process_file_name="sc.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Attempt To Disable Services has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 36, - "severity_id", 0, - "rule", create_map("name", "Attempt To Disable Services", "uid", "afb31de4-d023-11eb-98d5-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Attempt To Disable Services has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig", "Ransomware"], + class_name = "Detection Report", + confidence = 60, + confidence_id = 2, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 36, + severity_id = 0, + rule = {"name": "Attempt To Disable Services", "uid": "afb31de4-d023-11eb-98d5-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -117,4 +119,5 @@ test: - file_name: sc_disable.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index ddc458e504..18c10e792f 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, /(?i)save/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Attempted Credential Dump From Registry via Reg exe has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 63, - "severity_id", 0, - "rule", create_map("name", "Attempted Credential Dump From Registry via Reg exe", "uid", "14038953-e5f2-4daf-acff-5452062baf03", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Attempted Credential Dump From Registry via Reg exe has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Credential Dumping"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 63, + severity_id = 0, + rule = {"name": "Attempted Credential Dump From Registry via Reg exe", "uid": "14038953-e5f2-4daf-acff-5452062baf03", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -117,4 +119,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 572eba26b4..7b4e45184b 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") AND like(process_cmd_line, "%recoveryenabled%")) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("BCDEdit Failure Recovery Modification has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "BCDEdit Failure Recovery Modification", "uid", "76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "BCDEdit Failure Recovery Modification has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ryuk Ransomware", "Ransomware", "Information Sabotage"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 100, + impact_id = 5, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "BCDEdit Failure Recovery Modification", "uid": "76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -112,4 +114,5 @@ test: - file_name: windows-security_bcdedit_wbadmin.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index 0769a93a6c..87ca93870b 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Clear Unallocated Sector Using Cipher App has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 90, - "severity_id", 0, - "rule", create_map("name", "Clear Unallocated Sector Using Cipher App", "uid", "8f907d90-6173-11ec-9c23-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Clear Unallocated Sector Using Cipher App has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ransomware", "Information Sabotage"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 90, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 90, + severity_id = 0, + rule = {"name": "Clear Unallocated Sector Using Cipher App", "uid": "8f907d90-6173-11ec-9c23-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -113,4 +115,5 @@ test: - file_name: security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 0b3d0bf55f..3db8d162e4 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -26,33 +26,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") AND (process_file_name="net.exe" OR process_file_name="net1.exe") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Delete A Net User has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Delete A Net User", "uid", "8776d79c-d26e-11eb-9a56-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Delete A Net User has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig", "Ransomware"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Delete A Net User", "uid": "8776d79c-d26e-11eb-9a56-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -119,4 +121,5 @@ test: - file_name: security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index f90ed068db..95a83546b1 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Deny Permission using Cacls Utility has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Deny Permission using Cacls Utility", "uid", "b76eae28-cd25-11eb-9c92-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Deny Permission using Cacls Utility has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig", "Information Sabotage"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Deny Permission using Cacls Utility", "uid": "b76eae28-cd25-11eb-9c92-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -115,4 +117,5 @@ test: - file_name: all_icalc.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 66f8616fc8..5af0ae8dbb 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -30,33 +30,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Detect Prohibited Applications Spawning cmd exe has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Detect Prohibited Applications Spawning cmd exe", "uid", "c10a18cb-fd80-4ffa-a844-25026e0a0c94", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Detect Prohibited Applications Spawning cmd exe has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious Command-Line Executions", "Insider Threat"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Installation", "phase_id": 5}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Detect Prohibited Applications Spawning cmd exe", "uid": "c10a18cb-fd80-4ffa-a844-25026e0a0c94", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. @@ -119,4 +121,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index c1862cc5bb..a984fc0c74 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -32,33 +32,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, "%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Detect RClone Command-Line Usage has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Detect RClone Command-Line Usage", "uid", "e8b74268-5454-11ec-a799-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Detect RClone Command-Line Usage has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["DarkSide Ransomware", "Ransomware", "Insider Threat"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Detect RClone Command-Line Usage", "uid": "e8b74268-5454-11ec-a799-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -125,4 +127,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index a96f5a9195..1927f56abb 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") AND (process_file_name="net.exe" OR process_file_name="net1.exe") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Disable Net User Account has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Disable Net User Account", "uid", "ba858b08-d26c-11eb-af9b-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Disable Net User Account has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig", "Ransomware"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Installation", "phase_id": 5}, ], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Disable Net User Account", "uid": "ba858b08-d26c-11eb-af9b-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -119,4 +121,5 @@ test: - file_name: net_user_dis.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index e02d07c982..a4d7157c44 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, "%-querytype=%")) AND process_file_name="nslookup.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("DNS Exfiltration Using Nslookup App has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 72, - "severity_id", 0, - "rule", create_map("name", "DNS Exfiltration Using Nslookup App", "uid", "2452e632-9e0d-11eb-34ba-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "DNS Exfiltration Using Nslookup App has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious DNS Traffic", "Dynamic DNS", "Data Exfiltration", "Command And Control"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 90, + impact_id = 5, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 72, + severity_id = 0, + rule = {"name": "DNS Exfiltration Using Nslookup App", "uid": "2452e632-9e0d-11eb-34ba-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -120,4 +122,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index f50eaf9a35..3c91c5df52 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Fsutil Zeroing File has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 54, - "severity_id", 0, - "rule", create_map("name", "Fsutil Zeroing File", "uid", "f792cdc9-43ee-4429-a3c0-ffce4fed1a85", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Fsutil Zeroing File has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ransomware", "Insider Threat", "Information Sabotage"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 54, + severity_id = 0, + rule = {"name": "Fsutil Zeroing File", "uid": "f792cdc9-43ee-4429-a3c0-ffce4fed1a85", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -115,4 +117,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index fc32e7bda4..f3dddb5a82 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Grant Permission Using Cacls Utility has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Grant Permission Using Cacls Utility", "uid", "c6da561a-cd29-11eb-ae65-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Grant Permission Using Cacls Utility has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig", "Insider Threat"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Grant Permission Using Cacls Utility", "uid": "c6da561a-cd29-11eb-ae65-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -115,4 +117,5 @@ test: - file_name: all_icalc.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index 44ab76c288..4ee4d7edb4 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Hiding Files And Directories With Attrib exe has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 72, - "severity_id", 0, - "rule", create_map("name", "Hiding Files And Directories With Attrib exe", "uid", "028e4406-6176-11ec-aec2-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Hiding Files And Directories With Attrib exe has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows Defense Evasion Tactics", "Windows Persistence Techniques", "Information Sabotage", "Insider Threat"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 72, + severity_id = 0, + rule = {"name": "Hiding Files And Directories With Attrib exe", "uid": "028e4406-6176-11ec-aec2-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -118,4 +120,5 @@ test: - file_name: security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index abc8311a20..9f81fa8016 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Modify ACLs Permission Of Files Or Folders has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Modify ACLs Permission Of Files Or Folders", "uid", "9ae9a48a-cdbe-11eb-875a-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Modify ACLs Permission Of Files Or Folders has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Modify ACLs Permission Of Files Or Folders", "uid": "9ae9a48a-cdbe-11eb-875a-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -117,4 +119,5 @@ test: - file_name: all_icalc.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml index 2cbbcefe1b..43c1b36b33 100644 --- a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml +++ b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml @@ -26,33 +26,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Office Product Spawning Windows Script Host has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 63, - "severity_id", 0, - "rule", create_map("name", "Office Product Spawning Windows Script Host", "uid", "3ea3851a-8736-41a0-bc09-7e4485b48fa6", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Office Product Spawning Windows Script Host has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Spearphishing Attachments"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Delivery", "phase_id": 3}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 63, + severity_id = 0, + rule = {"name": "Office Product Spawning Windows Script Host", "uid": "3ea3851a-8736-41a0-bc09-7e4485b48fa6", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -116,4 +118,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index 3e2d5a8bb6..7960274bc8 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, "%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Resize Shadowstorage Volume has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 64, - "severity_id", 0, - "rule", create_map("name", "Resize Shadowstorage Volume", "uid", "dbc30554-d27e-11eb-9e5e-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Resize Shadowstorage Volume has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Clop Ransomware", "Ransomware"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 64, + severity_id = 0, + rule = {"name": "Resize Shadowstorage Volume", "uid": "dbc30554-d27e-11eb-9e5e-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -116,4 +118,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index aa26c33862..4515d16cc1 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -35,33 +35,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line, "%-c %")) AND like(process_file_name, "%sdelete%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Sdelete Application Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 42, - "severity_id", 0, - "rule", create_map("name", "Sdelete Application Execution", "uid", "fcc52b9a-4616-11ec-8454-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Sdelete Application Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Information Sabotage", "Insider Threat"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}, ], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 42, + severity_id = 0, + rule = {"name": "Sdelete Application Execution", "uid": "fcc52b9a-4616-11ec-8454-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -129,4 +131,5 @@ test: - file_name: security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index 5c322f21b6..6a965d3a5e 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -236,33 +236,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe") AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT match_regex(process_file_path, /(?i)\\windows\\system32/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("System Process Running from Unexpected Location has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 56, - "severity_id", 0, - "rule", create_map("name", "System Process Running from Unexpected Location", "uid", "28179107-099a-464a-94d3-08301e6c055f", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "System Process Running from Unexpected Location has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows Defense Evasion Tactics", "Masquerading - Rename System Utilities"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 56, + severity_id = 0, + rule = {"name": "System Process Running from Unexpected Location", "uid": "28179107-099a-464a-94d3-08301e6c055f", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: None references: [] @@ -321,4 +323,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 1a22c44bfb..0cf240058f 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%") OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%")) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("WBAdmin Delete System Backups has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 15, - "severity_id", 0, - "rule", create_map("name", "WBAdmin Delete System Backups", "uid", "71efbf52-4dbb-4c00-a520-306aa546cbb7", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "WBAdmin Delete System Backups has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ryuk Ransomware", "Ransomware"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 30, + impact_id = 2, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 15, + severity_id = 0, + rule = {"name": "WBAdmin Delete System Backups", "uid": "71efbf52-4dbb-4c00-a520-306aa546cbb7", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -114,4 +116,5 @@ test: - file_name: windows-security_bcdedit_wbadmin.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index a74aa387f6..10e487c32c 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -26,33 +26,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line, /(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("WevtUtil Usage To Clear Logs has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 63, - "severity_id", 0, - "rule", create_map("name", "WevtUtil Usage To Clear Logs", "uid", "5438113c-cdd9-11eb-93b8-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "WevtUtil Usage To Clear Logs has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware", "Insider Threat", "CISA AA22-264A"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 63, + severity_id = 0, + rule = {"name": "WevtUtil Usage To Clear Logs", "uid": "5438113c-cdd9-11eb-93b8-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -121,4 +123,5 @@ test: - file_name: clear_evt.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 423c110ccc..727e84a790 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% sl %") AND process_file_name="wevtutil.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Wevtutil Usage To Disable Logs has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 63, - "severity_id", 0, - "rule", create_map("name", "Wevtutil Usage To Disable Logs", "uid", "a4bdc944-cdd9-11eb-ac97-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Wevtutil Usage To Disable Logs has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows Log Manipulation", "Ransomware", "Insider Threat", "Information Sabotage"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 63, + severity_id = 0, + rule = {"name": "Wevtutil Usage To Disable Logs", "uid": "a4bdc944-cdd9-11eb-ac97-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -117,4 +119,5 @@ test: - file_name: disable_evt.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index d810c3e4e5..424d82b72e 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -29,33 +29,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%") OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%") OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Bits Job Persistence has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 56, - "severity_id", 0, - "rule", create_map("name", "Windows Bits Job Persistence", "uid", "1e25e97a-8ea4-11ec-9767-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Bits Job Persistence has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["BITS Jobs", "Living Off The Land"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Installation", "phase_id": 5}, ], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 56, + severity_id = 0, + rule = {"name": "Windows Bits Job Persistence", "uid": "1e25e97a-8ea4-11ec-9767-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -125,4 +127,5 @@ test: - file_name: bits-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 8ef9fa0746..5bac17445c 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -32,33 +32,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Bitsadmin Download File has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Windows Bitsadmin Download File", "uid", "d76e8188-8f5a-11ec-ace4-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Bitsadmin Download File has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Command And Control", "phase_id": 6}, ], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Windows Bitsadmin Download File", "uid": "d76e8188-8f5a-11ec-ace4-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -131,4 +133,5 @@ test: - file_name: bits-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index 67fd722158..e097a6d227 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows CertUtil Decode File has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 40, - "severity_id", 0, - "rule", create_map("name", "Windows CertUtil Decode File", "uid", "b06983f4-8f72-11ec-ab50-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows CertUtil Decode File has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Deobfuscate-Decode Files or Information", "Living Off The Land"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 40, + severity_id = 0, + rule = {"name": "Windows CertUtil Decode File", "uid": "b06983f4-8f72-11ec-ab50-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -123,4 +125,5 @@ test: - file_name: encode-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index fd8dacebe4..d1ea845f14 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") AND like(process_cmd_line, "%urlcache%")) OR like(process_cmd_line, "%urlcache%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows CertUtil URLCache Download has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 90, - "severity_id", 0, - "rule", create_map("name", "Windows CertUtil URLCache Download", "uid", "8cb1ad38-8f6d-11ec-87a3-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows CertUtil URLCache Download has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 90, + impact_id = 5, + kill_chain = {"phase": "Command And Control", "phase_id": 6}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 90, + severity_id = 0, + rule = {"name": "Windows CertUtil URLCache Download", "uid": "8cb1ad38-8f6d-11ec-87a3-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -120,4 +122,5 @@ test: - file_name: T1105-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index 9c70a807aa..9fd275acd2 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") AND like(process_cmd_line, "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows CertUtil VerifyCtl Download has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 90, - "severity_id", 0, - "rule", create_map("name", "Windows CertUtil VerifyCtl Download", "uid", "9ac29c40-8f6b-11ec-b19a-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows CertUtil VerifyCtl Download has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 90, + impact_id = 5, + kill_chain = {"phase": "Command And Control", "phase_id": 6}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 90, + severity_id = 0, + rule = {"name": "Windows CertUtil VerifyCtl Download", "uid": "9ac29c40-8f6b-11ec-b19a-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -121,4 +123,5 @@ test: - file_name: T1105-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml index b3669571d7..450f7a3765 100644 --- a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows COM Hijacking InprocServer32 Modification has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 64, - "severity_id", 0, - "rule", create_map("name", "Windows COM Hijacking InprocServer32 Modification", "uid", "0ae05a0f-bc84-456b-822a-a5b9c081c7ca", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows COM Hijacking InprocServer32 Modification has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Living Off The Land"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}, ], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 64, + severity_id = 0, + rule = {"name": "Windows COM Hijacking InprocServer32 Modification", "uid": "0ae05a0f-bc84-456b-822a-a5b9c081c7ca", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -120,4 +122,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 744e04b56e..90a4187b19 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -40,33 +40,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu %") OR like(process_cmd_line, "%-d %") OR like(process_cmd_line, "%--upload-file %") OR like(process_cmd_line, "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Curl Upload to Remote Destination has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows Curl Upload to Remote Destination", "uid", "cc8d046a-543b-11ec-b864-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Curl Upload to Remote Destination has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ingress Tool Transfer", "Insider Threat"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Command And Control", "phase_id": 6}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows Curl Upload to Remote Destination", "uid": "cc8d046a-543b-11ec-b864-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -131,4 +133,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml index a5e83f1ed2..7bb458684e 100644 --- a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml +++ b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml @@ -31,33 +31,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where (process_file_name="mmc.exe" AND like(process_cmd_line, "%gpme.msc%")) OR like(process_cmd_line, "%31B2F340-016D-11D2-945F-00C04FB984F9%") OR like(process_cmd_line, "%6AC1786C-016F-11D2-945F-00C04fB984F9%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Default Group Policy Object Modified with GPME has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 50, - "severity_id", 0, - "rule", create_map("name", "Windows Default Group Policy Object Modified with GPME", "uid", "bcb55c13-067b-4648-98f3-627010f72520", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Default Group Policy Object Modified with GPME has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Active Directory Privilege Escalation"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 100, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 50, + severity_id = 0, + rule = {"name": "Windows Default Group Policy Object Modified with GPME", "uid": "bcb55c13-067b-4648-98f3-627010f72520", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -125,4 +127,5 @@ test: - file_name: security-4688.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/security-4688.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 0c999d0876..489ccac64b 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, /(?i)\\windows defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows defender\\platform/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Defender Tools in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 56, - "severity_id", 0, - "rule", create_map("name", "Windows Defender Tools in Non Standard Path", "uid", "c205bd2e-cd5b-4224-8510-578a2a1f83d7", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Defender Tools in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Living Off The Land"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 56, + severity_id = 0, + rule = {"name": "Windows Defender Tools in Non Standard Path", "uid": "c205bd2e-cd5b-4224-8510-578a2a1f83d7", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. references: @@ -110,4 +112,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index ef37944b3c..dcc76e0bb4 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -26,33 +26,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%")) AND process_file_name="diskshadow.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Diskshadow Proxy Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Windows Diskshadow Proxy Execution", "uid", "aa502688-9037-11ec-842d-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Diskshadow Proxy Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Windows Diskshadow Proxy Execution", "uid": "aa502688-9037-11ec-842d-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -114,4 +116,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index 86312ce4bd..804e09936c 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -58,33 +58,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR match_regex(process_file_path, /(?i)\\windows\\networkcontroller/)=true OR match_regex(process_file_path, /(?i)\\windows\\systemapps/)=true OR match_regex(process_file_path, /(?i)\\winsxs/)=true OR match_regex(process_file_path, /(?i)\\microsoft.net/)=true)) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows DotNet Binary in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Windows DotNet Binary in Non Standard Path", "uid", "21179107-099a-324a-94d3-08301e6c065f", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows DotNet Binary in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Masquerading - Rename System Utilities", "Unusual Processes", "Ransomware", "Signed Binary Proxy Execution InstallUtil", "WhisperGate"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Windows DotNet Binary in Non Standard Path", "uid": "21179107-099a-324a-94d3-08301e6c065f", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application @@ -155,4 +157,5 @@ test: - file_name: dotnet_lolbin-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml index 3f20f3aaf5..512dd474b8 100644 --- a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml +++ b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml @@ -37,33 +37,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)get-recipient/)=true OR match_regex(process_cmd_line, /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), - "message", concat("Windows Exchange PowerShell Module Usage has been triggered on ", device_hostname, " by ", "Unknown", "."), - "users", [ - create_map( - "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 32, - "severity_id", 0, - "rule", create_map("name", "Windows Exchange PowerShell Module Usage", "uid", "1118bc65-b0c7-4589-bc2f-ad6802fd0909", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + message = "Windows Exchange PowerShell Module Usage has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["ProxyShell", "CISA AA22-264A"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 40, + impact_id = 3, + kill_chain = {"phase": "Installation", "phase_id": 5}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 32, + severity_id = 0, + rule = {"name": "Windows Exchange PowerShell Module Usage", "uid": "1118bc65-b0c7-4589-bc2f-ad6802fd0909", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -123,4 +125,5 @@ test: - file_name: windows-powershell.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index c1f2034cd3..bc4dec7946 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -29,33 +29,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line, /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Execute Arbitrary Commands with MSDT has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 100, - "severity_id", 0, - "rule", create_map("name", "Windows Execute Arbitrary Commands with MSDT", "uid", "f253f9c2-10f0-4cc8-b469-f505ba8c2038", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Execute Arbitrary Commands with MSDT has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 100, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 100, + severity_id = 0, + rule = {"name": "Windows Execute Arbitrary Commands with MSDT", "uid": "f253f9c2-10f0-4cc8-b469-f505ba8c2038", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -123,4 +125,5 @@ test: - file_name: msdt-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml index 7210a61325..da89d537c3 100644 --- a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml @@ -20,33 +20,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, /(?i)invoke-sharefinder/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), - "message", concat("Windows File Share Discovery With Powerview has been triggered on ", device_hostname, " by ", "Unknown", "."), - "users", [ - create_map( - "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 48, - "severity_id", 0, - "rule", create_map("name", "Windows File Share Discovery With Powerview", "uid", "ec4f671e-c736-4f78-a4c0-8fe809e952e5", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + message = "Windows File Share Discovery With Powerview has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Active Directory Privilege Escalation"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 48, + severity_id = 0, + rule = {"name": "Windows File Share Discovery With Powerview", "uid": "ec4f671e-c736-4f78-a4c0-8fe809e952e5", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -98,4 +100,5 @@ test: - file_name: windows-powershell.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml index a0c8df7164..68327e6f3a 100644 --- a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="findstr.exe" AND like(process_cmd_line, "%cpassword%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Findstr GPP Discovery has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 56, - "severity_id", 0, - "rule", create_map("name", "Windows Findstr GPP Discovery", "uid", "73ed0f19-080e-4917-b7c6-56e1760a50d4", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Findstr GPP Discovery has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Active Directory Privilege Escalation"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 56, + severity_id = 0, + rule = {"name": "Windows Findstr GPP Discovery", "uid": "73ed0f19-080e-4917-b7c6-56e1760a50d4", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -122,4 +124,5 @@ test: - file_name: windows-4688.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-4688.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml index caca8f71f3..de392f8484 100644 --- a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND process_file_name="explorer.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Ingress Tool Transfer Using Explorer has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 25, - "severity_id", 0, - "rule", create_map("name", "Windows Ingress Tool Transfer Using Explorer", "uid", "695bfad6-9662-4f9e-a576-bf02a951aa60", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Ingress Tool Transfer Using Explorer has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["DarkCrystal RAT"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Command And Control", "phase_id": 6}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 25, + severity_id = 0, + rule = {"name": "Windows Ingress Tool Transfer Using Explorer", "uid": "695bfad6-9662-4f9e-a576-bf02a951aa60", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints. @@ -116,4 +118,5 @@ test: - file_name: T1105_explorer-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index 4939a389eb..b5d059520e 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -57,33 +57,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)(?i)\\windows\\networkcontrolle/)=true OR match_regex(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true OR match_regex(process_file_path, /(?i)(?i)\\winsxs/)=true OR match_regex(process_file_path, /(?i)(?i)\\microsoft.net/)=true)) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows LOLBin Binary in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Windows LOLBin Binary in Non Standard Path", "uid", "25689101-012a-324a-94d3-08301e6c065a", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows LOLBin Binary in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Ransomware", "WhisperGate"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Windows LOLBin Binary in Non Standard Path", "uid": "25689101-012a-324a-94d3-08301e6c065a", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application @@ -152,4 +154,5 @@ test: - file_name: dotnet_lolbin-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index 04027d661a..7ac7e452bd 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe" OR process_file_name="powershell.exe") AND like(actor_process_file_name, "%mshta.exe") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows MSHTA Child Process has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows MSHTA Child Process", "uid", "f63f7e9c-9526-11ec-9fc7-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows MSHTA Child Process has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious MSHTA Activity", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows MSHTA Child Process", "uid": "f63f7e9c-9526-11ec-9fc7-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -119,4 +121,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index 88c567faca..49fb0fa644 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND process_file_name="mshta.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows MSHTA Command-Line URL has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows MSHTA Command-Line URL", "uid", "9b35c538-94ef-11ec-9439-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows MSHTA Command-Line URL has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious MSHTA Activity", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows MSHTA Command-Line URL", "uid": "9b35c538-94ef-11ec-9439-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -121,4 +123,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index bfe0659b88..a9ad8f960c 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") OR like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows MSHTA Inline HTA Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows MSHTA Inline HTA Execution", "uid", "24962154-9524-11ec-9333-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows MSHTA Inline HTA Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious MSHTA Activity", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows MSHTA Inline HTA Execution", "uid": "24962154-9524-11ec-9333-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -119,4 +121,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml index 060d41f55b..7d9bc65547 100644 --- a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml +++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %")) AND process_file_name="odbcconf.exe") AND like(process_cmd_line, "%.rsp%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Odbcconf Load Response File has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 42, - "severity_id", 0, - "rule", create_map("name", "Windows Odbcconf Load Response File", "uid", "7b6c3fac-0c37-4efc-a85e-de88f42b6763", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Odbcconf Load Response File has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 42, + severity_id = 0, + rule = {"name": "Windows Odbcconf Load Response File", "uid": "7b6c3fac-0c37-4efc-a85e-de88f42b6763", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -116,4 +118,5 @@ test: - file_name: odbcconf-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index c46df3acbb..5c68d82120 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -31,33 +31,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%") AND like(process_cmd_line, "%ntds%")) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows OS Credential Dumping with Ntdsutil Export NTDS has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 50, - "severity_id", 0, - "rule", create_map("name", "Windows OS Credential Dumping with Ntdsutil Export NTDS", "uid", "dad9ddec-a72a-47be-87b6-a0f7ba98ed6e", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows OS Credential Dumping with Ntdsutil Export NTDS has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Credential Dumping", "HAFNIUM Group", "Living Off The Land"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 100, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 50, + severity_id = 0, + rule = {"name": "Windows OS Credential Dumping with Ntdsutil Export NTDS", "uid": "dad9ddec-a72a-47be-87b6-a0f7ba98ed6e", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -126,4 +128,5 @@ test: - file_name: 4688_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml index 82ac46545c..fc19621d48 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml @@ -31,33 +31,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm %")) AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe")) AND like(process_cmd_line, "%lsass%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows OS Credential Dumping with Procdump has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows OS Credential Dumping with Procdump", "uid", "e102e297-dbe6-4a19-b319-5c08f4c19a06", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows OS Credential Dumping with Procdump has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Credential Dumping", "HAFNIUM Group"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows OS Credential Dumping with Procdump", "uid": "e102e297-dbe6-4a19-b319-5c08f4c19a06", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -124,4 +126,5 @@ test: - file_name: procdump_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index afa33b2910..1ca8b9f350 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -31,33 +31,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Powershell Connect to Internet With Hidden Window has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Windows Powershell Connect to Internet With Hidden Window", "uid", "477e068e-8b6d-11ec-b6c1-81af21670352", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Powershell Connect to Internet With Hidden Window has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group", "Log4Shell CVE-2021-44228"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Windows Powershell Connect to Internet With Hidden Window", "uid": "477e068e-8b6d-11ec-b6c1-81af21670352", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -128,4 +130,5 @@ test: - file_name: hidden_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index 736e0b05da..97b0b8d5a8 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -21,33 +21,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where like(process_cmd_line, "%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), - "message", concat("Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on ", device_hostname, " by ", "Unknown", "."), - "users", [ - create_map( - "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 54, - "severity_id", 0, - "rule", create_map("name", "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser", "uid", "d57b4d91-fc91-4482-a325-47693cced1eb", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Active Directory Kerberos Attacks"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 54, + severity_id = 0, + rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser", "uid": "d57b4d91-fc91-4482-a325-47693cced1eb", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -101,4 +103,5 @@ test: - file_name: windows-powershell.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log source: WinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index d7f5a99b1e..ac4fe75665 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -22,33 +22,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, /(?i)get-domainuser/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), - "message", concat("Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on ", device_hostname, " by ", "Unknown", "."), - "users", [ - create_map( - "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 54, - "severity_id", 0, - "rule", create_map("name", "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView", "uid", "dc3f2af7-ca69-47ce-a122-9f9787e19417", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Active Directory Kerberos Attacks"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 54, + severity_id = 0, + rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView", "uid": "dc3f2af7-ca69-47ce-a122-9f9787e19417", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -101,4 +103,5 @@ test: - file_name: getdomainuser.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 4b899f2c9b..0dd6e17262 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)downloadfile/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Powershell DownloadFile has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Windows Powershell DownloadFile", "uid", "46440222-81d5-44b1-a376-19dcd70d1b08", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Powershell DownloadFile has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Malicious PowerShell", "Ingress Tool Transfer", "Log4Shell CVE-2021-44228"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Windows Powershell DownloadFile", "uid": "46440222-81d5-44b1-a376-19dcd70d1b08", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -122,4 +124,5 @@ test: - file_name: downloadfile_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index 176bfc055a..ff7265f85f 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -29,33 +29,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)start-bitstransfer/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows PowerShell Start-BitsTransfer has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Windows PowerShell Start-BitsTransfer", "uid", "0bafd086-8f61-11ec-996e-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows PowerShell Start-BitsTransfer has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["BITS Jobs", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Command And Control", "phase_id": 6}, ], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Windows PowerShell Start-BitsTransfer", "uid": "0bafd086-8f61-11ec-996e-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -123,4 +125,5 @@ test: - file_name: T1197_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml index 71ca37b2d3..dbe9c8378b 100644 --- a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml @@ -22,33 +22,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, /(?i)get-gpppassword/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), - "message", concat("Windows PowerSploit GPP Discovery has been triggered on ", device_hostname, " by ", "Unknown", "."), - "users", [ - create_map( - "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 56, - "severity_id", 0, - "rule", create_map("name", "Windows PowerSploit GPP Discovery", "uid", "fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + message = "Windows PowerSploit GPP Discovery has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Active Directory Privilege Escalation"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 56, + severity_id = 0, + rule = {"name": "Windows PowerSploit GPP Discovery", "uid": "fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -103,4 +105,5 @@ test: - file_name: win-powershell.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index 21cca3f8fc..d98473c520 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="rasautou.exe" AND match_regex(process_cmd_line, /(?i)-p /)=true AND match_regex(process_cmd_line, /(?i)-d /)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rasautou DLL Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows Rasautou DLL Execution", "uid", "6f42b8ce-1e15-11ec-ad5a-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rasautou DLL Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows Defense Evasion Tactics", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows Rasautou DLL Execution", "uid": "6f42b8ce-1e15-11ec-ad5a-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -120,4 +122,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index 16da05f0aa..02be4d7a2d 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path", "uid", "c842931e-661f-42bc-a4df-0460d93cfb69", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path", "uid": "c842931e-661f-42bc-a4df-0460d93cfb69", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -120,4 +122,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 5bce274dce..28e61dd101 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="adplus.exe" AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path", "uid", "ecaaf956-c516-4980-b08e-8c01c19614ca", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path", "uid": "ecaaf956-c516-4980-b08e-8c01c19614ca", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -118,4 +120,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index ecd69422fa..762064a016 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="advpack.dll" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path", "uid", "3284e4f4-67f7-49b6-ad5e-a8fcead2eef8", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path", "uid": "3284e4f4-67f7-49b6-ad5e-a8fcead2eef8", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -118,4 +120,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index 8d5b573a57..07b2812db5 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path", "uid", "e124f71f-11bc-47e4-9931-6046d256005d", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path", "uid": "e124f71f-11bc-47e4-9931-6046d256005d", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -119,4 +121,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index 3f93be3ac8..2c4ff2a9d6 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path", "uid", "057c06c7-ef31-4749-b5c9-199152e53a06", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path", "uid": "057c06c7-ef31-4749-b5c9-199152e53a06", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -120,4 +122,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 7b0d5af043..becd6f4593 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path", "uid", "93862a89-abe0-4094-909a-08ec390aa5e3", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path", "uid": "93862a89-abe0-4094-909a-08ec390aa5e3", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -118,4 +120,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index f42875000d..047637fd7f 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path", "uid", "d75cc561-3828-4d0a-92c4-0eb93bfe0929", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path", "uid": "d75cc561-3828-4d0a-92c4-0eb93bfe0929", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -119,4 +121,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index ebd4dbec13..49b729c8db 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="at.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities At exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities At exe LOLBAS in Non Standard Path", "uid", "6401d583-0052-4dc5-a713-68b510826d2b", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities At exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities At exe LOLBAS in Non Standard Path", "uid": "6401d583-0052-4dc5-a713-68b510826d2b", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -117,4 +119,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 857dc390ee..8bdd3ecf0d 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path", "uid", "b8da7ea5-8c16-4eff-9787-54ec271159e0", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path", "uid": "b8da7ea5-8c16-4eff-9787-54ec271159e0", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -118,4 +120,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index 1a2d458cc2..8b1e1aa91a 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe") AND match_regex(process_cmd_line, /(?i)comsvcs.dll/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rundll32 Comsvcs Memory Dump has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 40, - "severity_id", 0, - "rule", create_map("name", "Windows Rundll32 Comsvcs Memory Dump", "uid", "76bb9e35-f314-4c3d-a385-83c72a13ce4e", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rundll32 Comsvcs Memory Dump has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Credential Dumping", "Suspicious Rundll32 Activity"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 40, + impact_id = 3, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 40, + severity_id = 0, + rule = {"name": "Windows Rundll32 Comsvcs Memory Dump", "uid": "76bb9e35-f314-4c3d-a385-83c72a13ce4e", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) @@ -114,4 +116,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index ab4d55d262..3e53f68714 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") OR like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rundll32 Inline HTA Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 56, - "severity_id", 0, - "rule", create_map("name", "Windows Rundll32 Inline HTA Execution", "uid", "0caa1dd6-94f5-11ec-9786-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rundll32 Inline HTA Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious MSHTA Activity", "NOBELIUM Group", "Living Off The Land"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 56, + severity_id = 0, + rule = {"name": "Windows Rundll32 Inline HTA Execution", "uid": "0caa1dd6-94f5-11ec-9786-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -122,4 +124,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 1024255a57..0978d59113 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Script Host Spawn MSBuild has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows Script Host Spawn MSBuild", "uid", "92886f1c-9b11-11ec-848a-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Script Host Spawn MSBuild has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Trusted Developer Utilities Proxy Execution MSBuild", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows Script Host Spawn MSBuild", "uid": "92886f1c-9b11-11ec-848a-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -120,4 +122,5 @@ test: - file_name: msbuild-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 1a299b5c7c..bda0531cee 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -26,33 +26,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows System Binary Proxy Execution Compiled HTML File Decompile has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 90, - "severity_id", 0, - "rule", create_map("name", "Windows System Binary Proxy Execution Compiled HTML File Decompile", "uid", "11c32b19-05a6-48a8-ab28-18dbd9ec5d50", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows System Binary Proxy Execution Compiled HTML File Decompile has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious Compiled HTML Activity", "Living Off The Land"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 100, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 90, + severity_id = 0, + rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File Decompile", "uid": "11c32b19-05a6-48a8-ab28-18dbd9ec5d50", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -119,4 +121,5 @@ test: - file_name: 4688_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 51024955d7..27c927747e 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -31,33 +31,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND process_file_name="hh.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows System Binary Proxy Execution Compiled HTML File URL In Command Line has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 90, - "severity_id", 0, - "rule", create_map("name", "Windows System Binary Proxy Execution Compiled HTML File URL In Command Line", "uid", "0fec631a-7c9b-4e4c-b28b-93260953e25f", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows System Binary Proxy Execution Compiled HTML File URL In Command Line has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious Compiled HTML Activity", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 90, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 90, + severity_id = 0, + rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File URL In Command Line", "uid": "0fec631a-7c9b-4e4c-b28b-93260953e25f", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -129,4 +131,5 @@ test: - file_name: chm-wineventlog-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index f2a788c237..93e3899975 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -34,33 +34,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line, "%its:%")) AND process_file_name="hh.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 72, - "severity_id", 0, - "rule", create_map("name", "Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers", "uid", "ba0c2450-caea-4086-ac3a-a71e2659754b", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious Compiled HTML Activity", "Living Off The Land"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 72, + severity_id = 0, + rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers", "uid": "ba0c2450-caea-4086-ac3a-a71e2659754b", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -132,4 +134,5 @@ test: - file_name: chm-wineventlog-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index 473f111800..dd369547a9 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %")) AND process_file_name="msiexec.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows System Binary Proxy Execution MSIExec DLLRegisterServer has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Windows System Binary Proxy Execution MSIExec DLLRegisterServer", "uid", "8d1d5570-722c-49a3-996c-2e2cceef5163", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows System Binary Proxy Execution MSIExec DLLRegisterServer has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows System Binary Proxy Execution MSIExec"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Windows System Binary Proxy Execution MSIExec DLLRegisterServer", "uid": "8d1d5570-722c-49a3-996c-2e2cceef5163", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -113,4 +115,5 @@ test: - file_name: 4688_msiexec-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 0b7212880c..03042eac29 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND process_file_name="msiexec.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows System Binary Proxy Execution MSIExec Remote Download has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Windows System Binary Proxy Execution MSIExec Remote Download", "uid", "92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows System Binary Proxy Execution MSIExec Remote Download has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows System Binary Proxy Execution MSIExec"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Windows System Binary Proxy Execution MSIExec Remote Download", "uid": "92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -113,4 +115,5 @@ test: - file_name: 4688_msiexec-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index f51b95cf5a..3b36e5418d 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %")) AND process_file_name="msiexec.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows System Binary Proxy Execution MSIExec Unregister DLL has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Windows System Binary Proxy Execution MSIExec Unregister DLL", "uid", "df76a8d1-92e1-4ec9-b8f7-695b5838703e", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows System Binary Proxy Execution MSIExec Unregister DLL has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows System Binary Proxy Execution MSIExec"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Windows System Binary Proxy Execution MSIExec Unregister DLL", "uid": "df76a8d1-92e1-4ec9-b8f7-695b5838703e", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -113,4 +115,5 @@ test: - file_name: 4688_msiexec-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index 701db02b7c..94d2f62ab3 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows WMIPrvse Spawn MSBuild has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows WMIPrvse Spawn MSBuild", "uid", "76b3b290-9b31-11ec-a934-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows WMIPrvse Spawn MSBuild has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Trusted Developer Utilities Proxy Execution MSBuild", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows WMIPrvse Spawn MSBuild", "uid": "76b3b290-9b31-11ec-a934-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -120,4 +122,5 @@ test: - file_name: msbuild-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index 7bda2abc32..b5b2ebfeda 100644 --- a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -9,26 +9,16 @@ description: The following detection identifies the usage of archive tools from command line. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") - OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") - OR like(actor_process_file_name, "%cmd.exe")) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="WinRAR.exe" + OR like(process_file_name, "7z%") OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, + "%powershell.exe") OR like(actor_process_file_name, "%cmd.exe")) --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/tmp/ssa___anomalous_usage_of_archive_tools.yml b/tmp/ssa___anomalous_usage_of_archive_tools.yml new file mode 100644 index 0000000000..8a7dd6cc0c --- /dev/null +++ b/tmp/ssa___anomalous_usage_of_archive_tools.yml @@ -0,0 +1,99 @@ +name: Anomalous usage of Archive Tools +id: 63614a58-10e2-4c6c-ae81-ea1113681439 +version: 1 +date: '2021-11-22' +author: Patrick Bareiss, Splunk +type: Anomaly +status: production +description: The following detection identifies the usage of archive tools from the + command line. +data_source: +- Windows Security 4688 +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name IN ("WinRAR.exe", + "7z%", "winzip%")) AND (actor_process_file_name IN ("%powershell.exe", "%cmd.exe")) + --finding_report--' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives can be ligitmate usage of archive tools from + the command line. +references: +- https://attack.mitre.org/techniques/T1560/001/ +tags: + analytic_story: + - Cobalt Strike + - NOBELIUM Group + - Insider Threat + asset_type: Endpoint + confidence: 60 + impact: 70 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading + of 7zip. + mitre_attack_id: + - T1560.001 + - T1560 + observable: + - name: process.pid + type: Other + - name: process.file.path + type: File + - name: process.file.name + type: File + - name: process.cmd_line + type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname + product: + - Splunk Behavioral Analytics + required_fields: + - process.pid + - process.file.path + - process.file.name + - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname + risk_score: 42 + security_domain: endpoint + mappings: + - ocsf: process.pid + cim: process_id + - ocsf: process.file.path + cim: process_path + - ocsf: process.file.name + cim: process_name + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.name + cim: user + - ocsf: actor.process.pid + cim: parent_process_id + - ocsf: actor.process.file.path + cim: parent_process_path + - ocsf: actor.process.file.name + cim: parent_process_name + - ocsf: device.hostname + cim: dest +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log + source: WinEventLog:Security From 9533c55d933e6c1fbecfd575d686b7175bfa81b9 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 8 Aug 2023 16:00:23 +0200 Subject: [PATCH 02/14] converted detections to SPL2 --- .../contentctl_infrastructure/adapter/finding_report_writer.py | 2 +- dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml | 2 +- dist/ssa/srs/ssa___attempt_to_delete_services.yml | 2 +- dist/ssa/srs/ssa___attempt_to_disable_services.yml | 2 +- ...sa___attempted_credential_dump_from_registry_via_reg_exe.yml | 2 +- dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml | 2 +- .../ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml | 2 +- dist/ssa/srs/ssa___delete_a_net_user.yml | 2 +- dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml | 2 +- .../ssa___detect_prohibited_applications_spawning_cmd_exe.yml | 2 +- dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml | 2 +- dist/ssa/srs/ssa___disable_net_user_account.yml | 2 +- dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml | 2 +- dist/ssa/srs/ssa___fsutil_zeroing_file.yml | 2 +- dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml | 2 +- .../srs/ssa___hiding_files_and_directories_with_attrib_exe.yml | 2 +- .../srs/ssa___modify_acls_permission_of_files_or_folders.yml | 2 +- .../srs/ssa___office_product_spawning_windows_script_host.yml | 2 +- dist/ssa/srs/ssa___resize_shadowstorage_volume.yml | 2 +- dist/ssa/srs/ssa___sdelete_application_execution.yml | 2 +- .../ssa___system_process_running_from_unexpected_location.yml | 2 +- dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml | 2 +- dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml | 2 +- dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml | 2 +- dist/ssa/srs/ssa___windows_bits_job_persistence.yml | 2 +- dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml | 2 +- dist/ssa/srs/ssa___windows_certutil_decode_file.yml | 2 +- dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml | 2 +- dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml | 2 +- .../ssa___windows_com_hijacking_inprocserver32_modification.yml | 2 +- .../ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml | 2 +- ...__windows_default_group_policy_object_modified_with_gpme.yml | 2 +- .../srs/ssa___windows_defender_tools_in_non_standard_path.yml | 2 +- dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml | 2 +- .../srs/ssa___windows_dotnet_binary_in_non_standard_path.yml | 2 +- dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml | 2 +- .../srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml | 2 +- .../srs/ssa___windows_file_share_discovery_with_powerview.yml | 2 +- dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml | 2 +- .../srs/ssa___windows_ingress_tool_transfer_using_explorer.yml | 2 +- .../srs/ssa___windows_lolbin_binary_in_non_standard_path.yml | 2 +- dist/ssa/srs/ssa___windows_mshta_child_process.yml | 2 +- dist/ssa/srs/ssa___windows_mshta_command_line_url.yml | 2 +- dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml | 2 +- dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml | 2 +- ..._windows_os_credential_dumping_with_ntdsutil_export_ntds.yml | 2 +- .../srs/ssa___windows_os_credential_dumping_with_procdump.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- ...isabled_kerberos_pre_authentication_discovery_get_aduser.yml | 2 +- ...led_kerberos_pre_authentication_discovery_with_powerview.yml | 2 +- dist/ssa/srs/ssa___windows_powershell_downloadfile.yml | 2 +- dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml | 2 +- dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml | 2 +- dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml | 2 +- ...tilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml | 2 +- ..._system_utilities_adplus_exe_lolbas_in_non_standard_path.yml | 2 +- ...system_utilities_advpack_dll_lolbas_in_non_standard_path.yml | 2 +- ..._utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml | 2 +- ...m_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml | 2 +- ..._system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml | 2 +- ...tilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml | 2 +- ...name_system_utilities_at_exe_lolbas_in_non_standard_path.yml | 2 +- ...ystem_utilities_atbroker_exe_lolbas_in_non_standard_path.yml | 2 +- dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml | 2 +- dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml | 2 +- dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml | 2 +- ...stem_binary_proxy_execution_compiled_html_file_decompile.yml | 2 +- ...y_proxy_execution_compiled_html_file_url_in_command_line.yml | 2 +- ...ution_compiled_html_file_using_infotech_storage_handlers.yml | 2 +- ..._system_binary_proxy_execution_msiexec_dllregisterserver.yml | 2 +- ...ws_system_binary_proxy_execution_msiexec_remote_download.yml | 2 +- ...ows_system_binary_proxy_execution_msiexec_unregister_dll.yml | 2 +- dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml | 2 +- 73 files changed, 73 insertions(+), 73 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py index 6ca32f2d6a..6eb4892445 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py @@ -35,7 +35,7 @@ class FindingReportObject(): kill_chain_phase_str = "[" i = 0 for kill_chain_phase in detection.tags.kill_chain_phases_id.keys(): - kill_chain_phase_str = '{"phase": "' + kill_chain_phase + '", "phase_id": ' + str(detection.tags.kill_chain_phases_id[kill_chain_phase]) + "}" + kill_chain_phase_str = kill_chain_phase_str + '{"phase": "' + kill_chain_phase + '", "phase_id": ' + str(detection.tags.kill_chain_phases_id[kill_chain_phase]) + "}" if not i == (len(detection.tags.kill_chain_phases_id.keys()) - 1): kill_chain_phase_str = kill_chain_phase_str + ', ' else: diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index 3a684bb988..4c102fb528 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -27,7 +27,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index 2159ac7a1d..978d605c01 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}, ], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}, ], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index 5239896158..aa28030887 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 18c10e792f..76c7a36742 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 7b4e45184b..fc77c9a1df 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 100, impact_id = 5, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index 87ca93870b..ea75265ac4 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 90, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 3db8d162e4..35cb88f390 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -40,7 +40,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 95a83546b1..7d897b5d74 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 5af0ae8dbb..f4adf14a64 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -44,7 +44,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Installation", "phase_id": 5}], + kill_chain = [{"phase": "Installation", "phase_id": 5}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index a984fc0c74..a3f7cfe558 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -46,7 +46,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index 1927f56abb..b1aa82b4a5 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Installation", "phase_id": 5}, ], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}, {"phase": "Delivery", "phase_id": 3}, {"phase": "Installation", "phase_id": 5}, ], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index a4d7157c44..771a4d557b 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 90, impact_id = 5, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index 3c91c5df52..a686f4c3c2 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index f3dddb5a82..fdd002e2ee 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index 4ee4d7edb4..dd7904c920 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index 9f81fa8016..d2013a7ba9 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml index 43c1b36b33..02d3fa295c 100644 --- a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml +++ b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml @@ -40,7 +40,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Delivery", "phase_id": 3}], + kill_chain = [{"phase": "Delivery", "phase_id": 3}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index 7960274bc8..d4e3a64d62 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index 4515d16cc1..264e520ac8 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -49,7 +49,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}, ], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}, ], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index 6a965d3a5e..ed91e79d98 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -250,7 +250,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 0cf240058f..19606fd404 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 30, impact_id = 2, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index 10e487c32c..7feb58809c 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -40,7 +40,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 727e84a790..452a5e0a49 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index 424d82b72e..53da9904d9 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -43,7 +43,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Installation", "phase_id": 5}, ], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, ], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 5bac17445c..5248d907c5 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -46,7 +46,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Command And Control", "phase_id": 6}, ], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}, ], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index e097a6d227..67f56b4703 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index d1ea845f14..a28a52caca 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 90, impact_id = 5, - kill_chain = {"phase": "Command And Control", "phase_id": 6}], + kill_chain = [{"phase": "Command And Control", "phase_id": 6}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index 9fd275acd2..a0e7674aed 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 90, impact_id = 5, - kill_chain = {"phase": "Command And Control", "phase_id": 6}], + kill_chain = [{"phase": "Command And Control", "phase_id": 6}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml index 450f7a3765..96b6272e40 100644 --- a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}, ], + kill_chain = [{"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}, ], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 90a4187b19..44ed4c0cbf 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -54,7 +54,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Command And Control", "phase_id": 6}], + kill_chain = [{"phase": "Command And Control", "phase_id": 6}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml index 7bb458684e..2edfde46fe 100644 --- a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml +++ b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml @@ -45,7 +45,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 100, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 489ccac64b..893fa72dd7 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index dcc76e0bb4..3c3a433b0d 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -40,7 +40,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index 804e09936c..ce515b94c0 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -72,7 +72,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml index 512dd474b8..c16a3e0dee 100644 --- a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml +++ b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml @@ -51,7 +51,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 40, impact_id = 3, - kill_chain = {"phase": "Installation", "phase_id": 5}], + kill_chain = [{"phase": "Installation", "phase_id": 5}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index bc4dec7946..c7b0d2893c 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -43,7 +43,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 100, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml index da89d537c3..6d84deceb8 100644 --- a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml @@ -34,7 +34,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml index 68327e6f3a..46b3b8a30c 100644 --- a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml index de392f8484..867f97d856 100644 --- a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Command And Control", "phase_id": 6}], + kill_chain = [{"phase": "Command And Control", "phase_id": 6}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index b5d059520e..f1a169e32c 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -71,7 +71,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index 7ac7e452bd..ba0b5cfe23 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index 49fb0fa644..d11539885e 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index a9ad8f960c..927c2baecc 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml index 7d9bc65547..f1ad328297 100644 --- a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml +++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 5c68d82120..336e242c38 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -45,7 +45,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 100, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml index fc19621d48..d3883fe3aa 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml @@ -45,7 +45,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 1ca8b9f350..dccad33c0a 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -45,7 +45,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index 97b0b8d5a8..5822451f93 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -35,7 +35,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index ac4fe75665..b4555eee73 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -36,7 +36,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 0dd6e17262..e1073cd717 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index ff7265f85f..b5f80f61ad 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -43,7 +43,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Command And Control", "phase_id": 6}, ], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}, ], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml index dbe9c8378b..ea35f18b14 100644 --- a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml @@ -36,7 +36,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index d98473c520..28ce73517e 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index 02be4d7a2d..ca4d697b03 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 28e61dd101..5391fa8a62 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index 762064a016..5f6ed8e0e6 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index 07b2812db5..ed30b0097a 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index 2c4ff2a9d6..b24c8b9483 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index becd6f4593..6fbc7ba587 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index 047637fd7f..2a60d7deb9 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 49b729c8db..36dd7eb6e2 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 8bdd3ecf0d..59ba21340c 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index 8b1e1aa91a..b345a46259 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 40, impact_id = 3, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index 3e53f68714..1db12030de 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 0978d59113..f6ac421f3c 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index bda0531cee..05808e34a7 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -40,7 +40,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 100, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 27c927747e..1a106206f9 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -45,7 +45,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 90, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index 93e3899975..452cc9a74f 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -48,7 +48,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index dd369547a9..f2e0ef948f 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 03042eac29..92e1a8c8b3 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index 3b36e5418d..14a73b3351 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index 94d2f62ab3..e6b3ecf4b2 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, From 01aec84d9a7ffc1b7a04194b026091e44b06bbc5 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 9 Aug 2023 11:42:41 +0200 Subject: [PATCH 03/14] converted detections to SPL2 --- .../adapter/finding_report_writer.py | 4 +- .../adapter/templates/finding_report.j2 | 10 +-- .../builder/backend_splunk_ba.py | 2 +- ...ssa___anomalous_usage_of_archive_tools.yml | 16 ++-- .../srs/ssa___attempt_to_delete_services.yml | 40 ++++----- .../srs/ssa___attempt_to_disable_services.yml | 40 ++++----- ...dential_dump_from_registry_via_reg_exe.yml | 48 ++++------ ..._bcdedit_failure_recovery_modification.yml | 41 ++++----- ...ar_unallocated_sector_using_cipher_app.yml | 40 ++++----- dist/ssa/srs/ssa___delete_a_net_user.yml | 41 ++++----- ...___deny_permission_using_cacls_utility.yml | 42 ++++----- ...ohibited_applications_spawning_cmd_exe.yml | 52 +++++------ ...ssa___detect_rclone_command_line_usage.yml | 48 ++++------ .../srs/ssa___disable_net_user_account.yml | 41 ++++----- ...___dns_exfiltration_using_nslookup_app.yml | 43 ++++----- dist/ssa/srs/ssa___fsutil_zeroing_file.yml | 40 ++++----- ...__grant_permission_using_cacls_utility.yml | 42 ++++----- ..._files_and_directories_with_attrib_exe.yml | 40 ++++----- ...fy_acls_permission_of_files_or_folders.yml | 44 ++++------ ...e_product_spawning_windows_script_host.yml | 46 ++++------ .../srs/ssa___resize_shadowstorage_volume.yml | 40 ++++----- .../ssa___sdelete_application_execution.yml | 61 ++++++------- ...ocess_running_from_unexpected_location.yml | 80 ++++++++--------- .../ssa___wbadmin_delete_system_backups.yml | 41 ++++----- .../ssa___wevtutil_usage_to_clear_logs.yml | 46 ++++------ .../ssa___wevtutil_usage_to_disable_logs.yml | 40 ++++----- .../ssa___windows_bits_job_persistence.yml | 45 ++++------ .../ssa___windows_bitsadmin_download_file.yml | 40 ++++----- .../ssa___windows_certutil_decode_file.yml | 40 ++++----- ...a___windows_certutil_urlcache_download.yml | 42 ++++----- ...___windows_certutil_verifyctl_download.yml | 42 ++++----- ..._hijacking_inprocserver32_modification.yml | 40 ++++----- ...dows_curl_upload_to_remote_destination.yml | 44 ++++------ ...group_policy_object_modified_with_gpme.yml | 42 ++++----- ...ws_defender_tools_in_non_standard_path.yml | 41 ++++----- ...a___windows_diskshadow_proxy_execution.yml | 40 ++++----- ...ows_dotnet_binary_in_non_standard_path.yml | 87 +++++++++---------- ...ndows_exchange_powershell_module_usage.yml | 33 +++---- ...s_execute_arbitrary_commands_with_msdt.yml | 42 ++++----- ...ws_file_share_discovery_with_powerview.yml | 29 +++---- .../ssa___windows_findstr_gpp_discovery.yml | 40 ++++----- ...s_ingress_tool_transfer_using_explorer.yml | 40 ++++----- ...ows_lolbin_binary_in_non_standard_path.yml | 63 ++++++-------- .../srs/ssa___windows_mshta_child_process.yml | 47 ++++------ .../ssa___windows_mshta_command_line_url.yml | 40 ++++----- ...a___windows_mshta_inline_hta_execution.yml | 41 ++++----- ...___windows_odbcconf_load_response_file.yml | 41 ++++----- ...tial_dumping_with_ntdsutil_export_ntds.yml | 44 ++++------ ...ws_os_credential_dumping_with_procdump.yml | 42 ++++----- ...connect_to_internet_with_hidden_window.yml | 44 ++++------ ...re_authentication_discovery_get_aduser.yml | 30 +++---- ...uthentication_discovery_with_powerview.yml | 31 +++---- .../ssa___windows_powershell_downloadfile.yml | 44 ++++------ ..._windows_powershell_start_bitstransfer.yml | 44 ++++------ ...sa___windows_powersploit_gpp_discovery.yml | 29 +++---- .../ssa___windows_rasautou_dll_execution.yml | 41 ++++----- ...onsole_exe_lolbas_in_non_standard_path.yml | 40 ++++----- ...adplus_exe_lolbas_in_non_standard_path.yml | 41 ++++----- ...dvpack_dll_lolbas_in_non_standard_path.yml | 40 ++++----- ...ecutor_exe_lolbas_in_non_standard_path.yml | 40 ++++----- ...taller_exe_lolbas_in_non_standard_path.yml | 40 ++++----- ...appvlp_exe_lolbas_in_non_standard_path.yml | 41 ++++----- ...mpiler_exe_lolbas_in_non_standard_path.yml | 41 ++++----- ...ies_at_exe_lolbas_in_non_standard_path.yml | 40 ++++----- ...broker_exe_lolbas_in_non_standard_path.yml | 40 ++++----- ...__windows_rundll32_comsvcs_memory_dump.yml | 41 ++++----- ..._windows_rundll32_inline_hta_execution.yml | 41 ++++----- ...sa___windows_script_host_spawn_msbuild.yml | 42 ++++----- ...execution_compiled_html_file_decompile.yml | 40 ++++----- ...compiled_html_file_url_in_command_line.yml | 40 ++++----- ...l_file_using_infotech_storage_handlers.yml | 40 ++++----- ...xy_execution_msiexec_dllregisterserver.yml | 40 ++++----- ...roxy_execution_msiexec_remote_download.yml | 40 ++++----- ...proxy_execution_msiexec_unregister_dll.yml | 40 ++++----- .../ssa___windows_wmiprvse_spawn_msbuild.yml | 40 ++++----- ...ssa___anomalous_usage_of_archive_tools.yml | 4 +- .../ssa___attempt_to_delete_services.yml | 28 ++---- .../ssa___attempt_to_disable_services.yml | 28 ++---- ...dential_dump_from_registry_via_reg_exe.yml | 36 +++----- ..._bcdedit_failure_recovery_modification.yml | 29 +++---- ...ar_unallocated_sector_using_cipher_app.yml | 28 ++---- .../endpoint/ssa___delete_a_net_user.yml | 29 +++---- ...___deny_permission_using_cacls_utility.yml | 30 +++---- ...ohibited_applications_spawning_cmd_exe.yml | 40 ++++----- ...ssa___detect_rclone_command_line_usage.yml | 36 +++----- .../ssa___disable_net_user_account.yml | 29 +++---- ...___dns_exfiltration_using_nslookup_app.yml | 31 +++---- .../endpoint/ssa___fsutil_zeroing_file.yml | 28 ++---- ...__grant_permission_using_cacls_utility.yml | 30 +++---- ..._files_and_directories_with_attrib_exe.yml | 28 ++---- ...fy_acls_permission_of_files_or_folders.yml | 32 +++---- ...e_product_spawning_windows_script_host.yml | 34 +++----- .../ssa___resize_shadowstorage_volume.yml | 28 ++---- .../ssa___sdelete_application_execution.yml | 49 +++++------ ...ocess_running_from_unexpected_location.yml | 68 +++++++-------- .../ssa___wbadmin_delete_system_backups.yml | 29 +++---- .../ssa___wevtutil_usage_to_clear_logs.yml | 34 +++----- .../ssa___wevtutil_usage_to_disable_logs.yml | 28 ++---- .../ssa___windows_bits_job_persistence.yml | 33 +++---- .../ssa___windows_bitsadmin_download_file.yml | 28 ++---- .../ssa___windows_certutil_decode_file.yml | 28 ++---- ...a___windows_certutil_urlcache_download.yml | 30 +++---- ...___windows_certutil_verifyctl_download.yml | 30 +++---- ..._hijacking_inprocserver32_modification.yml | 28 ++---- ...dows_curl_upload_to_remote_destination.yml | 32 +++---- ...group_policy_object_modified_with_gpme.yml | 30 +++---- ...ws_defender_tools_in_non_standard_path.yml | 29 +++---- ...a___windows_diskshadow_proxy_execution.yml | 28 ++---- ...ows_dotnet_binary_in_non_standard_path.yml | 75 +++++++--------- ...ndows_exchange_powershell_module_usage.yml | 21 ++--- ...s_execute_arbitrary_commands_with_msdt.yml | 30 +++---- ...ws_file_share_discovery_with_powerview.yml | 17 ++-- .../ssa___windows_findstr_gpp_discovery.yml | 28 ++---- ...s_ingress_tool_transfer_using_explorer.yml | 28 ++---- ...__windows_lateral_tool_transfer_remcom.yml | 29 +++---- ...ows_lolbin_binary_in_non_standard_path.yml | 51 +++++------ .../ssa___windows_mshta_child_process.yml | 35 +++----- .../ssa___windows_mshta_command_line_url.yml | 28 ++---- ...a___windows_mshta_inline_hta_execution.yml | 29 +++---- ...___windows_odbcconf_load_response_file.yml | 29 +++---- ...tial_dumping_with_ntdsutil_export_ntds.yml | 30 +++---- ...ws_os_credential_dumping_with_procdump.yml | 30 +++---- ...connect_to_internet_with_hidden_window.yml | 32 +++---- ...re_authentication_discovery_get_aduser.yml | 18 ++-- ...uthentication_discovery_with_powerview.yml | 19 ++-- .../ssa___windows_powershell_downloadfile.yml | 32 +++---- ..._windows_powershell_export_certificate.yml | 17 ++-- ...ndows_powershell_export_pfxcertificate.yml | 17 ++-- ..._windows_powershell_start_bitstransfer.yml | 32 +++---- ...sa___windows_powersploit_gpp_discovery.yml | 17 ++-- .../ssa___windows_rasautou_dll_execution.yml | 29 +++---- .../ssa___windows_remote_create_service.yml | 29 +++---- ...onsole_exe_lolbas_in_non_standard_path.yml | 28 ++---- ...adplus_exe_lolbas_in_non_standard_path.yml | 29 +++---- ...dvpack_dll_lolbas_in_non_standard_path.yml | 28 ++---- ...ecutor_exe_lolbas_in_non_standard_path.yml | 28 ++---- ...taller_exe_lolbas_in_non_standard_path.yml | 28 ++---- ...appvlp_exe_lolbas_in_non_standard_path.yml | 29 +++---- ...mpiler_exe_lolbas_in_non_standard_path.yml | 29 +++---- ...ies_at_exe_lolbas_in_non_standard_path.yml | 28 ++---- ...broker_exe_lolbas_in_non_standard_path.yml | 28 ++---- ...__windows_rundll32_comsvcs_memory_dump.yml | 29 +++---- ..._windows_rundll32_inline_hta_execution.yml | 29 +++---- ...sa___windows_script_host_spawn_msbuild.yml | 30 +++---- ...sa___windows_service_create_with_tscon.yml | 27 ++---- ...execution_compiled_html_file_decompile.yml | 28 ++---- ...compiled_html_file_url_in_command_line.yml | 28 ++---- ...l_file_using_infotech_storage_handlers.yml | 28 ++---- ...xy_execution_msiexec_dllregisterserver.yml | 28 ++---- ...roxy_execution_msiexec_remote_download.yml | 28 ++---- ...proxy_execution_msiexec_unregister_dll.yml | 28 ++---- .../ssa___windows_wmiprvse_spawn_msbuild.yml | 28 ++---- 152 files changed, 1988 insertions(+), 3375 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py index 6eb4892445..adab1ed38b 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py @@ -59,12 +59,12 @@ class FindingReportObject(): detection.tags.risk_level_id = 4 detection.tags.risk_level = "Critical" - evidence_str = "[" + evidence_str = "{" for i in range(len(detection.tags.observable)): evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '": ' + detection.tags.observable[i]["name"].replace(".", "_") if not i == (len(detection.tags.observable) - 1): evidence_str = evidence_str + ', ' - evidence_str = evidence_str + ']' + evidence_str = evidence_str + '}' detection.tags.evidence_str = evidence_str diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 index f4b933f288..88fa0d2926 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 @@ -21,10 +21,10 @@ risk_level_id = {{ detection.tags.risk_level_id }}, risk_score = {{ detection.tags.risk_score }}, severity_id = 0, - rule = {"name": "{{ detection.name }}", "uid": "{{ detection.id }}", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "{{ detection.name }}", "uid": "{{ detection.id }}", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index f90a9277eb..6e7bac33b0 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -64,7 +64,7 @@ class SplunkBABackend(TextQueryBackend): deferred_separator : ClassVar[str] = " OR " deferred_only_query : ClassVar[str] = "*" - wildcard_match_expression : ClassVar[Optional[str]] = "like({field}, {value})" + wildcard_match_expression : ClassVar[Optional[str]] = "{field} LIKE {value}" def __init__(self, processing_pipeline: Optional["sigma.processing.pipeline.ProcessingPipeline"] = None, collect_errors: bool = False, min_time : str = "-30d", max_time : str = "now", detection : Detection = None, field_mapping: dict = None, **kwargs): diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index 4c102fb528..fd30d2e083 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -11,11 +11,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="WinRAR.exe" - OR like(process_file_name, "7z%") OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, - "%powershell.exe") OR like(actor_process_file_name, "%cmd.exe")) + OR process_file_name LIKE "7z%" OR process_file_name LIKE "winzip%") AND (actor_process_file_name + LIKE "%powershell.exe" OR actor_process_file_name LIKE "%cmd.exe") | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Anomalous usage of Archive Tools has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -35,11 +35,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me risk_level_id = 2, risk_score = 42, severity_id = 0, - rule = {"name": "Anomalous usage of Archive Tools", "uid": "63614a58-10e2-4c6c-ae81-ea1113681439", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Anomalous usage of Archive Tools", "uid": "63614a58-10e2-4c6c-ae81-ea1113681439", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index 978d605c01..6f48a9783c 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -6,28 +6,18 @@ description: The following analytic identifies Windows Service Control, `sc.exe` instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="sc.exe" AND + process_cmd_line LIKE "%delete%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Attempt To Delete Services has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 36, severity_id = 0, - rule = {"name": "Attempt To Delete Services", "uid": "a0c8c292-d01a-11eb-aa18-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Attempt To Delete Services", "uid": "a0c8c292-d01a-11eb-aa18-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index aa28030887..cea289aa40 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -6,28 +6,18 @@ description: The following analytic identifies Windows Service Control, `sc.exe` instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") - AND process_file_name="sc.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%config%" + AND process_cmd_line LIKE "%disabled%" AND process_file_name="sc.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Attempt To Disable Services has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 36, severity_id = 0, - rule = {"name": "Attempt To Disable Services", "uid": "afb31de4-d023-11eb-98d5-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Attempt To Disable Services", "uid": "afb31de4-d023-11eb-98d5-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 76c7a36742..0b70137bf5 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -4,32 +4,22 @@ version: 2 description: The following analytic identifies the use of `reg.exe` attempting to export Windows registry keys that contain hashed credentials. Adversaries will utilize this technique to capture and perform offline password cracking. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true - OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, - /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true - OR match_regex(process_cmd_line, /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, - /(?i)save/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="reg.exe" OR + process_file_name="cmd.exe") AND (match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true + OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(process_cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\System/)=true + OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(process_cmd_line, + /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, /(?i)save/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Attempted Credential Dump From Registry via Reg exe has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 63, severity_id = 0, - rule = {"name": "Attempted Credential Dump From Registry via Reg exe", "uid": "14038953-e5f2-4daf-acff-5452062baf03", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Attempted Credential Dump From Registry via Reg exe", "uid": "14038953-e5f2-4daf-acff-5452062baf03", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index fc77c9a1df..872d7c12dc 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -4,28 +4,19 @@ version: 1 description: This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") - AND like(process_cmd_line, "%recoveryenabled%")) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="bcdedit.exe" + AND (process_cmd_line LIKE "%no%" AND process_cmd_line LIKE "%recoveryenabled%") + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "BCDEdit Failure Recovery Modification has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "BCDEdit Failure Recovery Modification", "uid": "76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "BCDEdit Failure Recovery Modification", "uid": "76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index ea75265ac4..a8326a402f 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -4,28 +4,18 @@ version: 1 description: this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="cipher.exe" + AND process_cmd_line LIKE "%/W:%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Clear Unallocated Sector Using Cipher App has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 90, severity_id = 0, - rule = {"name": "Clear Unallocated Sector Using Cipher App", "uid": "8f907d90-6173-11ec-9c23-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Clear Unallocated Sector Using Cipher App", "uid": "8f907d90-6173-11ec-9c23-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 35cb88f390..070f034c0b 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -7,28 +7,19 @@ description: This analytic will detect a suspicious net.exe/net1.exe command-lin user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") - AND (process_file_name="net.exe" OR process_file_name="net1.exe") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%" + AND process_cmd_line LIKE "%/delete%" AND (process_file_name="net.exe" OR process_file_name="net1.exe") + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Delete A Net User has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -48,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Delete A Net User", "uid": "8776d79c-d26e-11eb-9a56-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Delete A Net User", "uid": "8776d79c-d26e-11eb-9a56-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 7d897b5d74..d22cdf0e33 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -5,29 +5,19 @@ description: The following analytic identifies the use of `cacls.exe`, `icacls.e or `xcacls.exe` placing the deny permission on a file or directory. Adversaries perform this behavior to prevent responders from reviewing or gaining access to adversary files on disk. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" - OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + /(?i)deny/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Deny Permission using Cacls Utility has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Deny Permission using Cacls Utility", "uid": "b76eae28-cd25-11eb-9c92-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Deny Permission using Cacls Utility", "uid": "b76eae28-cd25-11eb-9c92-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index f4adf14a64..95309eb29a 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -5,34 +5,24 @@ description: The following analytic identifies parent processes, browsers, Windo terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" - OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" - OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" - OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe" - OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe" - AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" - AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((actor_process_file_name="winword.exe" + OR actor_process_file_name="excel.exe" OR actor_process_file_name="outlook.exe" + OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe" + OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe" + OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe") + OR (actor_process_file_name="java.exe" AND (NOT match_regex(actor_process_file_name, + /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" AND (NOT + process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Detect Prohibited Applications Spawning cmd exe has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -52,11 +42,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Detect Prohibited Applications Spawning cmd exe", "uid": "c10a18cb-fd80-4ffa-a844-25026e0a0c94", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Detect Prohibited Applications Spawning cmd exe", "uid": "c10a18cb-fd80-4ffa-a844-25026e0a0c94", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: In order to successfully implement this analytic, you will need diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index a3f7cfe558..f50f9fc6e7 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -8,33 +8,23 @@ description: This analytic identifies commonly used command-line arguments used is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line, - "%--transfers%") OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line, - "%--ignore-existing%") OR like(process_cmd_line, "%--no-check-certificate%") OR - like(process_cmd_line, "%--progress%") OR like(process_cmd_line, "%--config%") OR - like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, - "%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%--multi-thread-streams%" + OR process_cmd_line LIKE "%--transfers%" OR process_cmd_line LIKE "%--auto-confirm%" + OR process_cmd_line LIKE "%--ignore-existing%" OR process_cmd_line LIKE "%--no-check-certificate%" + OR process_cmd_line LIKE "%--progress%" OR process_cmd_line LIKE "%--config%" OR + process_cmd_line LIKE "%ftp%" OR process_cmd_line LIKE "%pcloud%" OR process_cmd_line + LIKE "%mega%" OR process_cmd_line LIKE "%copy%") AND process_file_name="rclone.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Detect RClone Command-Line Usage has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -54,11 +44,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Detect RClone Command-Line Usage", "uid": "e8b74268-5454-11ec-a799-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Detect RClone Command-Line Usage", "uid": "e8b74268-5454-11ec-a799-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index b1aa82b4a5..8ce96a388c 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -5,28 +5,19 @@ description: This analytic will identify a suspicious command-line that disables user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used by the adversaries to interrupt availability of accounts and continue the impact against the organization. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") - AND (process_file_name="net.exe" OR process_file_name="net1.exe") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%" + AND process_cmd_line LIKE "%/active:no%" AND (process_file_name="net.exe" OR process_file_name="net1.exe") + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Disable Net User Account has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Disable Net User Account", "uid": "ba858b08-d26c-11eb-af9b-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Disable Net User Account", "uid": "ba858b08-d26c-11eb-af9b-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index 771a4d557b..7dd731f656 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -7,29 +7,20 @@ description: This search is to detect potential DNS exfiltration using nslookup use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") - OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, - "%-querytype=%")) AND process_file_name="nslookup.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-retry=%" + OR process_cmd_line LIKE "%-type=%" OR process_cmd_line LIKE "%-q=%" OR process_cmd_line + LIKE "%-qt=%" OR process_cmd_line LIKE "%-querytype=%") AND process_file_name="nslookup.exe" + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "DNS Exfiltration Using Nslookup App has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 72, severity_id = 0, - rule = {"name": "DNS Exfiltration Using Nslookup App", "uid": "2452e632-9e0d-11eb-34ba-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "DNS Exfiltration Using Nslookup App", "uid": "2452e632-9e0d-11eb-34ba-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index a686f4c3c2..a853b913eb 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -4,28 +4,18 @@ version: 1 description: This search is to detect a suspicious fsutil process to zeroing a target file. This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its defense evasion after encrypting the compromised host. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%setzerodata%" + AND process_file_name="fsutil.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Fsutil Zeroing File has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 54, severity_id = 0, - rule = {"name": "Fsutil Zeroing File", "uid": "f792cdc9-43ee-4429-a3c0-ffce4fed1a85", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Fsutil Zeroing File", "uid": "f792cdc9-43ee-4429-a3c0-ffce4fed1a85", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index fdd002e2ee..efe053454f 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -5,29 +5,19 @@ description: The following analytic identifies the use of `cacls.exe`, `icacls.e or `xcacls.exe` placing the grant permission on a file or directory. Adversaries perform this behavior to allow components of their files to run, however it allows responders to review or gaining access to adversary files on disk. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" - OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + /(?i)grant/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Grant Permission Using Cacls Utility has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Grant Permission Using Cacls Utility", "uid": "c6da561a-cd29-11eb-ae65-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Grant Permission Using Cacls Utility", "uid": "c6da561a-cd29-11eb-ae65-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index dd7904c920..f6ed4535d0 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -5,28 +5,18 @@ description: Attackers leverage an existing Windows binary, attrib.exe, to mark as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe to hide files. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="attrib.exe" + AND match_regex(process_cmd_line, /(?i)/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Hiding Files And Directories With Attrib exe has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 72, severity_id = 0, - rule = {"name": "Hiding Files And Directories With Attrib exe", "uid": "028e4406-6176-11ec-aec2-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Hiding Files And Directories With Attrib exe", "uid": "028e4406-6176-11ec-aec2-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: You must be ingesting data that records process activity from your diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index d2013a7ba9..614ee484b3 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -7,30 +7,20 @@ description: This analytic identifies suspicious modification of ACL permission is commonly configured by the file or directory owner with appropriate permission. This behavior raises suspicion if this command is seen on an endpoint utilized by an account with no permission to do so. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, - /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND - (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, + /(?i)everyone:/)=true) AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" + OR process_file_name="cacls.exe") | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Modify ACLs Permission Of Files Or Folders has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Modify ACLs Permission Of Files Or Folders", "uid": "9ae9a48a-cdbe-11eb-875a-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Modify ACLs Permission Of Files Or Folders", "uid": "9ae9a48a-cdbe-11eb-875a-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml index 02d3fa295c..b7c405fe3b 100644 --- a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml +++ b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml @@ -4,31 +4,21 @@ version: 1 description: The following analytic will identify a Windows Office Product spawning WScript.exe or CScript.exe. Tuning may be required based on legitimate application usage that may spawn scripts from an Office product. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="cscript.exe" OR process_file_name="wscript.exe") - AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, - /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true - OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, - /(?i)winword.exe/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="cscript.exe" + OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true + OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, + /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true + OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Office Product Spawning Windows Script Host has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -48,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 63, severity_id = 0, - rule = {"name": "Office Product Spawning Windows Script Host", "uid": "3ea3851a-8736-41a0-bc09-7e4485b48fa6", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Office Product Spawning Windows Script Host", "uid": "3ea3851a-8736-41a0-bc09-7e4485b48fa6", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index d4e3a64d62..081705d1e0 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -5,29 +5,19 @@ description: The following analytic identifies the resizing of shadowstorage usi vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event and a precursor to deleting the shadowstorage. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, - "%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%shadowstorage%" + AND process_cmd_line LIKE "%resize%" AND process_cmd_line LIKE "%maxsize%" AND process_file_name="vssadmin.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Resize Shadowstorage Volume has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 64, severity_id = 0, - rule = {"name": "Resize Shadowstorage Volume", "uid": "dbc30554-d27e-11eb-9e5e-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Resize Shadowstorage Volume", "uid": "dbc30554-d27e-11eb-9e5e-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index 264e520ac8..a7ccdc0862 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -6,38 +6,29 @@ description: This analytic will detect the execution of sdelete.exe attempting t to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%") - OR like(process_cmd_line, "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line, - "%.zip%") OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%") - OR like(process_cmd_line, "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line, - "%.jpg%") OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%") - OR like(process_cmd_line, "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line, - "%.rtf%") OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%") - OR like(process_cmd_line, "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR - like(process_cmd_line, "%/accepteula%") OR like(process_cmd_line, "%-z %") OR like(process_cmd_line, - "%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR - like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line, - "%-c %")) AND like(process_file_name, "%sdelete%") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%.xls%" + OR process_cmd_line LIKE "%.gz%" OR process_cmd_line LIKE "%.tar%" OR process_cmd_line + LIKE "%.rar%" OR process_cmd_line LIKE "%.zip%" OR process_cmd_line LIKE "%.7z%" + OR process_cmd_line LIKE "%.bmp%" OR process_cmd_line LIKE "%.gif%" OR process_cmd_line + LIKE "%.png%" OR process_cmd_line LIKE "%.jpg%" OR process_cmd_line LIKE "%.txt%" + OR process_cmd_line LIKE "%.log%" OR process_cmd_line LIKE "%.key%" OR process_cmd_line + LIKE "%.pdf%" OR process_cmd_line LIKE "%.rtf%" OR process_cmd_line LIKE "%.ppt%" + OR process_cmd_line LIKE "%.xls%" OR process_cmd_line LIKE "%.doc%" OR process_cmd_line + LIKE "%-nobanner%" OR process_cmd_line LIKE "%/accepteula%" OR process_cmd_line + LIKE "%-z %" OR process_cmd_line LIKE "%-s %" OR process_cmd_line LIKE "%-q %" OR + process_cmd_line LIKE "%-r %" OR process_cmd_line LIKE "%-p %" OR process_cmd_line + LIKE "%-f %" OR process_cmd_line LIKE "%-c %") AND process_file_name LIKE "%sdelete%" + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Sdelete Application Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -57,11 +48,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 42, severity_id = 0, - rule = {"name": "Sdelete Application Execution", "uid": "fcc52b9a-4616-11ec-8454-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Sdelete Application Execution", "uid": "fcc52b9a-4616-11ec-8454-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index ed91e79d98..146de25876 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -7,45 +7,35 @@ description: An attacker tries might try to use different version of a system co run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe" - OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe" - OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe" - OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" OR process_file_name="write.exe" - OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe" - OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe" - OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" OR process_file_name="winver.exe" - OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" OR process_file_name="winresume.exe" - OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" OR process_file_name="wininit.exe" - OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe" - OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" OR process_file_name="where.exe" - OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe" - OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe" - OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe" - OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe" - OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe" - OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe" - OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe" - OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe" - OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe" - OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" OR - process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="xwizard.exe" + OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" + OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" + OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" + OR process_file_name="write.exe" OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" + OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" + OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" + OR process_file_name="winver.exe" OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" + OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" + OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" + OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" + OR process_file_name="where.exe" OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" + OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" + OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" + OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" + OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" + OR process_file_name="vds.exe" OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" + OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" + OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" + OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" + OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" + OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe" OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe" OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe" @@ -238,7 +228,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu match_regex(process_file_path, /(?i)\\windows\\system32/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "System Process Running from Unexpected Location has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -258,11 +248,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 56, severity_id = 0, - rule = {"name": "System Process Running from Unexpected Location", "uid": "28179107-099a-464a-94d3-08301e6c055f", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "System Process Running from Unexpected Location", "uid": "28179107-099a-464a-94d3-08301e6c055f", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 19606fd404..36e7c276bb 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -4,28 +4,19 @@ version: 1 description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%") - OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%")) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="wbadmin.exe" + AND (process_cmd_line LIKE "%systemstatebackup%" OR process_cmd_line LIKE "%catalog%" + OR process_cmd_line LIKE "%delete%") | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "WBAdmin Delete System Backups has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 15, severity_id = 0, - rule = {"name": "WBAdmin Delete System Backups", "uid": "71efbf52-4dbb-4c00-a520-306aa546cbb7", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "WBAdmin Delete System Backups", "uid": "71efbf52-4dbb-4c00-a520-306aa546cbb7", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index 7feb58809c..4600574ccf 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -4,31 +4,21 @@ version: 2 description: The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, or system event logs. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line, - /(?i)setup/)=true OR match_regex(process_cmd_line, /(?i)application/)=true OR match_regex(process_cmd_line, - /(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line, - /(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)powershell/)=true OR match_regex(process_cmd_line, /(?i)setup/)=true OR match_regex(process_cmd_line, + /(?i)application/)=true OR match_regex(process_cmd_line, /(?i)sysmon/)=true OR match_regex(process_cmd_line, + /(?i)system/)=true OR match_regex(process_cmd_line, /(?i)security/)=true) AND process_cmd_line + LIKE "% cl %" AND process_file_name="wevtutil.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "WevtUtil Usage To Clear Logs has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -48,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 63, severity_id = 0, - rule = {"name": "WevtUtil Usage To Clear Logs", "uid": "5438113c-cdd9-11eb-93b8-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "WevtUtil Usage To Clear Logs", "uid": "5438113c-cdd9-11eb-93b8-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: You must be ingesting data that records process activity from your diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 452a5e0a49..c2d69b55eb 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -4,28 +4,18 @@ version: 2 description: This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections in compromised host. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% - sl %") AND process_file_name="wevtutil.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%/e:false%" + AND process_cmd_line LIKE "% sl %" AND process_file_name="wevtutil.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Wevtutil Usage To Disable Logs has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 63, severity_id = 0, - rule = {"name": "Wevtutil Usage To Disable Logs", "uid": "a4bdc944-cdd9-11eb-ac97-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Wevtutil Usage To Disable Logs", "uid": "a4bdc944-cdd9-11eb-ac97-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: You must be ingesting data that records process activity from your diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index 53da9904d9..089db07e18 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -8,30 +8,21 @@ description: The following query identifies Microsoft Background Intelligent Tra the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%") - OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%") - OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%") - OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%resume%" + OR process_cmd_line LIKE "%setcustomheaders%" OR process_cmd_line LIKE "%setminretrydelay%" + OR process_cmd_line LIKE "%setnotifycmdline%" OR process_cmd_line LIKE "%setnotifyflags%" + OR process_cmd_line LIKE "%addfile%" OR process_cmd_line LIKE "%create%") AND process_file_name="bitsadmin.exe" + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Bits Job Persistence has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -51,11 +42,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 56, severity_id = 0, - rule = {"name": "Windows Bits Job Persistence", "uid": "1e25e97a-8ea4-11ec-9767-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Bits Job Persistence", "uid": "1e25e97a-8ea4-11ec-9767-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 5248d907c5..aa092d4b52 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -13,28 +13,18 @@ description: The following query identifies Microsoft Background Intelligent Tra and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%transfer%" + AND process_file_name="bitsadmin.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Bitsadmin Download File has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -54,11 +44,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Windows Bitsadmin Download File", "uid": "d76e8188-8f5a-11ec-ace4-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Bitsadmin Download File", "uid": "d76e8188-8f5a-11ec-ace4-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index 67f56b4703..4e7e843f0f 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -9,28 +9,18 @@ description: CertUtil.exe may be used to `encode` and `decode` a file, including and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%decode%" + AND process_file_name="certutil.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows CertUtil Decode File has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 40, severity_id = 0, - rule = {"name": "Windows CertUtil Decode File", "uid": "b06983f4-8f72-11ec-ab50-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows CertUtil Decode File", "uid": "b06983f4-8f72-11ec-ab50-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index a28a52caca..abd916fa39 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -8,29 +8,19 @@ description: Certutil.exe may download a file from a remote destination using `- However, it is uncommon for `certutil.exe` to write files to world writeable paths.\ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") - AND like(process_cmd_line, "%urlcache%")) OR like(process_cmd_line, "%urlcache%") - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="certutil.exe" + AND process_cmd_line LIKE "%split%" AND process_cmd_line LIKE "%urlcache%") OR process_cmd_line + LIKE "%urlcache%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows CertUtil URLCache Download has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 90, severity_id = 0, - rule = {"name": "Windows CertUtil URLCache Download", "uid": "8cb1ad38-8f6d-11ec-87a3-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows CertUtil URLCache Download", "uid": "8cb1ad38-8f6d-11ec-87a3-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index a0e7674aed..16e76e711a 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -8,29 +8,19 @@ description: 'Certutil.exe may download a file from a remote destination using ` \ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. Using `-VerifyCtl`, the file will either be written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. ' -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") - AND like(process_cmd_line, "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%") - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="certutil.exe" + AND process_cmd_line LIKE "%split%" AND process_cmd_line LIKE "%verifyctl%") OR + process_cmd_line LIKE "%verifyctl%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows CertUtil VerifyCtl Download has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 90, severity_id = 0, - rule = {"name": "Windows CertUtil VerifyCtl Download", "uid": "9ac29c40-8f6b-11ec-b19a-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows CertUtil VerifyCtl Download", "uid": "9ac29c40-8f6b-11ec-b19a-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml index 96b6272e40..713d4695a6 100644 --- a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -9,28 +9,18 @@ description: The following analytic identifies the use of reg.exe performing an to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true + AND process_file_name="reg.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows COM Hijacking InprocServer32 Modification has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 64, severity_id = 0, - rule = {"name": "Windows COM Hijacking InprocServer32 Modification", "uid": "0ae05a0f-bc84-456b-822a-a5b9c081c7ca", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows COM Hijacking InprocServer32 Modification", "uid": "0ae05a0f-bc84-456b-822a-a5b9c081c7ca", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 44ed4c0cbf..2299d662a5 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -19,30 +19,20 @@ description: 'The following analytic identifies the use of Windows Curl.exe uplo what they are attempting to upload (zip vs txt). During triage, review parallel processes for further behavior. In addition, identify if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.' -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data - %") OR like(process_cmd_line, "%-d %") OR like(process_cmd_line, "%--upload-file - %") OR like(process_cmd_line, "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-F %" + OR process_cmd_line LIKE "%--data %" OR process_cmd_line LIKE "%-d %" OR process_cmd_line + LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match_regex(process_file_name, + /(?i)curl.exe/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Curl Upload to Remote Destination has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -62,11 +52,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows Curl Upload to Remote Destination", "uid": "cc8d046a-543b-11ec-b864-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Curl Upload to Remote Destination", "uid": "cc8d046a-543b-11ec-b864-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml index 2edfde46fe..95d738b076 100644 --- a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml +++ b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml @@ -11,29 +11,19 @@ description: The following analytic identifies the potential edition of a defaul default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the edition of the default GPOs. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="mmc.exe" AND like(process_cmd_line, "%gpme.msc%")) - OR like(process_cmd_line, "%31B2F340-016D-11D2-945F-00C04FB984F9%") OR like(process_cmd_line, - "%6AC1786C-016F-11D2-945F-00C04fB984F9%") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="mmc.exe" AND + process_cmd_line LIKE "%gpme.msc%") OR process_cmd_line LIKE "%31B2F340-016D-11D2-945F-00C04FB984F9%" + OR process_cmd_line LIKE "%6AC1786C-016F-11D2-945F-00C04fB984F9%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Default Group Policy Object Modified with GPME has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -53,11 +43,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 50, severity_id = 0, - rule = {"name": "Windows Default Group Policy Object Modified with GPME", "uid": "bcb55c13-067b-4648-98f3-627010f72520", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Default Group Policy Object Modified with GPME", "uid": "bcb55c13-067b-4648-98f3-627010f72520", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 893fa72dd7..78c7754fd8 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -3,29 +3,20 @@ id: c205bd2e-cd5b-4224-8510-578a2a1f83d7 version: 1 description: The following analytic identifies usage of the MPCmdRun utility that can be abused by adversaries by moving it to a new directory. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, - /(?i)\\windows defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where match_regex(process_file_name, + /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, /(?i)\\windows + defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows defender\\platform/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Defender Tools in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 56, severity_id = 0, - rule = {"name": "Windows Defender Tools in Non Standard Path", "uid": "c205bd2e-cd5b-4224-8510-578a2a1f83d7", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Defender Tools in Non Standard Path", "uid": "c205bd2e-cd5b-4224-8510-578a2a1f83d7", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index 3c3a433b0d..a64ecbb01c 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -7,28 +7,18 @@ description: DiskShadow.exe is a Microsoft Signed binary present on Windows Serv usage of the scripting mode flags in executions of DiskShadow. During triage, compare to known backup behavior in your environment and then review the scripts called by diskshadow. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%")) - AND process_file_name="diskshadow.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%/s%" OR + process_cmd_line LIKE "%-S%") AND process_file_name="diskshadow.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Diskshadow Proxy Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -48,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Windows Diskshadow Proxy Execution", "uid": "aa502688-9037-11ec-842d-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Diskshadow Proxy Execution", "uid": "aa502688-9037-11ec-842d-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index ce515b94c0..b68abc926b 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -7,48 +7,39 @@ description: The following analytic identifies native .net binaries within the W an alert will be generated. Adversaries abuse these binaries as they are native to Windows and native DotNet. Note that not all SDK (post install of Windows) are captured in the list. Lookup - https://github.com/splunk/security_content/blob/develop/lookups/is_net_windows_file.csv. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, - /(?i)comsvcconfig.exe/)=true OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true - OR match_regex(process_file_name, /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, - /(?i)microsoft.workflow.compiler.exe/)=true OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true - OR match_regex(process_file_name, /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name, - /(?i)addinprocess.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true - OR match_regex(process_file_name, /(?i)addinutil.exe/)=true OR match_regex(process_file_name, - /(?i)aspnet_compiler.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true - OR match_regex(process_file_name, /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name, - /(?i)caspol.exe/)=true OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true - OR match_regex(process_file_name, /(?i)edmgen.exe/)=true OR match_regex(process_file_name, - /(?i)installutil.exe/)=true OR match_regex(process_file_name, /(?i)jsc.exe/)=true - OR match_regex(process_file_name, /(?i)ngentask.exe/)=true OR match_regex(process_file_name, - /(?i)regasm.exe/)=true OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true - OR match_regex(process_file_name, /(?i)sdnbr.exe/)=true OR match_regex(process_file_name, - /(?i)acu.exe/)=true OR match_regex(process_file_name, /(?i)appvstreamingux.exe/)=true - OR match_regex(process_file_name, /(?i)dsac.exe/)=true OR match_regex(process_file_name, - /(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.uev.synccontroller.exe/)=true - OR match_regex(process_file_name, /(?i)mtedit.exe/)=true OR match_regex(process_file_name, - /(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, /(?i)servermanager.exe/)=true - OR match_regex(process_file_name, /(?i)stordiag.exe/)=true OR match_regex(process_file_name, - /(?i)tzsync.exe/)=true OR match_regex(process_file_name, /(?i)uevagentpolicygenerator.exe/)=true - OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true OR match_regex(process_file_name, - /(?i)uevtemplatebaselinegenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true - OR match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name, +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_file_name, + /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, /(?i)comsvcconfig.exe/)=true + OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true OR match_regex(process_file_name, + /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.workflow.compiler.exe/)=true + OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true OR match_regex(process_file_name, + /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess.exe/)=true + OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true OR match_regex(process_file_name, + /(?i)addinutil.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_compiler.exe/)=true + OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true OR match_regex(process_file_name, + /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name, /(?i)caspol.exe/)=true + OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true OR match_regex(process_file_name, + /(?i)edmgen.exe/)=true OR match_regex(process_file_name, /(?i)installutil.exe/)=true + OR match_regex(process_file_name, /(?i)jsc.exe/)=true OR match_regex(process_file_name, + /(?i)ngentask.exe/)=true OR match_regex(process_file_name, /(?i)regasm.exe/)=true + OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true OR match_regex(process_file_name, + /(?i)sdnbr.exe/)=true OR match_regex(process_file_name, /(?i)acu.exe/)=true OR match_regex(process_file_name, + /(?i)appvstreamingux.exe/)=true OR match_regex(process_file_name, /(?i)dsac.exe/)=true + OR match_regex(process_file_name, /(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, + /(?i)microsoft.uev.synccontroller.exe/)=true OR match_regex(process_file_name, /(?i)mtedit.exe/)=true + OR match_regex(process_file_name, /(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, + /(?i)servermanager.exe/)=true OR match_regex(process_file_name, /(?i)stordiag.exe/)=true + OR match_regex(process_file_name, /(?i)tzsync.exe/)=true OR match_regex(process_file_name, + /(?i)uevagentpolicygenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true + OR match_regex(process_file_name, /(?i)uevtemplatebaselinegenerator.exe/)=true OR + match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true OR + match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name, /(?i)iediagcmd.exe/)=true OR match_regex(process_file_name, /(?i)xbox.tcui.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true OR match_regex(process_file_name, /(?i)iisual.exe/)=true OR match_regex(process_file_name, @@ -60,7 +51,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR match_regex(process_file_path, /(?i)\\microsoft.net/)=true)) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows DotNet Binary in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -80,11 +71,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Windows DotNet Binary in Non Standard Path", "uid": "21179107-099a-324a-94d3-08301e6c065f", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows DotNet Binary in Non Standard Path", "uid": "21179107-099a-324a-94d3-08301e6c065f", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. diff --git a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml index c16a3e0dee..0824a99345 100644 --- a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml +++ b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml @@ -23,23 +23,16 @@ description: 'The following analytic identifies the usage of Exchange PowerShell - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).' -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)get-recipient/)=true OR match_regex(process_cmd_line, /(?i)new-mailboxsearch/)=true - OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true OR match_regex(process_cmd_line, - /(?i)new-mailboxexportrequest/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line, + /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true + OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, message = "Windows Exchange PowerShell Module Usage has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -59,11 +52,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 32, severity_id = 0, - rule = {"name": "Windows Exchange PowerShell Module Usage", "uid": "1118bc65-b0c7-4589-bc2f-ad6802fd0909", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Exchange PowerShell Module Usage", "uid": "1118bc65-b0c7-4589-bc2f-ad6802fd0909", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index c7b0d2893c..a48d72f991 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -6,32 +6,22 @@ description: The following analytic identifies a recently disclosed arbitraty co identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, - "%ms-msdt:-id%") OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, - "%ms-msdt:%") OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%ms-msdt:/id%" + OR process_cmd_line LIKE "%ms-msdt:-id%" OR process_cmd_line LIKE "%ms-msdt:/id%" + OR process_cmd_line LIKE "%ms-msdt:%" OR process_cmd_line LIKE "%msdt%") AND process_file_name="msdt.exe") AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line, /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Execute Arbitrary Commands with MSDT has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -51,11 +41,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 100, severity_id = 0, - rule = {"name": "Windows Execute Arbitrary Commands with MSDT", "uid": "f253f9c2-10f0-4cc8-b469-f505ba8c2038", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Execute Arbitrary Commands with MSDT", "uid": "f253f9c2-10f0-4cc8-b469-f505ba8c2038", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml index 6d84deceb8..7fee533d55 100644 --- a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml @@ -8,21 +8,14 @@ description: The following analytic identifies the use of the Invoke-ShareFinder credentials, etc. Adversaries who have obtained a foothold in an AD network may leverage PowerView to identify secrets and leverage them for Privilege Escalation or Lateral Movement. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)invoke-sharefinder/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)invoke-sharefinder/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, message = "Windows File Share Discovery With Powerview has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -42,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 48, severity_id = 0, - rule = {"name": "Windows File Share Discovery With Powerview", "uid": "ec4f671e-c736-4f78-a4c0-8fe809e952e5", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows File Share Discovery With Powerview", "uid": "ec4f671e-c736-4f78-a4c0-8fe809e952e5", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable diff --git a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml index 46b3b8a30c..4f7b9a7575 100644 --- a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml @@ -9,28 +9,18 @@ description: The following analytic identifies the use of the findstr command em share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="findstr.exe" AND like(process_cmd_line, "%cpassword%") - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="findstr.exe" + AND process_cmd_line LIKE "%cpassword%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Findstr GPP Discovery has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 56, severity_id = 0, - rule = {"name": "Windows Findstr GPP Discovery", "uid": "73ed0f19-080e-4917-b7c6-56e1760a50d4", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Findstr GPP Discovery", "uid": "73ed0f19-080e-4917-b7c6-56e1760a50d4", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml index 867f97d856..b87bd54d64 100644 --- a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -9,28 +9,18 @@ description: The following analytic identifies the Windows Explorer process with anomaly detection might be a good pivot to check which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="explorer.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="explorer.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Ingress Tool Transfer Using Explorer has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 25, severity_id = 0, - rule = {"name": "Windows Ingress Tool Transfer Using Explorer", "uid": "695bfad6-9662-4f9e-a576-bf02a951aa60", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Ingress Tool Transfer Using Explorer", "uid": "695bfad6-9662-4f9e-a576-bf02a951aa60", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index f1a169e32c..0703ad6c87 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -6,36 +6,27 @@ description: The following analytic identifies native living off the land binari it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe, regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" - OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe" - OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe" - OR process_file_name="control.exe" OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe" - OR process_file_name="desktopimgdownldr.exe" OR process_file_name="dfsvc.exe" OR - process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" OR process_file_name="dllhost.exe" - OR process_file_name="dnscmd.exe" OR process_file_name="esentutl.exe" OR process_file_name="eventvwr.exe" - OR process_file_name="expand.exe" OR process_file_name="extexport.exe" OR process_file_name="extrac32.exe" - OR process_file_name="findstr.exe" OR process_file_name="finger.exe" OR process_file_name="fltmc.exe" - OR process_file_name="forfiles.exe" OR process_file_name="ftp.exe" OR process_file_name="gfxdownloadwrapper.exe" - OR process_file_name="gpscript.exe" OR process_file_name="imewdbld.exe" OR process_file_name="ie4uinit.exe" - OR process_file_name="ieexec.exe" OR process_file_name="ilasm.exe" OR process_file_name="infdefaultinstall.exe" - OR process_file_name="makecab.exe" OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="bitsadmin.exe" + OR process_file_name="certoc.exe" OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" + OR process_file_name="cmdkey.exe" OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" + OR process_file_name="configsecuritypolicy.exe" OR process_file_name="control.exe" + OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe" OR process_file_name="desktopimgdownldr.exe" + OR process_file_name="dfsvc.exe" OR process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" + OR process_file_name="dllhost.exe" OR process_file_name="dnscmd.exe" OR process_file_name="esentutl.exe" + OR process_file_name="eventvwr.exe" OR process_file_name="expand.exe" OR process_file_name="extexport.exe" + OR process_file_name="extrac32.exe" OR process_file_name="findstr.exe" OR process_file_name="finger.exe" + OR process_file_name="fltmc.exe" OR process_file_name="forfiles.exe" OR process_file_name="ftp.exe" + OR process_file_name="gfxdownloadwrapper.exe" OR process_file_name="gpscript.exe" + OR process_file_name="imewdbld.exe" OR process_file_name="ie4uinit.exe" OR process_file_name="ieexec.exe" + OR process_file_name="ilasm.exe" OR process_file_name="infdefaultinstall.exe" OR + process_file_name="makecab.exe" OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="mmc.exe" OR process_file_name="msconfig.exe" OR process_file_name="msdt.exe" OR process_file_name="mshta.exe" OR process_file_name="msiexec.exe" OR process_file_name="netsh.exe" OR process_file_name="odbcconf.exe" OR process_file_name="offlinescannershell.exe" @@ -59,7 +50,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)(?i)\\microsoft.net/)=true)) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows LOLBin Binary in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -79,11 +70,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Windows LOLBin Binary in Non Standard Path", "uid": "25689101-012a-324a-94d3-08301e6c065a", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows LOLBin Binary in Non Standard Path", "uid": "25689101-012a-324a-94d3-08301e6c065a", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index ba0b5cfe23..449bb1dedf 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -5,31 +5,22 @@ description: The following analytic identifies child processes spawning from "m The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, parent process "mshta.exe" and its child process. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="wscript.exe" OR process_file_name="cscript.exe" - OR process_file_name="searchprotocolhost.exe" OR process_file_name="microsoft.workflow.compiler.exe" - OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" - OR process_file_name="cmd.exe" OR process_file_name="powershell.exe") AND like(actor_process_file_name, - "%mshta.exe") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="wscript.exe" + OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe" + OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe" + OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe" + OR process_file_name="powershell.exe") AND actor_process_file_name LIKE "%mshta.exe" + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows MSHTA Child Process has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows MSHTA Child Process", "uid": "f63f7e9c-9526-11ec-9fc7-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows MSHTA Child Process", "uid": "f63f7e9c-9526-11ec-9fc7-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index d11539885e..0ac4383d1c 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -8,28 +8,18 @@ description: This analytic identifies when Microsoft HTML Application Host (msht malicious software to bypass preventative controls. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="mshta.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="mshta.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows MSHTA Command-Line URL has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows MSHTA Command-Line URL", "uid": "9b35c538-94ef-11ec-9439-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows MSHTA Command-Line URL", "uid": "9b35c538-94ef-11ec-9439-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index 927c2baecc..cdeda45f39 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -6,28 +6,19 @@ description: The following analytic identifies "mshta.exe" execution with inline invoking HTA content directly on the command-line. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "mshta.exe" and its parent process. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") - OR like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%about%" + OR process_cmd_line LIKE "%javascript%" OR process_cmd_line LIKE "%vbscript%") AND + process_file_name="mshta.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows MSHTA Inline HTA Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows MSHTA Inline HTA Execution", "uid": "24962154-9524-11ec-9333-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows MSHTA Inline HTA Execution", "uid": "24962154-9524-11ec-9333-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml index f1ad328297..13ca220cfe 100644 --- a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml +++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml @@ -6,28 +6,19 @@ description: The following analytic identifies the odbcconf.exe, Windows Open Da and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. During triage, review file modifications and parallel processes. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %")) - AND process_file_name="odbcconf.exe") AND like(process_cmd_line, "%.rsp%") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%/f %" + OR process_cmd_line LIKE "%-f %") AND process_file_name="odbcconf.exe") AND process_cmd_line + LIKE "%.rsp%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Odbcconf Load Response File has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 42, severity_id = 0, - rule = {"name": "Windows Odbcconf Load Response File", "uid": "7b6c3fac-0c37-4efc-a85e-de88f42b6763", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Odbcconf Load Response File", "uid": "7b6c3fac-0c37-4efc-a85e-de88f42b6763", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 336e242c38..53af63f924 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -12,33 +12,23 @@ description: 'Monitor for signs that Ntdsutil is being used to Extract Active Di This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination.' -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%") - AND like(process_cmd_line, "%ntds%")) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="ntdsutil.exe" + AND (process_cmd_line LIKE "%create%" AND process_cmd_line LIKE "%ntds%") | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows OS Credential Dumping with Ntdsutil Export NTDS has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], - analytic_stories = ["Credential Dumping", "HAFNIUM Group", "Living Off The Land"], + analytic_stories = ["Credential Dumping", "HAFNIUM Group", "Living Off The Land", "Volt Typhoon"], class_name = "Detection Report", confidence = 50, confidence_id = 2, @@ -53,11 +43,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 50, severity_id = 0, - rule = {"name": "Windows OS Credential Dumping with Ntdsutil Export NTDS", "uid": "dad9ddec-a72a-47be-87b6-a0f7ba98ed6e", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows OS Credential Dumping with Ntdsutil Export NTDS", "uid": "dad9ddec-a72a-47be-87b6-a0f7ba98ed6e", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting @@ -71,6 +61,7 @@ references: - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ tags: required_fields: - process.pid @@ -111,6 +102,7 @@ tags: - Credential Dumping - HAFNIUM Group - Living Off The Land + - Volt Typhoon cis20: - CIS 10 kill_chain_phases: diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml index d3883fe3aa..231a6d9298 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml @@ -11,29 +11,19 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe.' -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm - %")) AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe")) - AND like(process_cmd_line, "%lsass%") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%-ma %" + OR process_cmd_line LIKE "%-mm %") AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe")) + AND process_cmd_line LIKE "%lsass%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows OS Credential Dumping with Procdump has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -53,11 +43,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows OS Credential Dumping with Procdump", "uid": "e102e297-dbe6-4a19-b319-5c08f4c19a06", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows OS Credential Dumping with Procdump", "uid": "e102e297-dbe6-4a19-b319-5c08f4c19a06", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index dccad33c0a..29a025ccae 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -10,30 +10,20 @@ description: The following hunting analytic identifies PowerShell commands utili For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" + OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Powershell Connect to Internet With Hidden Window has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -53,11 +43,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Windows Powershell Connect to Internet With Hidden Window", "uid": "477e068e-8b6d-11ec-b6c1-81af21670352", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Powershell Connect to Internet With Hidden Window", "uid": "477e068e-8b6d-11ec-b6c1-81af21670352", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: You must be ingesting data that records process activity from your diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index 5822451f93..be4d210442 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -9,21 +9,15 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where like(process_cmd_line, - "%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where process_cmd_line LIKE "%4194304%" AND match_regex(process_cmd_line, /(?i)get-aduser/)=true + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -43,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 54, severity_id = 0, - rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser", "uid": "d57b4d91-fc91-4482-a325-47693cced1eb", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser", "uid": "d57b4d91-fc91-4482-a325-47693cced1eb", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index b4555eee73..7650d705bb 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -9,22 +9,15 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, /(?i)get-domainuser/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, + /(?i)get-domainuser/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -44,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 54, severity_id = 0, - rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView", "uid": "dc3f2af7-ca69-47ce-a122-9f9787e19417", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView", "uid": "dc3f2af7-ca69-47ce-a122-9f9787e19417", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index e1073cd717..c188824b28 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -6,30 +6,20 @@ description: The following analytic identifies the use of PowerShell downloading PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)downloadfile/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" + OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + /(?i)downloadfile/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Powershell DownloadFile has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Windows Powershell DownloadFile", "uid": "46440222-81d5-44b1-a376-19dcd70d1b08", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Powershell DownloadFile", "uid": "46440222-81d5-44b1-a376-19dcd70d1b08", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index b5f80f61ad..2500358d00 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -8,30 +8,20 @@ description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Si is used, it is highly possible files will be archived. During triage, review parallel processes and process lineage. Capture any files on disk and review. For the remote domain or IP, what is the reputation? -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)start-bitstransfer/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" + OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + /(?i)start-bitstransfer/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows PowerShell Start-BitsTransfer has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -51,11 +41,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Windows PowerShell Start-BitsTransfer", "uid": "0bafd086-8f61-11ec-996e-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows PowerShell Start-BitsTransfer", "uid": "0bafd086-8f61-11ec-996e-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml index ea35f18b14..4650b8e34f 100644 --- a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml @@ -10,21 +10,14 @@ description: The following analytic identifies the use of the Get-GPPPassword Po has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)get-gpppassword/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)get-gpppassword/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, message = "Windows PowerSploit GPP Discovery has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -44,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 56, severity_id = 0, - rule = {"name": "Windows PowerSploit GPP Discovery", "uid": "fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows PowerSploit GPP Discovery", "uid": "fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index 28ce73517e..a10ab76821 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -5,28 +5,19 @@ description: The following analytic identifies the Windows Windows Remote Auto D rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="rasautou.exe" AND match_regex(process_cmd_line, - /(?i)-p /)=true AND match_regex(process_cmd_line, /(?i)-d /)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="rasautou.exe" + AND match_regex(process_cmd_line, /(?i)-p /)=true AND match_regex(process_cmd_line, + /(?i)-d /)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rasautou DLL Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows Rasautou DLL Execution", "uid": "6f42b8ce-1e15-11ec-ad5a-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rasautou DLL Execution", "uid": "6f42b8ce-1e15-11ec-ad5a-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index ca4d697b03..4a5cb5074e 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -5,29 +5,19 @@ description: The following analytic identifies AccCheckConsole.exe which is a na living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="acccheckconsole.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path", "uid": "c842931e-661f-42bc-a4df-0460d93cfb69", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path", "uid": "c842931e-661f-42bc-a4df-0460d93cfb69", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 5391fa8a62..01d1fcd8e8 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -5,28 +5,19 @@ description: The following analytic identifies adplus.exe which is a native livi off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="adplus.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="adplus.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path", "uid": "ecaaf956-c516-4980-b08e-8c01c19614ca", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path", "uid": "ecaaf956-c516-4980-b08e-8c01c19614ca", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index 5f6ed8e0e6..cf08319b30 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -5,28 +5,18 @@ description: The following analytic identifies Advpack.dll which is a native liv off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="advpack.dll" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="advpack.dll" + AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path", "uid": "3284e4f4-67f7-49b6-ad5e-a8fcead2eef8", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path", "uid": "3284e4f4-67f7-49b6-ad5e-a8fcead2eef8", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index ed30b0097a..44237257b6 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -5,28 +5,18 @@ description: The following analytic identifies AgentExecutor.exe which is a nati living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="agentexecutor.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path", "uid": "e124f71f-11bc-47e4-9931-6046d256005d", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path", "uid": "e124f71f-11bc-47e4-9931-6046d256005d", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index b24c8b9483..c62a22554f 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -5,29 +5,19 @@ description: The following analytic identifies AppInstaller.exe which is a nativ living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="appinstaller.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path", "uid": "057c06c7-ef31-4749-b5c9-199152e53a06", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path", "uid": "057c06c7-ef31-4749-b5c9-199152e53a06", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 6fbc7ba587..94e3af2f34 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -5,28 +5,19 @@ description: The following analytic identifies Appvlp.exe which is a native livi off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="appvlp.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path", "uid": "93862a89-abe0-4094-909a-08ec390aa5e3", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path", "uid": "93862a89-abe0-4094-909a-08ec390aa5e3", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index 2a60d7deb9..260b51a3e3 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -5,28 +5,19 @@ description: The following analytic identifies Aspnet_Compiler.exe which is a na living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="aspnet_compiler.exe" + AND (NOT match_regex(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path", "uid": "d75cc561-3828-4d0a-92c4-0eb93bfe0929", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path", "uid": "d75cc561-3828-4d0a-92c4-0eb93bfe0929", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 36dd7eb6e2..b787c9dcfe 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -5,28 +5,18 @@ description: The following analytic identifies At.exe which is a native living o the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="at.exe" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="at.exe" AND + (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities At exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities At exe LOLBAS in Non Standard Path", "uid": "6401d583-0052-4dc5-a713-68b510826d2b", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities At exe LOLBAS in Non Standard Path", "uid": "6401d583-0052-4dc5-a713-68b510826d2b", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 59ba21340c..5aa120d6d9 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -5,28 +5,18 @@ description: The following analytic identifies Atbroker.exe which is a native li off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="atbroker.exe" + AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path", "uid": "b8da7ea5-8c16-4eff-9787-54ec271159e0", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path", "uid": "b8da7ea5-8c16-4eff-9787-54ec271159e0", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index b345a46259..deb2cd7983 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -4,28 +4,19 @@ version: 5 description: The following analytic identifies memory dumping using comsvcs.dll with the minidump function with `rundll32.exe`. This technique is common with adversaries who would like to dump the memory of lsass.exe. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe") - AND match_regex(process_cmd_line, /(?i)comsvcs.dll/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)minidump/)=true AND process_file_name="rundll32.exe") AND match_regex(process_cmd_line, + /(?i)comsvcs.dll/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rundll32 Comsvcs Memory Dump has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 40, severity_id = 0, - rule = {"name": "Windows Rundll32 Comsvcs Memory Dump", "uid": "76bb9e35-f314-4c3d-a385-83c72a13ce4e", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rundll32 Comsvcs Memory Dump", "uid": "76bb9e35-f314-4c3d-a385-83c72a13ce4e", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: You must be ingesting endpoint data that tracks process activity, diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index 1db12030de..f4a5e2e9d8 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -8,28 +8,19 @@ description: The following analytic identifies "rundll32.exe" execution with inl The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") - OR like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%about%" + OR process_cmd_line LIKE "%javascript%" OR process_cmd_line LIKE "%vbscript%") AND + process_file_name="rundll32.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rundll32 Inline HTA Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 56, severity_id = 0, - rule = {"name": "Windows Rundll32 Inline HTA Execution", "uid": "0caa1dd6-94f5-11ec-9786-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rundll32 Inline HTA Execution", "uid": "0caa1dd6-94f5-11ec-9786-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index f6ac421f3c..5492299cdf 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -7,29 +7,19 @@ description: This analytic is to detect a suspicious child process of MSBuild sp malicious script in the compromised host. During triage, review parallel processes and identify any file modifications. MSBuild may load a script from the same path without having command-line arguments. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, - /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" + AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, + /(?i)wscript.exe/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Script Host Spawn MSBuild has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows Script Host Spawn MSBuild", "uid": "92886f1c-9b11-11ec-848a-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Script Host Spawn MSBuild", "uid": "92886f1c-9b11-11ec-848a-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 05808e34a7..a0490d23e7 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -7,28 +7,18 @@ description: The following analytic identifies the decompile parameter with the script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%-decompile%" + AND process_file_name="hh.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows System Binary Proxy Execution Compiled HTML File Decompile has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -48,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 90, severity_id = 0, - rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File Decompile", "uid": "11c32b19-05a6-48a8-ab28-18dbd9ec5d50", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File Decompile", "uid": "11c32b19-05a6-48a8-ab28-18dbd9ec5d50", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 1a106206f9..c89385f259 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -12,28 +12,18 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="hh.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="hh.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows System Binary Proxy Execution Compiled HTML File URL In Command Line has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -53,11 +43,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 90, severity_id = 0, - rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File URL In Command Line", "uid": "0fec631a-7c9b-4e4c-b28b-93260953e25f", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File URL In Command Line", "uid": "0fec631a-7c9b-4e4c-b28b-93260953e25f", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index 452cc9a74f..5990a065c7 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -15,28 +15,18 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line, - "%its:%")) AND process_file_name="hh.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%mk:@MSITStore:%" + OR process_cmd_line LIKE "%its:%") AND process_file_name="hh.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -56,11 +46,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 72, severity_id = 0, - rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers", "uid": "ba0c2450-caea-4086-ac3a-a71e2659754b", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers", "uid": "ba0c2450-caea-4086-ac3a-a71e2659754b", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index f2e0ef948f..fc5846db7f 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -4,28 +4,18 @@ version: 1 description: The following analytic identifies the usage of msiexec.exe using the /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. Upon triage, review parent process and capture any artifacts for further review. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %")) - AND process_file_name="msiexec.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-y %" + OR process_cmd_line LIKE "%/y %") AND process_file_name="msiexec.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows System Binary Proxy Execution MSIExec DLLRegisterServer has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Windows System Binary Proxy Execution MSIExec DLLRegisterServer", "uid": "8d1d5570-722c-49a3-996c-2e2cceef5163", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows System Binary Proxy Execution MSIExec DLLRegisterServer", "uid": "8d1d5570-722c-49a3-996c-2e2cceef5163", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 92e1a8c8b3..8a4d2f28dc 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -4,28 +4,18 @@ version: 1 description: The following analytic identifies msiexec.exe with http in the command-line. This procedure will utilize msiexec.exe to download a remote file and load it. During triage, review parallel processes and capture any artifacts on disk for review. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="msiexec.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="msiexec.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows System Binary Proxy Execution MSIExec Remote Download has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Windows System Binary Proxy Execution MSIExec Remote Download", "uid": "92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows System Binary Proxy Execution MSIExec Remote Download", "uid": "92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index 14a73b3351..7f191cc80e 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -4,28 +4,18 @@ version: 1 description: The following analytic identifies the usage of msiexec.exe using the /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. Upon triage, review parent process and capture any artifacts for further review. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %")) - AND process_file_name="msiexec.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-z %" + OR process_cmd_line LIKE "%/z %") AND process_file_name="msiexec.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows System Binary Proxy Execution MSIExec Unregister DLL has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Windows System Binary Proxy Execution MSIExec Unregister DLL", "uid": "df76a8d1-92e1-4ec9-b8f7-695b5838703e", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows System Binary Proxy Execution MSIExec Unregister DLL", "uid": "df76a8d1-92e1-4ec9-b8f7-695b5838703e", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index e6b3ecf4b2..8968530a9a 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -8,28 +8,18 @@ description: The following analytic identifies wmiprvse.exe spawning msbuild.exe In a malicious instance, MSBuild.exe will spawn from non-standard processes and have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should be investigated. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, - /(?i)wmiprvse.exe/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" + AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows WMIPrvse Spawn MSBuild has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows WMIPrvse Spawn MSBuild", "uid": "76b3b290-9b31-11ec-a934-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows WMIPrvse Spawn MSBuild", "uid": "76b3b290-9b31-11ec-a934-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index b5b2ebfeda..f33f51c751 100644 --- a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -17,8 +17,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="WinRAR.exe" - OR like(process_file_name, "7z%") OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, - "%powershell.exe") OR like(actor_process_file_name, "%cmd.exe")) --finding_report--' + OR process_file_name LIKE "7z%" OR process_file_name LIKE "winzip%") AND (actor_process_file_name + LIKE "%powershell.exe" OR actor_process_file_name LIKE "%cmd.exe") --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml index cb2b668a3f..c3c7cd2217 100644 --- a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml @@ -12,25 +12,15 @@ description: The following analytic identifies Windows Service Control, `sc.exe` services to continue there objective and evade detections. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="sc.exe" AND + process_cmd_line LIKE "%delete%" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml index 358274fd08..60d0bb5063 100644 --- a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml @@ -12,25 +12,15 @@ description: The following analytic identifies Windows Service Control, `sc.exe` services to continue there objective and evade detections. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") - AND process_file_name="sc.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%config%" + AND process_cmd_line LIKE "%disabled%" AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 8c03c1170b..0c816a5a0a 100644 --- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -10,29 +10,19 @@ description: The following analytic identifies the use of `reg.exe` attempting t this technique to capture and perform offline password cracking. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true - OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, - /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true - OR match_regex(process_cmd_line, /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, - /(?i)save/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="reg.exe" OR + process_file_name="cmd.exe") AND (match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true + OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(process_cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\System/)=true + OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(process_cmd_line, + /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, /(?i)save/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml index 10067381ed..648dc87fc4 100644 --- a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml +++ b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml @@ -10,25 +10,16 @@ description: This search looks for flags passed to bcdedit.exe modifications to to prevent recovery. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") - AND like(process_cmd_line, "%recoveryenabled%")) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="bcdedit.exe" + AND (process_cmd_line LIKE "%no%" AND process_cmd_line LIKE "%recoveryenabled%") + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml index 4d6abb2fb4..082417f901 100644 --- a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -10,25 +10,15 @@ description: this search is to detect execution of `cipher.exe` to clear the una impossible to forensically recover deleted files. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="cipher.exe" + AND process_cmd_line LIKE "%/W:%" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/ssa_detections/endpoint/ssa___delete_a_net_user.yml b/ssa_detections/endpoint/ssa___delete_a_net_user.yml index 0b7efb37b6..0c92f19069 100644 --- a/ssa_detections/endpoint/ssa___delete_a_net_user.yml +++ b/ssa_detections/endpoint/ssa___delete_a_net_user.yml @@ -13,25 +13,16 @@ description: This analytic will detect a suspicious net.exe/net1.exe command-lin any other user accounts created before or after. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") - AND (process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%" + AND process_cmd_line LIKE "%/delete%" AND (process_file_name="net.exe" OR process_file_name="net1.exe") + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index bd18dc381d..b04c82576e 100644 --- a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -11,26 +11,16 @@ description: The following analytic identifies the use of `cacls.exe`, `icacls.e adversary files on disk. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" - OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + /(?i)deny/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 5b8c1e4f57..5e7e5f32b3 100644 --- a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -11,31 +11,21 @@ description: The following analytic identifies parent processes, browsers, Windo need to be tuned to further enhance the risk. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" - OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" - OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" - OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe" - OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe" - AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" - AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((actor_process_file_name="winword.exe" + OR actor_process_file_name="excel.exe" OR actor_process_file_name="outlook.exe" + OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe" + OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe" + OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe") + OR (actor_process_file_name="java.exe" AND (NOT match_regex(actor_process_file_name, + /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" AND (NOT + process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" --finding_report--' how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. diff --git a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml index 74ecbde3b8..54126b3ce8 100644 --- a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml +++ b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -14,29 +14,19 @@ description: This analytic identifies commonly used command-line arguments used investigating by review file modifications and parallel processes. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line, - "%--transfers%") OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line, - "%--ignore-existing%") OR like(process_cmd_line, "%--no-check-certificate%") OR - like(process_cmd_line, "%--progress%") OR like(process_cmd_line, "%--config%") OR - like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, - "%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%--multi-thread-streams%" + OR process_cmd_line LIKE "%--transfers%" OR process_cmd_line LIKE "%--auto-confirm%" + OR process_cmd_line LIKE "%--ignore-existing%" OR process_cmd_line LIKE "%--no-check-certificate%" + OR process_cmd_line LIKE "%--progress%" OR process_cmd_line LIKE "%--config%" OR + process_cmd_line LIKE "%ftp%" OR process_cmd_line LIKE "%pcloud%" OR process_cmd_line + LIKE "%mega%" OR process_cmd_line LIKE "%copy%") AND process_file_name="rclone.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___disable_net_user_account.yml b/ssa_detections/endpoint/ssa___disable_net_user_account.yml index 1af618919e..9ac1cb56ac 100644 --- a/ssa_detections/endpoint/ssa___disable_net_user_account.yml +++ b/ssa_detections/endpoint/ssa___disable_net_user_account.yml @@ -11,25 +11,16 @@ description: This analytic will identify a suspicious command-line that disables impact against the organization. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") - AND (process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%" + AND process_cmd_line LIKE "%/active:no%" AND (process_file_name="net.exe" OR process_file_name="net1.exe") + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml index 479110d105..42f165f747 100644 --- a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml @@ -13,26 +13,17 @@ description: This search is to detect potential DNS exfiltration using nslookup C2 DNS multiple tries. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") - OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, - "%-querytype=%")) AND process_file_name="nslookup.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-retry=%" + OR process_cmd_line LIKE "%-type=%" OR process_cmd_line LIKE "%-q=%" OR process_cmd_line + LIKE "%-qt=%" OR process_cmd_line LIKE "%-querytype=%") AND process_file_name="nslookup.exe" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml index f4c6e3fa0d..d16c8727c3 100644 --- a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml +++ b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml @@ -10,25 +10,15 @@ description: This search is to detect a suspicious fsutil process to zeroing a t malware path as part of its defense evasion after encrypting the compromised host. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%setzerodata%" + AND process_file_name="fsutil.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index aec2f7bbb0..021a4a0d0a 100644 --- a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -11,26 +11,16 @@ description: The following analytic identifies the use of `cacls.exe`, `icacls.e responders to review or gaining access to adversary files on disk. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" - OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + /(?i)grant/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml index 559e5078c7..d701cedbc0 100644 --- a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -11,25 +11,15 @@ description: Attackers leverage an existing Windows binary, attrib.exe, to mark to hide files. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="attrib.exe" + AND match_regex(process_cmd_line, /(?i)/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 56be05c9ba..f5162ac060 100644 --- a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -13,27 +13,17 @@ description: This analytic identifies suspicious modification of ACL permission an account with no permission to do so. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, - /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND - (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, + /(?i)everyone:/)=true) AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" + OR process_file_name="cacls.exe") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml index 22fa4abe4d..434231093c 100644 --- a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml +++ b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml @@ -10,28 +10,18 @@ description: The following analytic will identify a Windows Office Product spawn usage that may spawn scripts from an Office product. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="cscript.exe" OR process_file_name="wscript.exe") - AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, - /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true - OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, - /(?i)winword.exe/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="cscript.exe" + OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true + OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, + /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true + OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true) --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml index 14e8a6f7c5..84a5006170 100644 --- a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -11,25 +11,15 @@ description: The following analytic identifies the resizing of shadowstorage usi the shadowstorage. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, - "%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%shadowstorage%" + AND process_cmd_line LIKE "%resize%" AND process_cmd_line LIKE "%maxsize%" AND process_file_name="vssadmin.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml index 0db0a277f5..60a7d419b7 100644 --- a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml +++ b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml @@ -12,35 +12,26 @@ description: This analytic will detect the execution of sdelete.exe attempting t artifact on the targeted host. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%") - OR like(process_cmd_line, "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line, - "%.zip%") OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%") - OR like(process_cmd_line, "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line, - "%.jpg%") OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%") - OR like(process_cmd_line, "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line, - "%.rtf%") OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%") - OR like(process_cmd_line, "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR - like(process_cmd_line, "%/accepteula%") OR like(process_cmd_line, "%-z %") OR like(process_cmd_line, - "%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR - like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line, - "%-c %")) AND like(process_file_name, "%sdelete%") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%.xls%" + OR process_cmd_line LIKE "%.gz%" OR process_cmd_line LIKE "%.tar%" OR process_cmd_line + LIKE "%.rar%" OR process_cmd_line LIKE "%.zip%" OR process_cmd_line LIKE "%.7z%" + OR process_cmd_line LIKE "%.bmp%" OR process_cmd_line LIKE "%.gif%" OR process_cmd_line + LIKE "%.png%" OR process_cmd_line LIKE "%.jpg%" OR process_cmd_line LIKE "%.txt%" + OR process_cmd_line LIKE "%.log%" OR process_cmd_line LIKE "%.key%" OR process_cmd_line + LIKE "%.pdf%" OR process_cmd_line LIKE "%.rtf%" OR process_cmd_line LIKE "%.ppt%" + OR process_cmd_line LIKE "%.xls%" OR process_cmd_line LIKE "%.doc%" OR process_cmd_line + LIKE "%-nobanner%" OR process_cmd_line LIKE "%/accepteula%" OR process_cmd_line + LIKE "%-z %" OR process_cmd_line LIKE "%-s %" OR process_cmd_line LIKE "%-q %" OR + process_cmd_line LIKE "%-r %" OR process_cmd_line LIKE "%-p %" OR process_cmd_line + LIKE "%-f %" OR process_cmd_line LIKE "%-c %") AND process_file_name LIKE "%sdelete%" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index 4782fdb7f9..7b8d39b06c 100644 --- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -13,45 +13,35 @@ description: An attacker tries might try to use different version of a system co and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe" - OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe" - OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe" - OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" OR process_file_name="write.exe" - OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe" - OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe" - OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" OR process_file_name="winver.exe" - OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" OR process_file_name="winresume.exe" - OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" OR process_file_name="wininit.exe" - OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe" - OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" OR process_file_name="where.exe" - OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe" - OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe" - OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe" - OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe" - OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe" - OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe" - OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe" - OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe" - OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe" - OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" OR - process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="xwizard.exe" + OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" + OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" + OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" + OR process_file_name="write.exe" OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" + OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" + OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" + OR process_file_name="winver.exe" OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" + OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" + OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" + OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" + OR process_file_name="where.exe" OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" + OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" + OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" + OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" + OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" + OR process_file_name="vds.exe" OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" + OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" + OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" + OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" + OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" + OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe" OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe" OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe" diff --git a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml index 57350b2a5f..ade37b9816 100644 --- a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml +++ b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml @@ -10,25 +10,16 @@ description: This search looks for flags passed to wbadmin.exe (Windows Backup A recovery. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%") - OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%")) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="wbadmin.exe" + AND (process_cmd_line LIKE "%systemstatebackup%" OR process_cmd_line LIKE "%catalog%" + OR process_cmd_line LIKE "%delete%") --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index e3188eeac6..70e72eda41 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -10,28 +10,18 @@ description: The wevtutil.exe application is the windows event log utility. This powershell, sysmon, or system event logs. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line, - /(?i)setup/)=true OR match_regex(process_cmd_line, /(?i)application/)=true OR match_regex(process_cmd_line, - /(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line, - /(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)powershell/)=true OR match_regex(process_cmd_line, /(?i)setup/)=true OR match_regex(process_cmd_line, + /(?i)application/)=true OR match_regex(process_cmd_line, /(?i)sysmon/)=true OR match_regex(process_cmd_line, + /(?i)system/)=true OR match_regex(process_cmd_line, /(?i)security/)=true) AND process_cmd_line + LIKE "% cl %" AND process_file_name="wevtutil.exe" --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index 8309897e63..fea74b71fd 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -10,25 +10,15 @@ description: This search is to detect execution of wevtutil.exe to disable logs. and detections in compromised host. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% - sl %") AND process_file_name="wevtutil.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%/e:false%" + AND process_cmd_line LIKE "% sl %" AND process_file_name="wevtutil.exe" --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml index 477e43b714..daf1f5e452 100644 --- a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml +++ b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml @@ -14,27 +14,18 @@ description: The following query identifies Microsoft Background Intelligent Tra identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%") - OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%") - OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%") - OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%resume%" + OR process_cmd_line LIKE "%setcustomheaders%" OR process_cmd_line LIKE "%setminretrydelay%" + OR process_cmd_line LIKE "%setnotifycmdline%" OR process_cmd_line LIKE "%setnotifyflags%" + OR process_cmd_line LIKE "%addfile%" OR process_cmd_line LIKE "%create%") AND process_file_name="bitsadmin.exe" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml index 580df7e9ec..1f081b9633 100644 --- a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml +++ b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml @@ -19,25 +19,15 @@ description: The following query identifies Microsoft Background Intelligent Tra to list out the jobs during investigation. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%transfer%" + AND process_file_name="bitsadmin.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml index 4b5caa023a..b29ebbf928 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml @@ -15,25 +15,15 @@ description: CertUtil.exe may be used to `encode` and `decode` a file, including Review its contents or execution behavior for further analysis. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%decode%" + AND process_file_name="certutil.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml index c4804364a8..021f54aab8 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml @@ -14,26 +14,16 @@ description: Certutil.exe may download a file from a remote destination using `- remote IP or domain in question. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") - AND like(process_cmd_line, "%urlcache%")) OR like(process_cmd_line, "%urlcache%") - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="certutil.exe" + AND process_cmd_line LIKE "%split%" AND process_cmd_line LIKE "%urlcache%") OR process_cmd_line + LIKE "%urlcache%" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml index be0dcadd4a..342885f6dc 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml @@ -14,26 +14,16 @@ description: 'Certutil.exe may download a file from a remote destination using ` written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. ' data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") - AND like(process_cmd_line, "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%") - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="certutil.exe" + AND process_cmd_line LIKE "%split%" AND process_cmd_line LIKE "%verifyctl%") OR + process_cmd_line LIKE "%verifyctl%" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml index 1e1801b118..c406297a5b 100644 --- a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -15,25 +15,15 @@ description: The following analytic identifies the use of reg.exe performing an the adversary's code will be executed instead. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true + AND process_file_name="reg.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index 0eef7c072c..b73a56ab71 100644 --- a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -25,27 +25,17 @@ description: 'The following analytic identifies the use of Windows Curl.exe uplo in network logs. If a file was uploaded, isolate the endpoint and review.' data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data - %") OR like(process_cmd_line, "%-d %") OR like(process_cmd_line, "%--upload-file - %") OR like(process_cmd_line, "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-F %" + OR process_cmd_line LIKE "%--data %" OR process_cmd_line LIKE "%-d %" OR process_cmd_line + LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match_regex(process_file_name, + /(?i)curl.exe/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml b/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml index 97b6acf6b2..b25cc43b1e 100644 --- a/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml +++ b/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml @@ -17,26 +17,16 @@ description: The following analytic identifies the potential edition of a defaul of the default GPOs. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="mmc.exe" AND like(process_cmd_line, "%gpme.msc%")) - OR like(process_cmd_line, "%31B2F340-016D-11D2-945F-00C04FB984F9%") OR like(process_cmd_line, - "%6AC1786C-016F-11D2-945F-00C04fB984F9%") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="mmc.exe" AND + process_cmd_line LIKE "%gpme.msc%") OR process_cmd_line LIKE "%31B2F340-016D-11D2-945F-00C04FB984F9%" + OR process_cmd_line LIKE "%6AC1786C-016F-11D2-945F-00C04fB984F9%" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml index 68f28a13d9..9db25d56d3 100644 --- a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml @@ -9,25 +9,16 @@ description: The following analytic identifies usage of the MPCmdRun utility tha can be abused by adversaries by moving it to a new directory. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, - /(?i)\\windows defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where match_regex(process_file_name, + /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, /(?i)\\windows + defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows defender\\platform/)=true) --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. diff --git a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml index ea66adef4d..c5eebba164 100644 --- a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml @@ -13,25 +13,15 @@ description: DiskShadow.exe is a Microsoft Signed binary present on Windows Serv by diskshadow. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%")) - AND process_file_name="diskshadow.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%/s%" OR + process_cmd_line LIKE "%-S%") AND process_file_name="diskshadow.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml index 6ef87c5781..1cb6c75f94 100644 --- a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -13,48 +13,39 @@ description: The following analytic identifies native .net binaries within the W captured in the list. Lookup - https://github.com/splunk/security_content/blob/develop/lookups/is_net_windows_file.csv. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, - /(?i)comsvcconfig.exe/)=true OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true - OR match_regex(process_file_name, /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, - /(?i)microsoft.workflow.compiler.exe/)=true OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true - OR match_regex(process_file_name, /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name, - /(?i)addinprocess.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true - OR match_regex(process_file_name, /(?i)addinutil.exe/)=true OR match_regex(process_file_name, - /(?i)aspnet_compiler.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true - OR match_regex(process_file_name, /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name, - /(?i)caspol.exe/)=true OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true - OR match_regex(process_file_name, /(?i)edmgen.exe/)=true OR match_regex(process_file_name, - /(?i)installutil.exe/)=true OR match_regex(process_file_name, /(?i)jsc.exe/)=true - OR match_regex(process_file_name, /(?i)ngentask.exe/)=true OR match_regex(process_file_name, - /(?i)regasm.exe/)=true OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true - OR match_regex(process_file_name, /(?i)sdnbr.exe/)=true OR match_regex(process_file_name, - /(?i)acu.exe/)=true OR match_regex(process_file_name, /(?i)appvstreamingux.exe/)=true - OR match_regex(process_file_name, /(?i)dsac.exe/)=true OR match_regex(process_file_name, - /(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.uev.synccontroller.exe/)=true - OR match_regex(process_file_name, /(?i)mtedit.exe/)=true OR match_regex(process_file_name, - /(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, /(?i)servermanager.exe/)=true - OR match_regex(process_file_name, /(?i)stordiag.exe/)=true OR match_regex(process_file_name, - /(?i)tzsync.exe/)=true OR match_regex(process_file_name, /(?i)uevagentpolicygenerator.exe/)=true - OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true OR match_regex(process_file_name, - /(?i)uevtemplatebaselinegenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true - OR match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name, +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_file_name, + /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, /(?i)comsvcconfig.exe/)=true + OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true OR match_regex(process_file_name, + /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.workflow.compiler.exe/)=true + OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true OR match_regex(process_file_name, + /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess.exe/)=true + OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true OR match_regex(process_file_name, + /(?i)addinutil.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_compiler.exe/)=true + OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true OR match_regex(process_file_name, + /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name, /(?i)caspol.exe/)=true + OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true OR match_regex(process_file_name, + /(?i)edmgen.exe/)=true OR match_regex(process_file_name, /(?i)installutil.exe/)=true + OR match_regex(process_file_name, /(?i)jsc.exe/)=true OR match_regex(process_file_name, + /(?i)ngentask.exe/)=true OR match_regex(process_file_name, /(?i)regasm.exe/)=true + OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true OR match_regex(process_file_name, + /(?i)sdnbr.exe/)=true OR match_regex(process_file_name, /(?i)acu.exe/)=true OR match_regex(process_file_name, + /(?i)appvstreamingux.exe/)=true OR match_regex(process_file_name, /(?i)dsac.exe/)=true + OR match_regex(process_file_name, /(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, + /(?i)microsoft.uev.synccontroller.exe/)=true OR match_regex(process_file_name, /(?i)mtedit.exe/)=true + OR match_regex(process_file_name, /(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, + /(?i)servermanager.exe/)=true OR match_regex(process_file_name, /(?i)stordiag.exe/)=true + OR match_regex(process_file_name, /(?i)tzsync.exe/)=true OR match_regex(process_file_name, + /(?i)uevagentpolicygenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true + OR match_regex(process_file_name, /(?i)uevtemplatebaselinegenerator.exe/)=true OR + match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true OR + match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name, /(?i)iediagcmd.exe/)=true OR match_regex(process_file_name, /(?i)xbox.tcui.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true OR match_regex(process_file_name, /(?i)iisual.exe/)=true OR match_regex(process_file_name, diff --git a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml index 54989536c3..a3f7a5035e 100644 --- a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml +++ b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml @@ -29,20 +29,13 @@ description: 'The following analytic identifies the usage of Exchange PowerShell mail contacts, and distribution groups).' data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)get-recipient/)=true OR match_regex(process_cmd_line, /(?i)new-mailboxsearch/)=true - OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true OR match_regex(process_cmd_line, - /(?i)new-mailboxexportrequest/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line, + /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true + OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml index 4e22c110a1..07f0d4b0df 100644 --- a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -12,26 +12,16 @@ description: The following analytic identifies a recently disclosed arbitraty co process execution that may be related, including an Office Product. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, - "%ms-msdt:-id%") OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, - "%ms-msdt:%") OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%ms-msdt:/id%" + OR process_cmd_line LIKE "%ms-msdt:-id%" OR process_cmd_line LIKE "%ms-msdt:/id%" + OR process_cmd_line LIKE "%ms-msdt:%" OR process_cmd_line LIKE "%msdt%") AND process_file_name="msdt.exe") AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line, /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true --finding_report--' diff --git a/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml index 9fc3a90784..c1efe0a14a 100644 --- a/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml +++ b/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml @@ -14,18 +14,11 @@ description: The following analytic identifies the use of the Invoke-ShareFinder or Lateral Movement. data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)invoke-sharefinder/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)invoke-sharefinder/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml b/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml index 9a807b25d7..3990d363b0 100644 --- a/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml +++ b/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml @@ -15,25 +15,15 @@ description: The following analytic identifies the use of the findstr command em existing Group Policy Preferences files with passwords are not removed from SYSVOL. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="findstr.exe" AND like(process_cmd_line, "%cpassword%") - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="findstr.exe" + AND process_cmd_line LIKE "%cpassword%" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml index 19b0ead9d5..bd290f26df 100644 --- a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -15,25 +15,15 @@ description: The following analytic identifies the Windows Explorer process with is not commonly used to open an URL. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="explorer.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="explorer.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml b/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml index 7250c821d4..5ff0ea5241 100644 --- a/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml +++ b/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml @@ -10,25 +10,16 @@ description: This analytic identifies the use of RemCom.exe - The open source ps remotely. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%/user:%") OR like(process_cmd_line, "%/pwd:%") - OR like(process_cmd_line, "%\\%")) AND process_file_name="remcom.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%/user:%" + OR process_cmd_line LIKE "%/pwd:%" OR process_cmd_line LIKE "%\\%") AND process_file_name="remcom.exe" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml index 54af1e4cce..007bd8d679 100644 --- a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -12,36 +12,27 @@ description: The following analytic identifies native living off the land binari regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" - OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe" - OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe" - OR process_file_name="control.exe" OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe" - OR process_file_name="desktopimgdownldr.exe" OR process_file_name="dfsvc.exe" OR - process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" OR process_file_name="dllhost.exe" - OR process_file_name="dnscmd.exe" OR process_file_name="esentutl.exe" OR process_file_name="eventvwr.exe" - OR process_file_name="expand.exe" OR process_file_name="extexport.exe" OR process_file_name="extrac32.exe" - OR process_file_name="findstr.exe" OR process_file_name="finger.exe" OR process_file_name="fltmc.exe" - OR process_file_name="forfiles.exe" OR process_file_name="ftp.exe" OR process_file_name="gfxdownloadwrapper.exe" - OR process_file_name="gpscript.exe" OR process_file_name="imewdbld.exe" OR process_file_name="ie4uinit.exe" - OR process_file_name="ieexec.exe" OR process_file_name="ilasm.exe" OR process_file_name="infdefaultinstall.exe" - OR process_file_name="makecab.exe" OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="bitsadmin.exe" + OR process_file_name="certoc.exe" OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" + OR process_file_name="cmdkey.exe" OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" + OR process_file_name="configsecuritypolicy.exe" OR process_file_name="control.exe" + OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe" OR process_file_name="desktopimgdownldr.exe" + OR process_file_name="dfsvc.exe" OR process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" + OR process_file_name="dllhost.exe" OR process_file_name="dnscmd.exe" OR process_file_name="esentutl.exe" + OR process_file_name="eventvwr.exe" OR process_file_name="expand.exe" OR process_file_name="extexport.exe" + OR process_file_name="extrac32.exe" OR process_file_name="findstr.exe" OR process_file_name="finger.exe" + OR process_file_name="fltmc.exe" OR process_file_name="forfiles.exe" OR process_file_name="ftp.exe" + OR process_file_name="gfxdownloadwrapper.exe" OR process_file_name="gpscript.exe" + OR process_file_name="imewdbld.exe" OR process_file_name="ie4uinit.exe" OR process_file_name="ieexec.exe" + OR process_file_name="ilasm.exe" OR process_file_name="infdefaultinstall.exe" OR + process_file_name="makecab.exe" OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="mmc.exe" OR process_file_name="msconfig.exe" OR process_file_name="msdt.exe" OR process_file_name="mshta.exe" OR process_file_name="msiexec.exe" OR process_file_name="netsh.exe" OR process_file_name="odbcconf.exe" OR process_file_name="offlinescannershell.exe" diff --git a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml index f37120c357..27226312ef 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml @@ -11,28 +11,19 @@ description: The following analytic identifies child processes spawning from "m "mshta.exe" and its child process. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="wscript.exe" OR process_file_name="cscript.exe" - OR process_file_name="searchprotocolhost.exe" OR process_file_name="microsoft.workflow.compiler.exe" - OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" - OR process_file_name="cmd.exe" OR process_file_name="powershell.exe") AND like(actor_process_file_name, - "%mshta.exe") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="wscript.exe" + OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe" + OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe" + OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe" + OR process_file_name="powershell.exe") AND actor_process_file_name LIKE "%mshta.exe" + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml index 05cf77767c..aca5330bd7 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml @@ -14,25 +14,15 @@ description: This analytic identifies when Microsoft HTML Application Host (msht as well as the target system, the user, process "rundll32.exe" and its parent process. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="mshta.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="mshta.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml index 596fb1de8c..5a5bee65d3 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml @@ -12,25 +12,16 @@ description: The following analytic identifies "mshta.exe" execution with inline as well as the target system, the user, process "mshta.exe" and its parent process. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") - OR like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%about%" + OR process_cmd_line LIKE "%javascript%" OR process_cmd_line LIKE "%vbscript%") AND + process_file_name="mshta.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml index cf48c2debf..7922777483 100644 --- a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml +++ b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml @@ -12,25 +12,16 @@ description: The following analytic identifies the odbcconf.exe, Windows Open Da During triage, review file modifications and parallel processes. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %")) - AND process_file_name="odbcconf.exe") AND like(process_cmd_line, "%.rsp%") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%/f %" + OR process_cmd_line LIKE "%-f %") AND process_file_name="odbcconf.exe") AND process_cmd_line + LIKE "%.rsp%" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 0f995ae31b..ab807767f5 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -18,25 +18,15 @@ description: 'Monitor for signs that Ntdsutil is being used to Extract Active Di will yield a file modification named ntds.dit to the destination.' data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%") - AND like(process_cmd_line, "%ntds%")) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="ntdsutil.exe" + AND (process_cmd_line LIKE "%create%" AND process_cmd_line LIKE "%ntds%") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -48,11 +38,13 @@ references: - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ tags: analytic_story: - Credential Dumping - HAFNIUM Group - Living Off The Land + - Volt Typhoon asset_type: Endpoint confidence: 50 impact: 100 diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml index 29f8863b1b..d4ba5ce686 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml @@ -17,26 +17,16 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo into lsass.exe.' data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm - %")) AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe")) - AND like(process_cmd_line, "%lsass%") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%-ma %" + OR process_cmd_line LIKE "%-mm %") AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe")) + AND process_cmd_line LIKE "%lsass%" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index fcdadc10e5..3d0a855c61 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -16,27 +16,17 @@ description: The following hunting analytic identifies PowerShell commands utili the hyphen. We have added endash, emdash, horizontal bar, and forward slash. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" + OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index d161cbe9ff..f56ba45e87 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -15,18 +15,12 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev their passwords offline. data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where like(process_cmd_line, - "%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where process_cmd_line LIKE "%4194304%" AND match_regex(process_cmd_line, /(?i)get-aduser/)=true + --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index 55afcb9a07..a3da967bc8 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -15,19 +15,12 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev and attempt to crack their passwords offline. data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, /(?i)get-domainuser/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, + /(?i)get-domainuser/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml index 22cfaf36b6..6bf321e9a0 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml @@ -12,27 +12,17 @@ description: The following analytic identifies the use of PowerShell downloading transaction logs are available, review for further details of the implant. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)downloadfile/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" + OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + /(?i)downloadfile/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml index 3e2c96fb12..7d4390f1d4 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml @@ -11,18 +11,11 @@ description: The following analytic identifies the PowerShell Cmdlet export-cert Store. data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)export-certificate/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)export-certificate/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml index c375c6604d..f4a7e2b33e 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml @@ -11,18 +11,11 @@ description: The following analytic identifies the PowerShell Cmdlet export-pfxc Store. data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)export-pfxcertificate/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)export-pfxcertificate/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml index bbd6c30d1f..7d5b4a4e21 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -14,27 +14,17 @@ description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Si domain or IP, what is the reputation? data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)start-bitstransfer/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" + OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + /(?i)start-bitstransfer/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml b/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml index 7c904bfeaa..4f7d937a0d 100644 --- a/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml +++ b/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml @@ -16,18 +16,11 @@ description: The following analytic identifies the use of the Get-GPPPassword Po are not removed from SYSVOL. data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)get-gpppassword/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)get-gpppassword/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml index a8765ced9b..fab57125a0 100644 --- a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -11,25 +11,16 @@ description: The following analytic identifies the Windows Windows Remote Auto D parent and child process behavior including file and image loads. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="rasautou.exe" AND match_regex(process_cmd_line, - /(?i)-p /)=true AND match_regex(process_cmd_line, /(?i)-d /)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="rasautou.exe" + AND match_regex(process_cmd_line, /(?i)-p /)=true AND match_regex(process_cmd_line, + /(?i)-d /)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml index e60d1050f1..6002889d2d 100644 --- a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml +++ b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml @@ -11,25 +11,16 @@ description: This analytic identifies an endpoint that remotely connects to anot with all the resulting service information. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)create/)=true OR match_regex(process_cmd_line, - /(?i)\\\\/)=true) AND process_file_name="sc.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)create/)=true OR match_regex(process_cmd_line, /(?i)\\\\/)=true) AND process_file_name="sc.exe" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index a7fb7fcc2f..2f7f6fc4d5 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,15 @@ description: The following analytic identifies AccCheckConsole.exe which is a na was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="acccheckconsole.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index a25578275c..95c9c571aa 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,16 @@ description: The following analytic identifies adplus.exe which is a native livi was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="adplus.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="adplus.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) + --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index 4ece03abc5..e3f7d60f8b 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -11,25 +11,15 @@ description: The following analytic identifies Advpack.dll which is a native liv was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="advpack.dll" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="advpack.dll" + AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index e501a1e021..a8af25142f 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,15 @@ description: The following analytic identifies AgentExecutor.exe which is a nati was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="agentexecutor.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index ae25453e47..1f1f8446fc 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,15 @@ description: The following analytic identifies AppInstaller.exe which is a nativ was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="appinstaller.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 6f8496d0b7..c13db65c31 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,16 @@ description: The following analytic identifies Appvlp.exe which is a native livi was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="appvlp.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) + --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index 518186bc0a..a57ca72320 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,16 @@ description: The following analytic identifies Aspnet_Compiler.exe which is a na was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="aspnet_compiler.exe" + AND (NOT match_regex(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) + --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 065beffafe..58cb8ce16a 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,15 @@ description: The following analytic identifies At.exe which is a native living o derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="at.exe" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="at.exe" AND + (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index d8061c5c35..ce2726da1a 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,15 @@ description: The following analytic identifies Atbroker.exe which is a native li was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="atbroker.exe" + AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml index 41d78ec4ab..f888aa997b 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -10,25 +10,16 @@ description: The following analytic identifies memory dumping using comsvcs.dll who would like to dump the memory of lsass.exe. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe") - AND match_regex(process_cmd_line, /(?i)comsvcs.dll/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)minidump/)=true AND process_file_name="rundll32.exe") AND match_regex(process_cmd_line, + /(?i)comsvcs.dll/)=true --finding_report--' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml index 2de0b7b3aa..2ed5d482c2 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml @@ -14,25 +14,16 @@ description: The following analytic identifies "rundll32.exe" execution with inl "rundll32.exe" and its parent process. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") - OR like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%about%" + OR process_cmd_line LIKE "%javascript%" OR process_cmd_line LIKE "%vbscript%") AND + process_file_name="rundll32.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml index b169c9e05b..cdb9b2a5da 100644 --- a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml @@ -13,26 +13,16 @@ description: This analytic is to detect a suspicious child process of MSBuild sp without having command-line arguments. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, - /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" + AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, + /(?i)wscript.exe/)=true) --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml index 6f347bc2a4..0e8bfb1854 100644 --- a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml +++ b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml @@ -16,24 +16,15 @@ description: The following analytic detects potential RDP Hijacking attempts by mitigating potential risks and impacts on targeted systems. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%/dest:rdp-tcp%") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where match_regex(process_cmd_line, /(?i)/dest:rdp-tcp/)=true + AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index bcc100d5c2..7c104da311 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -13,25 +13,15 @@ description: The following analytic identifies the decompile parameter with the the next stage. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%-decompile%" + AND process_file_name="hh.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 49ac3c20a6..8fe198cecf 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -18,25 +18,15 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="hh.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="hh.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index abd8a1442d..5070b3336c 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -21,25 +21,15 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a C:\Windows\syswow64. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line, - "%its:%")) AND process_file_name="hh.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%mk:@MSITStore:%" + OR process_cmd_line LIKE "%its:%") AND process_file_name="hh.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index c314f2f25d..7b90b0f9f5 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -10,25 +10,15 @@ description: The following analytic identifies the usage of msiexec.exe using th Upon triage, review parent process and capture any artifacts for further review. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %")) - AND process_file_name="msiexec.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-y %" + OR process_cmd_line LIKE "%/y %") AND process_file_name="msiexec.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index a4494465de..60829a59b0 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -10,25 +10,15 @@ description: The following analytic identifies msiexec.exe with http in the comm triage, review parallel processes and capture any artifacts on disk for review. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="msiexec.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="msiexec.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index e13bc11735..d63f023d28 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -10,25 +10,15 @@ description: The following analytic identifies the usage of msiexec.exe using th Upon triage, review parent process and capture any artifacts for further review. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %")) - AND process_file_name="msiexec.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-z %" + OR process_cmd_line LIKE "%/z %") AND process_file_name="msiexec.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml index 7d6d33ddad..cc5fd105fd 100644 --- a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -14,25 +14,15 @@ description: The following analytic identifies wmiprvse.exe spawning msbuild.exe powershell.exe is far less common and should be investigated. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, - /(?i)wmiprvse.exe/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" + AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, From da3d925adf3e3fab5b5902b1d48e6b75c3e077c5 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 9 Aug 2023 14:11:24 +0200 Subject: [PATCH 04/14] converted detections to SPL2 --- .../adapter/finding_report_writer.py | 1 - .../adapter/templates/finding_report.j2 | 4 +- .../builder/backend_splunk_ba.py | 2 +- .../srs/ssa___attempt_to_delete_services.yml | 2 +- ...dential_dump_from_registry_via_reg_exe.yml | 10 +-- ...___deny_permission_using_cacls_utility.yml | 2 +- ...ohibited_applications_spawning_cmd_exe.yml | 6 +- .../srs/ssa___disable_net_user_account.yml | 2 +- ...__grant_permission_using_cacls_utility.yml | 2 +- ..._files_and_directories_with_attrib_exe.yml | 2 +- ...fy_acls_permission_of_files_or_folders.yml | 8 +-- ...e_product_spawning_windows_script_host.yml | 8 +-- .../ssa___sdelete_application_execution.yml | 2 +- ...ocess_running_from_unexpected_location.yml | 4 +- .../ssa___wevtutil_usage_to_clear_logs.yml | 10 +-- .../ssa___windows_bits_job_persistence.yml | 2 +- .../ssa___windows_bitsadmin_download_file.yml | 2 +- ..._hijacking_inprocserver32_modification.yml | 4 +- ...dows_curl_upload_to_remote_destination.yml | 2 +- ...ws_defender_tools_in_non_standard_path.yml | 7 +- ...ows_dotnet_binary_in_non_standard_path.yml | 67 +++++++++---------- ...ndows_exchange_powershell_module_usage.yml | 10 +-- ...s_execute_arbitrary_commands_with_msdt.yml | 6 +- ...ws_file_share_discovery_with_powerview.yml | 6 +- ...ows_lolbin_binary_in_non_standard_path.yml | 10 +-- ...connect_to_internet_with_hidden_window.yml | 2 +- ...re_authentication_discovery_get_aduser.yml | 6 +- ...uthentication_discovery_with_powerview.yml | 6 +- .../ssa___windows_powershell_downloadfile.yml | 2 +- ..._windows_powershell_start_bitstransfer.yml | 4 +- ...sa___windows_powersploit_gpp_discovery.yml | 6 +- .../ssa___windows_rasautou_dll_execution.yml | 4 +- ...onsole_exe_lolbas_in_non_standard_path.yml | 2 +- ...adplus_exe_lolbas_in_non_standard_path.yml | 2 +- ...dvpack_dll_lolbas_in_non_standard_path.yml | 2 +- ...ecutor_exe_lolbas_in_non_standard_path.yml | 2 +- ...taller_exe_lolbas_in_non_standard_path.yml | 2 +- ...appvlp_exe_lolbas_in_non_standard_path.yml | 2 +- ...mpiler_exe_lolbas_in_non_standard_path.yml | 2 +- ...ies_at_exe_lolbas_in_non_standard_path.yml | 2 +- ...broker_exe_lolbas_in_non_standard_path.yml | 2 +- ...__windows_rundll32_comsvcs_memory_dump.yml | 6 +- ...sa___windows_script_host_spawn_msbuild.yml | 2 +- .../ssa___windows_wmiprvse_spawn_msbuild.yml | 2 +- ...dential_dump_from_registry_via_reg_exe.yml | 10 +-- ...___deny_permission_using_cacls_utility.yml | 2 +- ...ohibited_applications_spawning_cmd_exe.yml | 6 +- ...__grant_permission_using_cacls_utility.yml | 2 +- ..._files_and_directories_with_attrib_exe.yml | 2 +- ...fy_acls_permission_of_files_or_folders.yml | 8 +-- ...e_product_spawning_windows_script_host.yml | 8 +-- ...ocess_running_from_unexpected_location.yml | 4 +- .../ssa___wevtutil_usage_to_clear_logs.yml | 10 +-- ..._hijacking_inprocserver32_modification.yml | 2 +- ...dows_curl_upload_to_remote_destination.yml | 2 +- ...ws_defender_tools_in_non_standard_path.yml | 7 +- ...ows_dotnet_binary_in_non_standard_path.yml | 67 +++++++++---------- ...ndows_exchange_powershell_module_usage.yml | 6 +- ...s_execute_arbitrary_commands_with_msdt.yml | 6 +- ...ws_file_share_discovery_with_powerview.yml | 2 +- ...ows_lolbin_binary_in_non_standard_path.yml | 10 +-- ...connect_to_internet_with_hidden_window.yml | 2 +- ...re_authentication_discovery_get_aduser.yml | 2 +- ...uthentication_discovery_with_powerview.yml | 2 +- .../ssa___windows_powershell_downloadfile.yml | 2 +- ..._windows_powershell_export_certificate.yml | 2 +- ...ndows_powershell_export_pfxcertificate.yml | 2 +- ..._windows_powershell_start_bitstransfer.yml | 2 +- ...sa___windows_powersploit_gpp_discovery.yml | 2 +- .../ssa___windows_rasautou_dll_execution.yml | 4 +- .../ssa___windows_remote_create_service.yml | 5 +- ...onsole_exe_lolbas_in_non_standard_path.yml | 2 +- ...adplus_exe_lolbas_in_non_standard_path.yml | 2 +- ...dvpack_dll_lolbas_in_non_standard_path.yml | 2 +- ...ecutor_exe_lolbas_in_non_standard_path.yml | 2 +- ...taller_exe_lolbas_in_non_standard_path.yml | 2 +- ...appvlp_exe_lolbas_in_non_standard_path.yml | 2 +- ...mpiler_exe_lolbas_in_non_standard_path.yml | 2 +- ...ies_at_exe_lolbas_in_non_standard_path.yml | 2 +- ...broker_exe_lolbas_in_non_standard_path.yml | 2 +- ...__windows_rundll32_comsvcs_memory_dump.yml | 6 +- ...sa___windows_script_host_spawn_msbuild.yml | 2 +- ...sa___windows_service_create_with_tscon.yml | 2 +- .../ssa___windows_wmiprvse_spawn_msbuild.yml | 2 +- 84 files changed, 219 insertions(+), 229 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py index adab1ed38b..9903f219c8 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py @@ -38,7 +38,6 @@ class FindingReportObject(): kill_chain_phase_str = kill_chain_phase_str + '{"phase": "' + kill_chain_phase + '", "phase_id": ' + str(detection.tags.kill_chain_phases_id[kill_chain_phase]) + "}" if not i == (len(detection.tags.kill_chain_phases_id.keys()) - 1): kill_chain_phase_str = kill_chain_phase_str + ', ' - else: i = i + 1 kill_chain_phase_str = kill_chain_phase_str + ']' detection.tags.kill_chain_phases_str = kill_chain_phase_str diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 index 88fa0d2926..feff052006 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 @@ -2,8 +2,8 @@ | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {{ detection.tags.evidence_str }}, - message = "{{ detection.name }} has been triggered on " + device_hostname + " by " + actor_user_name + ".", - users = [{"name": actor_user_name, "uid": actor_user.uid}], + message = "{{ detection.name }} has been triggered on " + device_hostname + " by " + {{ actor_user_name }} + ".", + users = [{"name": {{ actor_user_name }}, "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], analytic_stories = {{ detection.tags.analytics_story_str }}, diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index 6e7bac33b0..1333e0cc4d 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -33,7 +33,7 @@ class SplunkBABackend(TextQueryBackend): wildcard_single : ClassVar[str] = "%" add_escaped : ClassVar[str] = "\\" - re_expression : ClassVar[str] = "match_regex({field}, /(?i){regex}/)=true" + re_expression : ClassVar[str] = "match({field}, /(?i){regex}/)=true" re_escape_char : ClassVar[str] = "\\" re_escape : ClassVar[Tuple[str]] = ('"',) diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index 6f48a9783c..a15d7db969 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -29,7 +29,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 60, impact_id = 4, - kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}, ], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 0b70137bf5..f7a11a1e64 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -12,11 +12,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="reg.exe" OR - process_file_name="cmd.exe") AND (match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true - OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(process_cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\System/)=true - OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(process_cmd_line, - /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, /(?i)save/)=true + process_file_name="cmd.exe") AND (match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true + OR match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match(process_cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match(process_cmd_line, /(?i)HKLM\\System/)=true + OR match(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match(process_cmd_line, /(?i)HKLM\\Security/)=true) + AND match(process_cmd_line, /(?i)save/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index d22cdf0e33..0409bf8692 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" - OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match(process_cmd_line, /(?i)deny/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 95309eb29a..58cca50220 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -17,9 +17,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe") - OR (actor_process_file_name="java.exe" AND (NOT match_regex(actor_process_file_name, - /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" AND (NOT - process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" + OR (actor_process_file_name="java.exe" AND (NOT match(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) + OR (actor_process_file_name="chrome.exe" AND (NOT process_cmd_line="chrome-extension"))) + AND process_file_name="cmd.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index 8ce96a388c..c83e4beb96 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -29,7 +29,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 70, impact_id = 4, - kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}, {"phase": "Delivery", "phase_id": 3}, {"phase": "Installation", "phase_id": 5}, ], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}, {"phase": "Delivery", "phase_id": 3}, {"phase": "Installation", "phase_id": 5}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index efe053454f..d9955ec8f1 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" - OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match(process_cmd_line, /(?i)grant/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index f6ed4535d0..267ae722ad 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="attrib.exe" - AND match_regex(process_cmd_line, /(?i)/)=true + AND match(process_cmd_line, /(?i)/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index 614ee484b3..c65aa357c2 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -14,10 +14,10 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, - /(?i)everyone:/)=true) AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" - OR process_file_name="cacls.exe") + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)S-1-1-0:/)=true + OR match(process_cmd_line, /(?i)SYSTEM:/)=true OR match(process_cmd_line, /(?i)everyone:/)=true) + AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml index b7c405fe3b..9bc5e0595b 100644 --- a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml +++ b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml @@ -12,10 +12,10 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="cscript.exe" - OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true - OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, - /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true - OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true) + OR process_file_name="wscript.exe") AND (match(actor_process_file_name, /(?i)visio.exe/)=true + OR match(actor_process_file_name, /(?i)mspub.exe/)=true OR match(actor_process_file_name, + /(?i)powerpnt.exe/)=true OR match(actor_process_file_name, /(?i)excel.exe/)=true + OR match(actor_process_file_name, /(?i)winword.exe/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index a7ccdc0862..75dd61648b 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -40,7 +40,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 60, impact_id = 4, - kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}, ], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index 146de25876..d8a643e571 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -224,8 +224,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me OR process_file_name="axinstui.exe" OR process_file_name="autoworkplace.exe" OR process_file_name="authhost.exe" OR process_file_name="atbroker.exe" OR process_file_name="applicationframehost.exe" OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe") - AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT - match_regex(process_file_path, /(?i)\\windows\\system32/)=true) + AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT match(process_file_path, + /(?i)\\windows\\system32/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index 4600574ccf..39ed1afd93 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -11,11 +11,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)powershell/)=true OR match_regex(process_cmd_line, /(?i)setup/)=true OR match_regex(process_cmd_line, - /(?i)application/)=true OR match_regex(process_cmd_line, /(?i)sysmon/)=true OR match_regex(process_cmd_line, - /(?i)system/)=true OR match_regex(process_cmd_line, /(?i)security/)=true) AND process_cmd_line - LIKE "% cl %" AND process_file_name="wevtutil.exe" + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)powershell/)=true + OR match(process_cmd_line, /(?i)setup/)=true OR match(process_cmd_line, /(?i)application/)=true + OR match(process_cmd_line, /(?i)sysmon/)=true OR match(process_cmd_line, /(?i)system/)=true + OR match(process_cmd_line, /(?i)security/)=true) AND process_cmd_line LIKE "% cl + %" AND process_file_name="wevtutil.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index 089db07e18..49c0fe93cb 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -34,7 +34,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 70, impact_id = 4, - kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, ], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index aa092d4b52..ba36c8d543 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -36,7 +36,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 70, impact_id = 4, - kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}, ], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml index 713d4695a6..800a1bf3e2 100644 --- a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -16,7 +16,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true + | eval device_hostname = device.hostname | where match(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, @@ -32,7 +32,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 80, impact_id = 5, - kill_chain = [{"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}, ], + kill_chain = [{"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 2299d662a5..5287852502 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -28,7 +28,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-F %" OR process_cmd_line LIKE "%--data %" OR process_cmd_line LIKE "%-d %" OR process_cmd_line - LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match_regex(process_file_name, + LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match(process_file_name, /(?i)curl.exe/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 78c7754fd8..7b17a812d6 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -10,10 +10,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match_regex(process_file_name, - /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, /(?i)\\windows - defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows - defender\\platform/)=true) + | eval device_hostname = device.hostname | where match(process_file_name, /(?i)mpcmdrun.exe/)=true + AND (NOT match(process_file_path, /(?i)\\windows defender/)=true) AND (NOT match(process_file_path, + /(?i)\\microsoft\\windows defender\\platform/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index b68abc926b..e4bb5c82d3 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -14,41 +14,38 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_file_name, - /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, /(?i)comsvcconfig.exe/)=true - OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true OR match_regex(process_file_name, - /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.workflow.compiler.exe/)=true - OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true OR match_regex(process_file_name, - /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess.exe/)=true - OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true OR match_regex(process_file_name, - /(?i)addinutil.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_compiler.exe/)=true - OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true OR match_regex(process_file_name, - /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name, /(?i)caspol.exe/)=true - OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true OR match_regex(process_file_name, - /(?i)edmgen.exe/)=true OR match_regex(process_file_name, /(?i)installutil.exe/)=true - OR match_regex(process_file_name, /(?i)jsc.exe/)=true OR match_regex(process_file_name, - /(?i)ngentask.exe/)=true OR match_regex(process_file_name, /(?i)regasm.exe/)=true - OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true OR match_regex(process_file_name, - /(?i)sdnbr.exe/)=true OR match_regex(process_file_name, /(?i)acu.exe/)=true OR match_regex(process_file_name, - /(?i)appvstreamingux.exe/)=true OR match_regex(process_file_name, /(?i)dsac.exe/)=true - OR match_regex(process_file_name, /(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, - /(?i)microsoft.uev.synccontroller.exe/)=true OR match_regex(process_file_name, /(?i)mtedit.exe/)=true - OR match_regex(process_file_name, /(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, - /(?i)servermanager.exe/)=true OR match_regex(process_file_name, /(?i)stordiag.exe/)=true - OR match_regex(process_file_name, /(?i)tzsync.exe/)=true OR match_regex(process_file_name, - /(?i)uevagentpolicygenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true - OR match_regex(process_file_name, /(?i)uevtemplatebaselinegenerator.exe/)=true OR - match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true OR - match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name, - /(?i)iediagcmd.exe/)=true OR match_regex(process_file_name, /(?i)xbox.tcui.exe/)=true - OR match_regex(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true - OR match_regex(process_file_name, /(?i)iisual.exe/)=true OR match_regex(process_file_name, - /(?i)filehistory.exe/)=true OR match_regex(process_file_name, /(?i)secureassessmentbrowser.exe/)=true) - AND (NOT (match_regex(process_file_path, /(?i)\\windows\\system32/)=true OR match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path, /(?i)\\windows\\adws/)=true - OR match_regex(process_file_path, /(?i)\\windows\\networkcontroller/)=true OR match_regex(process_file_path, - /(?i)\\windows\\systemapps/)=true OR match_regex(process_file_path, /(?i)\\winsxs/)=true - OR match_regex(process_file_path, /(?i)\\microsoft.net/)=true)) + | eval device_hostname = device.hostname | where (match(process_file_name, /(?i)MSBuild.exe/)=true + OR match(process_file_name, /(?i)comsvcconfig.exe/)=true OR match(process_file_name, + /(?i)dfsradmin.exe/)=true OR match(process_file_name, /(?i)dfsvc.exe/)=true OR match(process_file_name, + /(?i)microsoft.workflow.compiler.exe/)=true OR match(process_file_name, /(?i)smsvchost.exe/)=true + OR match(process_file_name, /(?i)wsatconfig.exe/)=true OR match(process_file_name, + /(?i)addinprocess.exe/)=true OR match(process_file_name, /(?i)addinprocess32.exe/)=true + OR match(process_file_name, /(?i)addinutil.exe/)=true OR match(process_file_name, + /(?i)aspnet_compiler.exe/)=true OR match(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true + OR match(process_file_name, /(?i)aspnet_regsql.exe/)=true OR match(process_file_name, + /(?i)caspol.exe/)=true OR match(process_file_name, /(?i)datasvcutil.exe/)=true OR + match(process_file_name, /(?i)edmgen.exe/)=true OR match(process_file_name, /(?i)installutil.exe/)=true + OR match(process_file_name, /(?i)jsc.exe/)=true OR match(process_file_name, /(?i)ngentask.exe/)=true + OR match(process_file_name, /(?i)regasm.exe/)=true OR match(process_file_name, /(?i)regsvcs.exe/)=true + OR match(process_file_name, /(?i)sdnbr.exe/)=true OR match(process_file_name, /(?i)acu.exe/)=true + OR match(process_file_name, /(?i)appvstreamingux.exe/)=true OR match(process_file_name, + /(?i)dsac.exe/)=true OR match(process_file_name, /(?i)lbfoadmin.exe/)=true OR match(process_file_name, + /(?i)microsoft.uev.synccontroller.exe/)=true OR match(process_file_name, /(?i)mtedit.exe/)=true + OR match(process_file_name, /(?i)scriptrunner.exe/)=true OR match(process_file_name, + /(?i)servermanager.exe/)=true OR match(process_file_name, /(?i)stordiag.exe/)=true + OR match(process_file_name, /(?i)tzsync.exe/)=true OR match(process_file_name, /(?i)uevagentpolicygenerator.exe/)=true + OR match(process_file_name, /(?i)uevappmonitor.exe/)=true OR match(process_file_name, + /(?i)uevtemplatebaselinegenerator.exe/)=true OR match(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true + OR match(process_file_name, /(?i)powershell_ise.exe/)=true OR match(process_file_name, + /(?i)iediagcmd.exe/)=true OR match(process_file_name, /(?i)xbox.tcui.exe/)=true + OR match(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true + OR match(process_file_name, /(?i)iisual.exe/)=true OR match(process_file_name, /(?i)filehistory.exe/)=true + OR match(process_file_name, /(?i)secureassessmentbrowser.exe/)=true) AND (NOT (match(process_file_path, + /(?i)\\windows\\system32/)=true OR match(process_file_path, /(?i)\\windows\\syswow64/)=true + OR match(process_file_path, /(?i)\\windows\\adws/)=true OR match(process_file_path, + /(?i)\\windows\\networkcontroller/)=true OR match(process_file_path, /(?i)\\windows\\systemapps/)=true + OR match(process_file_path, /(?i)\\winsxs/)=true OR match(process_file_path, /(?i)\\microsoft.net/)=true)) + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml index 0824a99345..d9c189e641 100644 --- a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml +++ b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml @@ -27,14 +27,14 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line, - /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true - OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true + | where match(process_cmd_line, /(?i)get-recipient/)=true OR match(process_cmd_line, + /(?i)new-mailboxsearch/)=true OR match(process_cmd_line, /(?i)new-managementroleassignment/)=true + OR match(process_cmd_line, /(?i)new-mailboxexportrequest/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, - message = "Windows Exchange PowerShell Module Usage has been triggered on " + device_hostname + " by " + actor_user_name + ".", - users = [{"name": actor_user_name, "uid": actor_user.uid}], + message = "Windows Exchange PowerShell Module Usage has been triggered on " + device_hostname + " by " + "Unknown" + ".", + users = [{"name": "Unknown", "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], analytic_stories = ["ProxyShell", "CISA AA22-264A"], diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index a48d72f991..f526a2f22f 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -16,9 +16,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%ms-msdt:/id%" OR process_cmd_line LIKE "%ms-msdt:-id%" OR process_cmd_line LIKE "%ms-msdt:/id%" OR process_cmd_line LIKE "%ms-msdt:%" OR process_cmd_line LIKE "%msdt%") AND process_file_name="msdt.exe") - AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line, - /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) - AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true + AND (match(process_cmd_line, /(?i).xml/)=true OR match(process_cmd_line, /(?i)it_rebrowseforfile=/)=true + OR match(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match(process_cmd_line, + /(?i)pcwdiagnostic/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml index 7fee533d55..b6b88bab5e 100644 --- a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml @@ -12,12 +12,12 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)invoke-sharefinder/)=true + | where match(process_cmd_line, /(?i)invoke-sharefinder/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, - message = "Windows File Share Discovery With Powerview has been triggered on " + device_hostname + " by " + actor_user_name + ".", - users = [{"name": actor_user_name, "uid": actor_user.uid}], + message = "Windows File Share Discovery With Powerview has been triggered on " + device_hostname + " by " + "Unknown" + ".", + users = [{"name": "Unknown", "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], analytic_stories = ["Active Directory Privilege Escalation"], diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index 0703ad6c87..52ce6106b5 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -43,11 +43,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me OR process_file_name="verclsid.exe" OR process_file_name="wab.exe" OR process_file_name="wlrmdr.exe" OR process_file_name="wmic.exe" OR process_file_name="workfolders.exe" OR process_file_name="wscript.exe" OR process_file_name="wsreset.exe" OR process_file_name="wuauclt.exe" OR process_file_name="xwizard.exe") - AND (NOT (match_regex(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR - match_regex(process_file_path, /(?i)(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path, - /(?i)(?i)\\windows\\networkcontrolle/)=true OR match_regex(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true - OR match_regex(process_file_path, /(?i)(?i)\\winsxs/)=true OR match_regex(process_file_path, - /(?i)(?i)\\microsoft.net/)=true)) + AND (NOT (match(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR match(process_file_path, + /(?i)(?i)\\windows\\syswow64/)=true OR match(process_file_path, /(?i)(?i)\\windows\\networkcontrolle/)=true + OR match(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true OR match(process_file_path, + /(?i)(?i)\\winsxs/)=true OR match(process_file_path, /(?i)(?i)\\microsoft.net/)=true)) + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 29a025ccae..80aa84648f 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index be4d210442..efa2c1a6cc 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -13,13 +13,13 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where process_cmd_line LIKE "%4194304%" AND match_regex(process_cmd_line, /(?i)get-aduser/)=true + | where process_cmd_line LIKE "%4194304%" AND match(process_cmd_line, /(?i)get-aduser/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, - message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on " + device_hostname + " by " + actor_user_name + ".", - users = [{"name": actor_user_name, "uid": actor_user.uid}], + message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on " + device_hostname + " by " + "Unknown" + ".", + users = [{"name": "Unknown", "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], analytic_stories = ["Active Directory Kerberos Attacks"], diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index 7650d705bb..890e2266aa 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -13,13 +13,13 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, + | where match(process_cmd_line, /(?i)preauthnotrequired/)=true AND match(process_cmd_line, /(?i)get-domainuser/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, - message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on " + device_hostname + " by " + actor_user_name + ".", - users = [{"name": actor_user_name, "uid": actor_user.uid}], + message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on " + device_hostname + " by " + "Unknown" + ".", + users = [{"name": "Unknown", "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], analytic_stories = ["Active Directory Kerberos Attacks"], diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index c188824b28..4a776ee071 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -15,7 +15,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)downloadfile/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index 2500358d00..0799d0e078 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -17,7 +17,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)start-bitstransfer/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, @@ -33,7 +33,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 70, impact_id = 4, - kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}, ], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml index 4650b8e34f..e125074ebc 100644 --- a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml @@ -14,12 +14,12 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)get-gpppassword/)=true + | where match(process_cmd_line, /(?i)get-gpppassword/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, - message = "Windows PowerSploit GPP Discovery has been triggered on " + device_hostname + " by " + actor_user_name + ".", - users = [{"name": actor_user_name, "uid": actor_user.uid}], + message = "Windows PowerSploit GPP Discovery has been triggered on " + device_hostname + " by " + "Unknown" + ".", + users = [{"name": "Unknown", "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], analytic_stories = ["Active Directory Privilege Escalation"], diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index a10ab76821..482f8ada17 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -13,8 +13,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="rasautou.exe" - AND match_regex(process_cmd_line, /(?i)-p /)=true AND match_regex(process_cmd_line, - /(?i)-d /)=true + AND match(process_cmd_line, /(?i)-p /)=true AND match(process_cmd_line, /(?i)-d + /)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index 4a5cb5074e..740cf36319 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="acccheckconsole.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 01d1fcd8e8..16926bf393 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="adplus.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index cf08319b30..ff329e9c7e 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="advpack.dll" - AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) + AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index 44237257b6..9914665f37 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="agentexecutor.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index c62a22554f..af5b9998a4 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="appinstaller.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) + AND (NOT match(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 94e3af2f34..07aab07703 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="appvlp.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index 260b51a3e3..8274df62be 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="aspnet_compiler.exe" - AND (NOT match_regex(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) + AND (NOT match(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index b787c9dcfe..667b57e8c1 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="at.exe" AND - (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) + (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 5aa120d6d9..1d41516be8 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="atbroker.exe" - AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) + AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index deb2cd7983..6922f72764 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -11,9 +11,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)minidump/)=true AND process_file_name="rundll32.exe") AND match_regex(process_cmd_line, - /(?i)comsvcs.dll/)=true + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)minidump/)=true + AND process_file_name="rundll32.exe") AND match(process_cmd_line, /(?i)comsvcs.dll/)=true + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 5492299cdf..6502f28f18 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -15,7 +15,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" - AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, + AND (match(actor_process_file_name, /(?i)cscript.exe/)=true OR match(actor_process_file_name, /(?i)wscript.exe/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index 8968530a9a..9775f6b5d9 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -16,7 +16,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" - AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true + AND match(actor_process_file_name, /(?i)wmiprvse.exe/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 0c816a5a0a..c52dfa8ad6 100644 --- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -18,11 +18,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="reg.exe" OR - process_file_name="cmd.exe") AND (match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true - OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(process_cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\System/)=true - OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(process_cmd_line, - /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, /(?i)save/)=true --finding_report--' + process_file_name="cmd.exe") AND (match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true + OR match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match(process_cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match(process_cmd_line, /(?i)HKLM\\System/)=true + OR match(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match(process_cmd_line, /(?i)HKLM\\Security/)=true) + AND match(process_cmd_line, /(?i)save/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index b04c82576e..3bb94bc52e 100644 --- a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" - OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match(process_cmd_line, /(?i)deny/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 5e7e5f32b3..62afc13388 100644 --- a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -23,9 +23,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe") - OR (actor_process_file_name="java.exe" AND (NOT match_regex(actor_process_file_name, - /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" AND (NOT - process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" --finding_report--' + OR (actor_process_file_name="java.exe" AND (NOT match(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) + OR (actor_process_file_name="chrome.exe" AND (NOT process_cmd_line="chrome-extension"))) + AND process_file_name="cmd.exe" --finding_report--' how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. diff --git a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index 021a4a0d0a..f3b20295f2 100644 --- a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" - OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match(process_cmd_line, /(?i)grant/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml index d701cedbc0..c7a66d164b 100644 --- a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="attrib.exe" - AND match_regex(process_cmd_line, /(?i)/)=true --finding_report--' + AND match(process_cmd_line, /(?i)/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index f5162ac060..96b99a50d0 100644 --- a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -20,10 +20,10 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, - /(?i)everyone:/)=true) AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" - OR process_file_name="cacls.exe") --finding_report--' + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)S-1-1-0:/)=true + OR match(process_cmd_line, /(?i)SYSTEM:/)=true OR match(process_cmd_line, /(?i)everyone:/)=true) + AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml index 434231093c..8f99a7f8fa 100644 --- a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml +++ b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml @@ -18,10 +18,10 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="cscript.exe" - OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true - OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, - /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true - OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true) --finding_report--' + OR process_file_name="wscript.exe") AND (match(actor_process_file_name, /(?i)visio.exe/)=true + OR match(actor_process_file_name, /(?i)mspub.exe/)=true OR match(actor_process_file_name, + /(?i)powerpnt.exe/)=true OR match(actor_process_file_name, /(?i)excel.exe/)=true + OR match(actor_process_file_name, /(?i)winword.exe/)=true) --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index 7b8d39b06c..58e4a72061 100644 --- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -230,8 +230,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me OR process_file_name="axinstui.exe" OR process_file_name="autoworkplace.exe" OR process_file_name="authhost.exe" OR process_file_name="atbroker.exe" OR process_file_name="applicationframehost.exe" OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe") - AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT - match_regex(process_file_path, /(?i)\\windows\\system32/)=true) --finding_report--' + AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT match(process_file_path, + /(?i)\\windows\\system32/)=true) --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: None references: [] diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index 70e72eda41..7924a16f66 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -17,11 +17,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)powershell/)=true OR match_regex(process_cmd_line, /(?i)setup/)=true OR match_regex(process_cmd_line, - /(?i)application/)=true OR match_regex(process_cmd_line, /(?i)sysmon/)=true OR match_regex(process_cmd_line, - /(?i)system/)=true OR match_regex(process_cmd_line, /(?i)security/)=true) AND process_cmd_line - LIKE "% cl %" AND process_file_name="wevtutil.exe" --finding_report--' + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)powershell/)=true + OR match(process_cmd_line, /(?i)setup/)=true OR match(process_cmd_line, /(?i)application/)=true + OR match(process_cmd_line, /(?i)sysmon/)=true OR match(process_cmd_line, /(?i)system/)=true + OR match(process_cmd_line, /(?i)security/)=true) AND process_cmd_line LIKE "% cl + %" AND process_file_name="wevtutil.exe" --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml index c406297a5b..b2722a57f9 100644 --- a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -22,7 +22,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true + | eval device_hostname = device.hostname | where match(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index b73a56ab71..67be892bf2 100644 --- a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -34,7 +34,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-F %" OR process_cmd_line LIKE "%--data %" OR process_cmd_line LIKE "%-d %" OR process_cmd_line - LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match_regex(process_file_name, + LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match(process_file_name, /(?i)curl.exe/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml index 9db25d56d3..97e3b5c5aa 100644 --- a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml @@ -16,10 +16,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match_regex(process_file_name, - /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, /(?i)\\windows - defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows - defender\\platform/)=true) --finding_report--' + | eval device_hostname = device.hostname | where match(process_file_name, /(?i)mpcmdrun.exe/)=true + AND (NOT match(process_file_path, /(?i)\\windows defender/)=true) AND (NOT match(process_file_path, + /(?i)\\microsoft\\windows defender\\platform/)=true) --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. references: diff --git a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml index 1cb6c75f94..aa304945f6 100644 --- a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -20,41 +20,38 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_file_name, - /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, /(?i)comsvcconfig.exe/)=true - OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true OR match_regex(process_file_name, - /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.workflow.compiler.exe/)=true - OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true OR match_regex(process_file_name, - /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess.exe/)=true - OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true OR match_regex(process_file_name, - /(?i)addinutil.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_compiler.exe/)=true - OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true OR match_regex(process_file_name, - /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name, /(?i)caspol.exe/)=true - OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true OR match_regex(process_file_name, - /(?i)edmgen.exe/)=true OR match_regex(process_file_name, /(?i)installutil.exe/)=true - OR match_regex(process_file_name, /(?i)jsc.exe/)=true OR match_regex(process_file_name, - /(?i)ngentask.exe/)=true OR match_regex(process_file_name, /(?i)regasm.exe/)=true - OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true OR match_regex(process_file_name, - /(?i)sdnbr.exe/)=true OR match_regex(process_file_name, /(?i)acu.exe/)=true OR match_regex(process_file_name, - /(?i)appvstreamingux.exe/)=true OR match_regex(process_file_name, /(?i)dsac.exe/)=true - OR match_regex(process_file_name, /(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, - /(?i)microsoft.uev.synccontroller.exe/)=true OR match_regex(process_file_name, /(?i)mtedit.exe/)=true - OR match_regex(process_file_name, /(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, - /(?i)servermanager.exe/)=true OR match_regex(process_file_name, /(?i)stordiag.exe/)=true - OR match_regex(process_file_name, /(?i)tzsync.exe/)=true OR match_regex(process_file_name, - /(?i)uevagentpolicygenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true - OR match_regex(process_file_name, /(?i)uevtemplatebaselinegenerator.exe/)=true OR - match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true OR - match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name, - /(?i)iediagcmd.exe/)=true OR match_regex(process_file_name, /(?i)xbox.tcui.exe/)=true - OR match_regex(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true - OR match_regex(process_file_name, /(?i)iisual.exe/)=true OR match_regex(process_file_name, - /(?i)filehistory.exe/)=true OR match_regex(process_file_name, /(?i)secureassessmentbrowser.exe/)=true) - AND (NOT (match_regex(process_file_path, /(?i)\\windows\\system32/)=true OR match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path, /(?i)\\windows\\adws/)=true - OR match_regex(process_file_path, /(?i)\\windows\\networkcontroller/)=true OR match_regex(process_file_path, - /(?i)\\windows\\systemapps/)=true OR match_regex(process_file_path, /(?i)\\winsxs/)=true - OR match_regex(process_file_path, /(?i)\\microsoft.net/)=true)) --finding_report--' + | eval device_hostname = device.hostname | where (match(process_file_name, /(?i)MSBuild.exe/)=true + OR match(process_file_name, /(?i)comsvcconfig.exe/)=true OR match(process_file_name, + /(?i)dfsradmin.exe/)=true OR match(process_file_name, /(?i)dfsvc.exe/)=true OR match(process_file_name, + /(?i)microsoft.workflow.compiler.exe/)=true OR match(process_file_name, /(?i)smsvchost.exe/)=true + OR match(process_file_name, /(?i)wsatconfig.exe/)=true OR match(process_file_name, + /(?i)addinprocess.exe/)=true OR match(process_file_name, /(?i)addinprocess32.exe/)=true + OR match(process_file_name, /(?i)addinutil.exe/)=true OR match(process_file_name, + /(?i)aspnet_compiler.exe/)=true OR match(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true + OR match(process_file_name, /(?i)aspnet_regsql.exe/)=true OR match(process_file_name, + /(?i)caspol.exe/)=true OR match(process_file_name, /(?i)datasvcutil.exe/)=true OR + match(process_file_name, /(?i)edmgen.exe/)=true OR match(process_file_name, /(?i)installutil.exe/)=true + OR match(process_file_name, /(?i)jsc.exe/)=true OR match(process_file_name, /(?i)ngentask.exe/)=true + OR match(process_file_name, /(?i)regasm.exe/)=true OR match(process_file_name, /(?i)regsvcs.exe/)=true + OR match(process_file_name, /(?i)sdnbr.exe/)=true OR match(process_file_name, /(?i)acu.exe/)=true + OR match(process_file_name, /(?i)appvstreamingux.exe/)=true OR match(process_file_name, + /(?i)dsac.exe/)=true OR match(process_file_name, /(?i)lbfoadmin.exe/)=true OR match(process_file_name, + /(?i)microsoft.uev.synccontroller.exe/)=true OR match(process_file_name, /(?i)mtedit.exe/)=true + OR match(process_file_name, /(?i)scriptrunner.exe/)=true OR match(process_file_name, + /(?i)servermanager.exe/)=true OR match(process_file_name, /(?i)stordiag.exe/)=true + OR match(process_file_name, /(?i)tzsync.exe/)=true OR match(process_file_name, /(?i)uevagentpolicygenerator.exe/)=true + OR match(process_file_name, /(?i)uevappmonitor.exe/)=true OR match(process_file_name, + /(?i)uevtemplatebaselinegenerator.exe/)=true OR match(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true + OR match(process_file_name, /(?i)powershell_ise.exe/)=true OR match(process_file_name, + /(?i)iediagcmd.exe/)=true OR match(process_file_name, /(?i)xbox.tcui.exe/)=true + OR match(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true + OR match(process_file_name, /(?i)iisual.exe/)=true OR match(process_file_name, /(?i)filehistory.exe/)=true + OR match(process_file_name, /(?i)secureassessmentbrowser.exe/)=true) AND (NOT (match(process_file_path, + /(?i)\\windows\\system32/)=true OR match(process_file_path, /(?i)\\windows\\syswow64/)=true + OR match(process_file_path, /(?i)\\windows\\adws/)=true OR match(process_file_path, + /(?i)\\windows\\networkcontroller/)=true OR match(process_file_path, /(?i)\\windows\\systemapps/)=true + OR match(process_file_path, /(?i)\\winsxs/)=true OR match(process_file_path, /(?i)\\microsoft.net/)=true)) + --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application diff --git a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml index a3f7a5035e..ebeb2baa38 100644 --- a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml +++ b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml @@ -33,9 +33,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line, - /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true - OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true --finding_report--' + | where match(process_cmd_line, /(?i)get-recipient/)=true OR match(process_cmd_line, + /(?i)new-mailboxsearch/)=true OR match(process_cmd_line, /(?i)new-managementroleassignment/)=true + OR match(process_cmd_line, /(?i)new-mailboxexportrequest/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml index 07f0d4b0df..0af85436d8 100644 --- a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -22,9 +22,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%ms-msdt:/id%" OR process_cmd_line LIKE "%ms-msdt:-id%" OR process_cmd_line LIKE "%ms-msdt:/id%" OR process_cmd_line LIKE "%ms-msdt:%" OR process_cmd_line LIKE "%msdt%") AND process_file_name="msdt.exe") - AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line, - /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) - AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true --finding_report--' + AND (match(process_cmd_line, /(?i).xml/)=true OR match(process_cmd_line, /(?i)it_rebrowseforfile=/)=true + OR match(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match(process_cmd_line, + /(?i)pcwdiagnostic/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml index c1efe0a14a..dc0a56c184 100644 --- a/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml +++ b/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml @@ -18,7 +18,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)invoke-sharefinder/)=true --finding_report--' + | where match(process_cmd_line, /(?i)invoke-sharefinder/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml index 007bd8d679..ccd9af5497 100644 --- a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -49,11 +49,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me OR process_file_name="verclsid.exe" OR process_file_name="wab.exe" OR process_file_name="wlrmdr.exe" OR process_file_name="wmic.exe" OR process_file_name="workfolders.exe" OR process_file_name="wscript.exe" OR process_file_name="wsreset.exe" OR process_file_name="wuauclt.exe" OR process_file_name="xwizard.exe") - AND (NOT (match_regex(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR - match_regex(process_file_path, /(?i)(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path, - /(?i)(?i)\\windows\\networkcontrolle/)=true OR match_regex(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true - OR match_regex(process_file_path, /(?i)(?i)\\winsxs/)=true OR match_regex(process_file_path, - /(?i)(?i)\\microsoft.net/)=true)) --finding_report--' + AND (NOT (match(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR match(process_file_path, + /(?i)(?i)\\windows\\syswow64/)=true OR match(process_file_path, /(?i)(?i)\\windows\\networkcontrolle/)=true + OR match(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true OR match(process_file_path, + /(?i)(?i)\\winsxs/)=true OR match(process_file_path, /(?i)(?i)\\microsoft.net/)=true)) + --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 3d0a855c61..8b565f275c 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -25,7 +25,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index f56ba45e87..7e4dc440bf 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where process_cmd_line LIKE "%4194304%" AND match_regex(process_cmd_line, /(?i)get-aduser/)=true + | where process_cmd_line LIKE "%4194304%" AND match(process_cmd_line, /(?i)get-aduser/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index a3da967bc8..aac779b072 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, + | where match(process_cmd_line, /(?i)preauthnotrequired/)=true AND match(process_cmd_line, /(?i)get-domainuser/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here diff --git a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml index 6bf321e9a0..4e7323720d 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml @@ -21,7 +21,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)downloadfile/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml index 7d4390f1d4..45f2fd5c76 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml @@ -15,7 +15,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)export-certificate/)=true --finding_report--' + | where match(process_cmd_line, /(?i)export-certificate/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml index f4a7e2b33e..895cd59795 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml @@ -15,7 +15,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)export-pfxcertificate/)=true --finding_report--' + | where match(process_cmd_line, /(?i)export-pfxcertificate/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml index 7d5b4a4e21..d7c0e9641b 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -23,7 +23,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)start-bitstransfer/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml b/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml index 4f7d937a0d..a6e373f9af 100644 --- a/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml +++ b/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml @@ -20,7 +20,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)get-gpppassword/)=true --finding_report--' + | where match(process_cmd_line, /(?i)get-gpppassword/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml index fab57125a0..5b06e7fe22 100644 --- a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -19,8 +19,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="rasautou.exe" - AND match_regex(process_cmd_line, /(?i)-p /)=true AND match_regex(process_cmd_line, - /(?i)-d /)=true --finding_report--' + AND match(process_cmd_line, /(?i)-p /)=true AND match(process_cmd_line, /(?i)-d + /)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml index 6002889d2d..74de00e694 100644 --- a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml +++ b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml @@ -18,9 +18,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)create/)=true OR match_regex(process_cmd_line, /(?i)\\\\/)=true) AND process_file_name="sc.exe" - --finding_report--' + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)create/)=true + OR match(process_cmd_line, /(?i)\\\\/)=true) AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index 2f7f6fc4d5..8ddf0d7212 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="acccheckconsole.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 95c9c571aa..089394a343 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="adplus.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index e3f7d60f8b..396f7c09dd 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="advpack.dll" - AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' + AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index a8af25142f..3643a3c25a 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="agentexecutor.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)/)=true) --finding_report--' + AND (NOT match(process_file_path, /(?i)\\program files (x86)/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index 1f1f8446fc..0344c095dd 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="appinstaller.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) + AND (NOT match(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index c13db65c31..865e257a60 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="appvlp.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index a57ca72320..9d2b863ad1 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="aspnet_compiler.exe" - AND (NOT match_regex(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) + AND (NOT match(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 58cb8ce16a..c7972db282 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="at.exe" AND - (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' + (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index ce2726da1a..a6e598f94c 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="atbroker.exe" - AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' + AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml index f888aa997b..bc39ea7fcf 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -17,9 +17,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)minidump/)=true AND process_file_name="rundll32.exe") AND match_regex(process_cmd_line, - /(?i)comsvcs.dll/)=true --finding_report--' + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)minidump/)=true + AND process_file_name="rundll32.exe") AND match(process_cmd_line, /(?i)comsvcs.dll/)=true + --finding_report--' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) diff --git a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml index cdb9b2a5da..b5e78fe232 100644 --- a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml @@ -21,7 +21,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" - AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, + AND (match(actor_process_file_name, /(?i)cscript.exe/)=true OR match(actor_process_file_name, /(?i)wscript.exe/)=true) --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml index 0e8bfb1854..b303b0ddb8 100644 --- a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml +++ b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml @@ -23,7 +23,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match_regex(process_cmd_line, /(?i)/dest:rdp-tcp/)=true + | eval device_hostname = device.hostname | where match(process_cmd_line, /(?i)/dest:rdp-tcp/)=true AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml index cc5fd105fd..f8a462ae4c 100644 --- a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -22,7 +22,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" - AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true --finding_report--' + AND match(actor_process_file_name, /(?i)wmiprvse.exe/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, From 54033069281cd3d8bdb983d643261c2ca002708b Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 9 Aug 2023 17:56:37 +0200 Subject: [PATCH 05/14] delete tmp folder --- ...ssa___anomalous_usage_of_archive_tools.yml | 99 ------------------- 1 file changed, 99 deletions(-) delete mode 100644 tmp/ssa___anomalous_usage_of_archive_tools.yml diff --git a/tmp/ssa___anomalous_usage_of_archive_tools.yml b/tmp/ssa___anomalous_usage_of_archive_tools.yml deleted file mode 100644 index 8a7dd6cc0c..0000000000 --- a/tmp/ssa___anomalous_usage_of_archive_tools.yml +++ /dev/null @@ -1,99 +0,0 @@ -name: Anomalous usage of Archive Tools -id: 63614a58-10e2-4c6c-ae81-ea1113681439 -version: 1 -date: '2021-11-22' -author: Patrick Bareiss, Splunk -type: Anomaly -status: production -description: The following detection identifies the usage of archive tools from the - command line. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("WinRAR.exe", - "7z%", "winzip%")) AND (actor_process_file_name IN ("%powershell.exe", "%cmd.exe")) - --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: False positives can be ligitmate usage of archive tools from - the command line. -references: -- https://attack.mitre.org/techniques/T1560/001/ -tags: - analytic_story: - - Cobalt Strike - - NOBELIUM Group - - Insider Threat - asset_type: Endpoint - confidence: 60 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading - of 7zip. - mitre_attack_id: - - T1560.001 - - T1560 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 42 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log - source: WinEventLog:Security From e120a617b324e8e2b94703e1ef3ad04ee0e79579 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 10 Aug 2023 11:46:46 +0200 Subject: [PATCH 06/14] converted detections to SPL2 --- ...ocess_running_from_unexpected_location.yml | 324 ++++++------------ ...ocess_running_from_unexpected_location.yml | 324 ++++++------------ 2 files changed, 224 insertions(+), 424 deletions(-) diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index d8a643e571..52cf812123 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -14,218 +14,118 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name="xwizard.exe" - OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" - OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" - OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" - OR process_file_name="write.exe" OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" - OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" - OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" - OR process_file_name="winver.exe" OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" - OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" - OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" - OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" - OR process_file_name="where.exe" OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" - OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" - OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" - OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" - OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" - OR process_file_name="vds.exe" OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" - OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" - OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" - OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" - OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" - OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" - OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe" - OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe" - OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe" - OR process_file_name="systeminfo.exe" OR process_file_name="syskey.exe" OR process_file_name="sxstrace.exe" - OR process_file_name="svchost.exe" OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe" - OR process_file_name="spreview.exe" OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe" - OR process_file_name="spinstall.exe" OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" - OR process_file_name="smss.exe" OR process_file_name="slui.exe" OR process_file_name="sihost.exe" - OR process_file_name="sigverif.exe" OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" - OR process_file_name="shadow.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" - OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe" - OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe" - OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe" - OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe" OR process_file_name="sc.exe" - OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe" - OR process_file_name="rundll32.exe" OR process_file_name="runas.exe" OR process_file_name="rstrui.exe" - OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe" - OR process_file_name="resmon.exe" OR process_file_name="reset.exe" OR process_file_name="replace.exe" - OR process_file_name="repair-bde.exe" OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe" - OR process_file_name="regsvr32.exe" OR process_file_name="regini.exe" OR process_file_name="regedt32.exe" - OR process_file_name="reg.exe" OR process_file_name="recover.exe" OR process_file_name="recdisc.exe" - OR process_file_name="rdrleakdiag.exe" OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe" - OR process_file_name="rasphone.exe" OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe" - OR process_file_name="rasautou.exe" OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe" - OR process_file_name="query.exe" OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe" - OR process_file_name="pwlauncher.exe" OR process_file_name="psr.exe" OR process_file_name="provtool.exe" - OR process_file_name="proquota.exe" OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe" - OR process_file_name="print.exe" OR process_file_name="prevhost.exe" OR process_file_name="powercfg.exe" - OR process_file_name="poqexec.exe" OR process_file_name="plasrv.exe" OR process_file_name="phoneactivate.exe" - OR process_file_name="perfmon.exe" OR process_file_name="pcwrun.exe" OR process_file_name="pcawrk.exe" - OR process_file_name="pcaui.exe" OR process_file_name="pcalua.exe" OR process_file_name="p2phost.exe" - OR process_file_name="osk.exe" OR process_file_name="openfiles.exe" OR process_file_name="omadmprc.exe" - OR process_file_name="omadmclient.exe" OR process_file_name="odbcconf.exe" OR process_file_name="odbcad32.exe" - OR process_file_name="ocsetup.exe" OR process_file_name="ntprint.exe" OR process_file_name="ntoskrnl.exe" - OR process_file_name="nslookup.exe" OR process_file_name="notepad.exe" OR process_file_name="nltest.exe" - OR process_file_name="newdev.exe" OR process_file_name="netsh.exe" OR process_file_name="netiougc.exe" - OR process_file_name="netcfg.exe" OR process_file_name="netbtugc.exe" OR process_file_name="net1.exe" - OR process_file_name="net.exe" OR process_file_name="ndadmin.exe" OR process_file_name="nbtstat.exe" - OR process_file_name="mtstocom.exe" OR process_file_name="mstsc.exe" OR process_file_name="msra.exe" - OR process_file_name="mspaint.exe" OR process_file_name="msinfo32.exe" OR process_file_name="msiexec.exe" - OR process_file_name="mshta.exe" OR process_file_name="msg.exe" OR process_file_name="msfeedssync.exe" - OR process_file_name="msdtc.exe" OR process_file_name="msdt.exe" OR process_file_name="msconfig.exe" - OR process_file_name="mpnotify.exe" OR process_file_name="mountvol.exe" OR process_file_name="mobsync.exe" - OR process_file_name="mmc.exe" OR process_file_name="mfpmp.exe" OR process_file_name="mctadmin.exe" - OR process_file_name="mcbuilder.exe" OR process_file_name="mblctr.exe" OR process_file_name="manage-bde.exe" - OR process_file_name="makecab.exe" OR process_file_name="lsm.exe" OR process_file_name="lsass.exe" - OR process_file_name="lpremove.exe" OR process_file_name="lpksetup.exe" OR process_file_name="lpkinstall.exe" - OR process_file_name="logoff.exe" OR process_file_name="logman.exe" OR process_file_name="logagent.exe" - OR process_file_name="lodctr.exe" OR process_file_name="licensingdiag.exe" OR process_file_name="label.exe" - OR process_file_name="ktmutil.exe" OR process_file_name="ksetup.exe" OR process_file_name="klist.exe" - OR process_file_name="isoburn.exe" OR process_file_name="iscsicpl.exe" OR process_file_name="iscsicli.exe" - OR process_file_name="irftp.exe" OR process_file_name="ipconfig.exe" OR process_file_name="immersivetpmvscmgrsvr.exe" - OR process_file_name="iexpress.exe" OR process_file_name="ieetwcollector.exe" OR - process_file_name="ieunatt.exe" OR process_file_name="ie4uinit.exe" OR process_file_name="icsunattend.exe" - OR process_file_name="icardagt.exe" OR process_file_name="icacls.exe" OR process_file_name="hwrreg.exe" - OR process_file_name="hwrcomp.exe" OR process_file_name="help.exe" OR process_file_name="hdwwiz.exe" - OR process_file_name="grpconv.exe" OR process_file_name="gpupdate.exe" OR process_file_name="gpscript.exe" - OR process_file_name="gpresult.exe" OR process_file_name="getmac.exe" OR process_file_name="fveprompt.exe" - OR process_file_name="fvenotify.exe" OR process_file_name="ftp.exe" OR process_file_name="fsutil.exe" - OR process_file_name="fsquirt.exe" OR process_file_name="fsavailux.exe" OR process_file_name="forfiles.exe" - OR process_file_name="fontview.exe" OR process_file_name="fontdrvhost.exe" OR process_file_name="fodhelper.exe" - OR process_file_name="fltmc.exe" OR process_file_name="fixmapi.exe" OR process_file_name="finger.exe" - OR process_file_name="findstr.exe" OR process_file_name="find.exe" OR process_file_name="fhmanagew.exe" - OR process_file_name="fc.exe" OR process_file_name="extrac32.exe" OR process_file_name="expand.exe" - OR process_file_name="eventvwr.exe" OR process_file_name="eventcreate.exe" OR process_file_name="eudcedit.exe" - OR process_file_name="esentutl.exe" OR process_file_name="embeddedapplauncher.exe" - OR process_file_name="efsui.exe" OR process_file_name="easinvoker.exe" OR process_file_name="dxdiag.exe" - OR process_file_name="dwm.exe" OR process_file_name="dvdupgrd.exe" OR process_file_name="dvdplay.exe" - OR process_file_name="dstokenclean.exe" OR process_file_name="dsregcmd.exe" OR process_file_name="drvinst.exe" - OR process_file_name="drvcfg.exe" OR process_file_name="driverquery.exe" OR process_file_name="dpnsvr.exe" - OR process_file_name="dpapimig.exe" OR process_file_name="doskey.exe" OR process_file_name="dnscacheugc.exe" - OR process_file_name="dmclient.exe" OR process_file_name="dmcfghost.exe" OR process_file_name="dmcertinst.exe" - OR process_file_name="dllhst3g.exe" OR process_file_name="dllhost.exe" OR process_file_name="djoin.exe" - OR process_file_name="dispdiag.exe" OR process_file_name="diskraid.exe" OR process_file_name="diskperf.exe" - OR process_file_name="diskpart.exe" OR process_file_name="dinotify.exe" OR process_file_name="diantz.exe" - OR process_file_name="dialer.exe" OR process_file_name="dfrgui.exe" OR process_file_name="ddodiag.exe" - OR process_file_name="dcomcnfg.exe" OR process_file_name="dccw.exe" OR process_file_name="dashost.exe" - OR process_file_name="cttunesvr.exe" OR process_file_name="cttune.exe" OR process_file_name="ctfmon.exe" - OR process_file_name="csrss.exe" OR process_file_name="cscript.exe" OR process_file_name="credwiz.exe" - OR process_file_name="convert.exe" OR process_file_name="control.exe" OR process_file_name="consent.exe" - OR process_file_name="conhost.exe" OR process_file_name="compact.exe" OR process_file_name="comp.exe" - OR process_file_name="colorcpl.exe" OR process_file_name="cofire.exe" OR process_file_name="cmstp.exe" - OR process_file_name="cmmon32.exe" OR process_file_name="cmdl32.exe" OR process_file_name="cmdkey.exe" - OR process_file_name="cmd.exe" OR process_file_name="clip.exe" OR process_file_name="cliconfg.exe" - OR process_file_name="cleanmgr.exe" OR process_file_name="cipher.exe" OR process_file_name="choice.exe" - OR process_file_name="chkntfs.exe" OR process_file_name="chkdsk.exe" OR process_file_name="chgusr.exe" - OR process_file_name="chgport.exe" OR process_file_name="chglogon.exe" OR process_file_name="charmap.exe" - OR process_file_name="changepk.exe" OR process_file_name="change.exe" OR process_file_name="certutil.exe" - OR process_file_name="certreq.exe" OR process_file_name="cdpreference.exe" OR process_file_name="calc.exe" - OR process_file_name="cacls.exe" OR process_file_name="bthudtask.exe" OR process_file_name="browser_broker.exe" - OR process_file_name="bridgeunattend.exe" OR process_file_name="bootsect.exe" OR - process_file_name="bootim.exe" OR process_file_name="bootcfg.exe" OR process_file_name="bitsadmin.exe" - OR process_file_name="bdeunlock.exe" OR process_file_name="bdechangepin.exe" OR - process_file_name="bcdedit.exe" OR process_file_name="bcdboot.exe" OR process_file_name="bcastdvr.exe" - OR process_file_name="backgroundtaskhost.exe" OR process_file_name="baaupdate.exe" - OR process_file_name="autofmt.exe" OR process_file_name="autoconv.exe" OR process_file_name="autochk.exe" - OR process_file_name="auditpol.exe" OR process_file_name="audiodg.exe" OR process_file_name="attrib.exe" - OR process_file_name="at.exe" OR process_file_name="appidpolicyconverter.exe" OR - process_file_name="appidcertstorecheck.exe" OR process_file_name="alg.exe" OR process_file_name="aitstatic.exe" - OR process_file_name="aitagent.exe" OR process_file_name="acu.exe" OR process_file_name="wpcmon.exe" - OR process_file_name="workfolders.exe" OR process_file_name="windowsupdateelevatedinstaller.exe" - OR process_file_name="windowsanytimeupgradeui.exe" OR process_file_name="windowsanytimeupgraderesults.exe" - OR process_file_name="windowsanytimeupgrade.exe" OR process_file_name="windowsactiondialog.exe" - OR process_file_name="windows.media.backgroundplayback.exe" OR process_file_name="winsat.exe" - OR process_file_name="werfaultsecure.exe" OR process_file_name="werfault.exe" OR - process_file_name="webcache.exe" OR process_file_name="wallpaperhost.exe" OR process_file_name="wwahost.exe" - OR process_file_name="wudfhost.exe" OR process_file_name="wsreset.exe" OR process_file_name="wsmanhttpconfig.exe" - OR process_file_name="wscollect.exe" OR process_file_name="wpdshextautoplay.exe" - OR process_file_name="wmpdmc.exe" OR process_file_name="wfs.exe" OR process_file_name="vaultsysui.exe" - OR process_file_name="vaultcmd.exe" OR process_file_name="vssvc.exe" OR process_file_name="utilman.exe" - OR process_file_name="usoclient.exe" OR process_file_name="useraccountcontrolsettings.exe" - OR process_file_name="useraccountbroker.exe" OR process_file_name="upgraderesultsui.exe" - OR process_file_name="ui0detect.exe" OR process_file_name="tswpfwrp.exe" OR process_file_name="tpminit.exe" - OR process_file_name="tokenbrokercookies.exe" OR process_file_name="thumbnailextractionhost.exe" - OR process_file_name="taskmgr.exe" OR process_file_name="tapiunattend.exe" OR process_file_name="tswbprxy.exe" - OR process_file_name="tstheme.exe" OR process_file_name="tracert.exe" OR process_file_name="tcpsvcs.exe" - OR process_file_name="systemsettingsremovedevice.exe" OR process_file_name="systemsettingsbroker.exe" - OR process_file_name="systemsettingsadminflows.exe" OR process_file_name="systempropertiesremote.exe" - OR process_file_name="systempropertiesprotection.exe" OR process_file_name="systempropertiesperformance.exe" - OR process_file_name="systempropertieshardware.exe" OR process_file_name="systempropertiesdataexecutionprevention.exe" - OR process_file_name="systempropertiescomputername.exe" OR process_file_name="systempropertiesadvanced.exe" - OR process_file_name="sysreseterr.exe" OR process_file_name="synchost.exe" OR process_file_name="stikynot.exe" - OR process_file_name="srtasks.exe" OR process_file_name="sppextcomobj.exe" OR process_file_name="spaceagent.exe" - OR process_file_name="soundrecorder.exe" OR process_file_name="snippingtool.exe" - OR process_file_name="sndvol.exe" OR process_file_name="smartscreensettings.exe" - OR process_file_name="slidetoshutdown.exe" OR process_file_name="settingsynchost.exe" - OR process_file_name="setieinstalleddate.exe" OR process_file_name="sensordataservice.exe" - OR process_file_name="secedit.exe" OR process_file_name="searchprotocolhost.exe" - OR process_file_name="searchindexer.exe" OR process_file_name="searchfilterhost.exe" - OR process_file_name="sihclient.exe" OR process_file_name="runtimebroker.exe" OR - process_file_name="runlegacycplelevated.exe" OR process_file_name="rpcping.exe" - OR process_file_name="rmclient.exe" OR process_file_name="remoteposworker.exe" OR - process_file_name="relpost.exe" OR process_file_name="registeriepkeys.exe" OR process_file_name="register-cimprovider.exe" - OR process_file_name="recoverydrive.exe" OR process_file_name="reagentc.exe" OR - process_file_name="rdpsauachelper.exe" OR process_file_name="rdpsaproxy.exe" OR - process_file_name="rdpsa.exe" OR process_file_name="route.exe" OR process_file_name="rmactivate_ssp_isv.exe" - OR process_file_name="rmactivate_ssp.exe" OR process_file_name="rmactivate_isv.exe" - OR process_file_name="rmactivate.exe" OR process_file_name="rdspnf.exe" OR process_file_name="proximityuxhost.exe" - OR process_file_name="printisolationhost.exe" OR process_file_name="printdialoghost3d.exe" - OR process_file_name="printdialoghost.exe" OR process_file_name="printbrmui.exe" - OR process_file_name="presentationsettings.exe" OR process_file_name="presentationhost.exe" - OR process_file_name="pnputil.exe" OR process_file_name="pnpunattend.exe" OR process_file_name="pkgmgr.exe" - OR process_file_name="pickerhost.exe" OR process_file_name="passwordonwakesettingflyout.exe" - OR process_file_name="ping.exe" OR process_file_name="pathping.exe" OR process_file_name="optionalfeatures.exe" - OR process_file_name="openwith.exe" OR process_file_name="networkuxbroker.exe" OR - process_file_name="netplwiz.exe" OR process_file_name="netproj.exe" OR process_file_name="netevtfwdr.exe" - OR process_file_name="netcfgnotifyobjecthost.exe" OR process_file_name="narrator.exe" - OR process_file_name="netstat.exe" OR process_file_name="napstat.exe" OR process_file_name="musnotificationux.exe" - OR process_file_name="musnotification.exe" OR process_file_name="multidigimon.exe" - OR process_file_name="muiunattend.exe" OR process_file_name="msspellcheckinghost.exe" - OR process_file_name="mpsigstub.exe" OR process_file_name="migautoplay.exe" OR process_file_name="mdsched.exe" - OR process_file_name="mdres.exe" OR process_file_name="mbaeparsertask.exe" OR process_file_name="magnify.exe" - OR process_file_name="mschedexe.exe" OR process_file_name="mrt.exe" OR process_file_name="mrinfo.exe" - OR process_file_name="mdmappinstaller.exe" OR process_file_name="mdmagent.exe" OR - process_file_name="mdeserver.exe" OR process_file_name="lsaiso.exe" OR process_file_name="logonui.exe" - OR process_file_name="lockscreencontentserver.exe" OR process_file_name="lockapphost.exe" - OR process_file_name="locator.exe" OR process_file_name="locationnotifications.exe" - OR process_file_name="locationnotificationwindows.exe" OR process_file_name="licensingui.exe" - OR process_file_name="licensemanagershellext.exe" OR process_file_name="legacynetuxhost.exe" - OR process_file_name="launchwinapp.exe" OR process_file_name="launchtm.exe" OR process_file_name="languagecomponentsinstallercomhandler.exe" - OR process_file_name="installagent.exe" OR process_file_name="infdefaultinstall.exe" - OR process_file_name="icsentitlementhost.exe" OR process_file_name="hostname.exe" - OR process_file_name="gettingstarted.exe" OR process_file_name="genvalobj.exe" OR - process_file_name="gamepanel.exe" OR process_file_name="fondue.exe" OR process_file_name="filehistory.exe" - OR process_file_name="fxsunatd.exe" OR process_file_name="fxssvc.exe" OR process_file_name="fxscover.exe" - OR process_file_name="ehstorauthn.exe" OR process_file_name="easeofaccessdialog.exe" - OR process_file_name="easpoliciesbrokerhost.exe" OR process_file_name="eap3host.exe" - OR process_file_name="eosnotify.exe" OR process_file_name="edpcleanup.exe" OR process_file_name="dxpserver.exe" - OR process_file_name="dsmusertask.exe" OR process_file_name="dpiscaling.exe" OR - process_file_name="dmomacpmo.exe" OR process_file_name="dmnotificationbroker.exe" - OR process_file_name="displayswitch.exe" OR process_file_name="dism.exe" OR process_file_name="disksnapshot.exe" - OR process_file_name="deviceproperties.exe" OR process_file_name="devicepairingwizard.exe" - OR process_file_name="deviceenroller.exe" OR process_file_name="deviceeject.exe" - OR process_file_name="devicedisplayobjectprovider.exe" OR process_file_name="defrag.exe" - OR process_file_name="dataexchangehost.exe" OR process_file_name="dwwin.exe" OR - process_file_name="dfdwiz.exe" OR process_file_name="credentialuibroker.exe" OR - process_file_name="computerdefaults.exe" OR process_file_name="compattelrunner.exe" - OR process_file_name="compmgmtlauncher.exe" OR process_file_name="cloudstoragewizard.exe" - OR process_file_name="cloudnotifications.exe" OR process_file_name="cloudexperiencehostbroker.exe" - OR process_file_name="clipup.exe" OR process_file_name="checknetisolation.exe" OR - process_file_name="certenrollctrl.exe" OR process_file_name="castsrv.exe" OR process_file_name="camerasettingsuihost.exe" - OR process_file_name="bytecodegenerator.exe" OR process_file_name="bitlockerwizardelev.exe" - OR process_file_name="bitlockerwizard.exe" OR process_file_name="bitlockerdeviceencryption.exe" - OR process_file_name="bdeunlockwizard.exe" OR process_file_name="bdeuisrv.exe" OR - process_file_name="bdehdcfg.exe" OR process_file_name="backgroundtransferhost.exe" - OR process_file_name="axinstui.exe" OR process_file_name="autoworkplace.exe" OR - process_file_name="authhost.exe" OR process_file_name="atbroker.exe" OR process_file_name="applicationframehost.exe" - OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe") - AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT match(process_file_path, - /(?i)\\windows\\system32/)=true) + | eval device_hostname = device.hostname | where (process_file_name IN ("xwizard.exe", + "xpsrchvw.exe", "xcopy.exe", "wusa.exe", "wuauclt.exe", "wuapp.exe", "wuapihost.exe", + "wsqmcons.exe", "wsmprovhost.exe", "wscript.exe", "write.exe", "wpr.exe", "wpnpinst.exe", + "wowreg32.exe", "wlrmdr.exe", "wlanext.exe", "wksprt.exe", "wkspbroker.exe", "wisptis.exe", + "winver.exe", "winrshost.exe", "winrs.exe", "winresume.exe", "winlogon.exe", "winload.exe", + "wininit.exe", "wimserv.exe", "wifitask.exe", "wiawow64.exe", "wiaacmgr.exe", "whoami.exe", + "where.exe", "wextract.exe", "wevtutil.exe", "wermgr.exe", "wecutil.exe", "wbengine.exe", + "wbadmin.exe", "waitfor.exe", "w32tm.exe", "vssadmin.exe", "vmicsvc.exe", "verifiergui.exe", + "verifier.exe", "verclsid.exe", "vdsldr.exe", "vds.exe", "userinit.exe", "upnpcont.exe", + "unregmp2.exe", "unlodctr.exe", "ucsvc.exe", "tzutil.exe", "tzsync.exe", "typeperf.exe", + "tskill.exe", "tsdiscon.exe", "tscon.exe", "tracerpt.exe", "tpmvscmgrsvr.exe", "tpmvscmgr.exe", + "timeout.exe", "tcmsetup.exe", "taskmgr.exe", "tasklist.exe", "taskkill.exe", "taskhostw.exe", + "taskhost.exe", "taskeng.exe", "takeown.exe", "tabcal.exe", "systray.exe", "systemreset.exe", + "systeminfo.exe", "syskey.exe", "sxstrace.exe", "svchost.exe", "subst.exe", "srdelayed.exe", + "spreview.exe", "sppsvc.exe", "spoolsv.exe", "spinstall.exe", "sort.exe", "snmptrap.exe", + "smss.exe", "slui.exe", "sihost.exe", "sigverif.exe", "shutdown.exe", "shrpubw.exe", + "shadow.exe", "setx.exe", "setupugc.exe", "setupcl.exe", "setspn.exe", "sethc.exe", + "sessionmsg.exe", "services.exe", "secinit.exe", "sdiagnhost.exe", "sdclt.exe", + "sdchange.exe", "sdbinst.exe", "schtasks.exe", "sc.exe", "sbunattend.exe", "rwinsta.exe", + "runonce.exe", "rundll32.exe", "runas.exe", "rstrui.exe", "rrinstaller.exe", "rmttpmvscmgrsvr.exe", + "resmon.exe", "reset.exe", "replace.exe", "repair-bde.exe", "relog.exe", "rekeywiz.exe", + "regsvr32.exe", "regini.exe", "regedt32.exe", "reg.exe", "recover.exe", "recdisc.exe", + "rdrleakdiag.exe", "rdpinput.exe", "rdpclip.exe", "rasphone.exe", "raserver.exe", + "rasdial.exe", "rasautou.exe", "qwinsta.exe", "quser.exe", "query.exe", "qprocess.exe", + "qappsrv.exe", "pwlauncher.exe", "psr.exe", "provtool.exe", "proquota.exe", "printui.exe", + "printfilterpipelinesvc.exe", "print.exe", "prevhost.exe", "powercfg.exe", "poqexec.exe", + "plasrv.exe", "phoneactivate.exe", "perfmon.exe", "pcwrun.exe", "pcawrk.exe", "pcaui.exe", + "pcalua.exe", "p2phost.exe", "osk.exe", "openfiles.exe", "omadmprc.exe", "omadmclient.exe", + "odbcconf.exe", "odbcad32.exe", "ocsetup.exe", "ntprint.exe", "ntoskrnl.exe", "nslookup.exe", + "notepad.exe", "nltest.exe", "newdev.exe", "netsh.exe", "netiougc.exe", "netcfg.exe", + "netbtugc.exe", "net1.exe", "net.exe", "ndadmin.exe", "nbtstat.exe", "mtstocom.exe", + "mstsc.exe", "msra.exe", "mspaint.exe", "msinfo32.exe", "msiexec.exe", "mshta.exe", + "msg.exe", "msfeedssync.exe", "msdtc.exe", "msdt.exe", "msconfig.exe", "mpnotify.exe", + "mountvol.exe", "mobsync.exe", "mmc.exe", "mfpmp.exe", "mctadmin.exe", "mcbuilder.exe", + "mblctr.exe", "manage-bde.exe", "makecab.exe", "lsm.exe", "lsass.exe", "lpremove.exe", + "lpksetup.exe", "lpkinstall.exe", "logoff.exe", "logman.exe", "logagent.exe", "lodctr.exe", + "licensingdiag.exe", "label.exe", "ktmutil.exe", "ksetup.exe", "klist.exe", "isoburn.exe", + "iscsicpl.exe", "iscsicli.exe", "irftp.exe", "ipconfig.exe", "immersivetpmvscmgrsvr.exe", + "iexpress.exe", "ieetwcollector.exe", "ieunatt.exe", "ie4uinit.exe", "icsunattend.exe", + "icardagt.exe", "icacls.exe", "hwrreg.exe", "hwrcomp.exe", "help.exe", "hdwwiz.exe", + "grpconv.exe", "gpupdate.exe", "gpscript.exe", "gpresult.exe", "getmac.exe", "fveprompt.exe", + "fvenotify.exe", "ftp.exe", "fsutil.exe", "fsquirt.exe", "fsavailux.exe", "forfiles.exe", + "fontview.exe", "fontdrvhost.exe", "fodhelper.exe", "fltmc.exe", "fixmapi.exe", + "finger.exe", "findstr.exe", "find.exe", "fhmanagew.exe", "fc.exe", "extrac32.exe", + "expand.exe", "eventvwr.exe", "eventcreate.exe", "eudcedit.exe", "esentutl.exe", + "embeddedapplauncher.exe", "efsui.exe", "easinvoker.exe", "dxdiag.exe", "dwm.exe", + "dvdupgrd.exe", "dvdplay.exe", "dstokenclean.exe", "dsregcmd.exe", "drvinst.exe", + "drvcfg.exe", "driverquery.exe", "dpnsvr.exe", "dpapimig.exe", "doskey.exe", "dnscacheugc.exe", + "dmclient.exe", "dmcfghost.exe", "dmcertinst.exe", "dllhst3g.exe", "dllhost.exe", + "djoin.exe", "dispdiag.exe", "diskraid.exe", "diskperf.exe", "diskpart.exe", "dinotify.exe", + "diantz.exe", "dialer.exe", "dfrgui.exe", "ddodiag.exe", "dcomcnfg.exe", "dccw.exe", + "dashost.exe", "cttunesvr.exe", "cttune.exe", "ctfmon.exe", "csrss.exe", "cscript.exe", + "credwiz.exe", "convert.exe", "control.exe", "consent.exe", "conhost.exe", "compact.exe", + "comp.exe", "colorcpl.exe", "cofire.exe", "cmstp.exe", "cmmon32.exe", "cmdl32.exe", + "cmdkey.exe", "cmd.exe", "clip.exe", "cliconfg.exe", "cleanmgr.exe", "cipher.exe", + "choice.exe", "chkntfs.exe", "chkdsk.exe", "chgusr.exe", "chgport.exe", "chglogon.exe", + "charmap.exe", "changepk.exe", "change.exe", "certutil.exe", "certreq.exe", "cdpreference.exe", + "calc.exe", "cacls.exe", "bthudtask.exe", "browser_broker.exe", "bridgeunattend.exe", + "bootsect.exe", "bootim.exe", "bootcfg.exe", "bitsadmin.exe", "bdeunlock.exe", "bdechangepin.exe", + "bcdedit.exe", "bcdboot.exe", "bcastdvr.exe", "backgroundtaskhost.exe", "baaupdate.exe", + "autofmt.exe", "autoconv.exe", "autochk.exe", "auditpol.exe", "audiodg.exe", "attrib.exe", + "at.exe", "appidpolicyconverter.exe", "appidcertstorecheck.exe", "alg.exe", "aitstatic.exe", + "aitagent.exe", "acu.exe", "wpcmon.exe", "workfolders.exe", "windowsupdateelevatedinstaller.exe", + "windowsanytimeupgradeui.exe", "windowsanytimeupgraderesults.exe", "windowsanytimeupgrade.exe", + "windowsactiondialog.exe", "windows.media.backgroundplayback.exe", "winsat.exe", + "werfaultsecure.exe", "werfault.exe", "webcache.exe", "wallpaperhost.exe", "wwahost.exe", + "wudfhost.exe", "wsreset.exe", "wsmanhttpconfig.exe", "wscollect.exe", "wpdshextautoplay.exe", + "wmpdmc.exe", "wfs.exe", "vaultsysui.exe", "vaultcmd.exe", "vssvc.exe", "utilman.exe", + "usoclient.exe", "useraccountcontrolsettings.exe", "useraccountbroker.exe", "upgraderesultsui.exe", + "ui0detect.exe", "tswpfwrp.exe", "tpminit.exe", "tokenbrokercookies.exe", "thumbnailextractionhost.exe", + "taskmgr.exe", "tapiunattend.exe", "tswbprxy.exe", "tstheme.exe", "tracert.exe", + "tcpsvcs.exe", "systemsettingsremovedevice.exe", "systemsettingsbroker.exe", "systemsettingsadminflows.exe", + "systempropertiesremote.exe", "systempropertiesprotection.exe", "systempropertiesperformance.exe", + "systempropertieshardware.exe", "systempropertiesdataexecutionprevention.exe", "systempropertiescomputername.exe", + "systempropertiesadvanced.exe", "sysreseterr.exe", "synchost.exe", "stikynot.exe", + "srtasks.exe", "sppextcomobj.exe", "spaceagent.exe", "soundrecorder.exe", "snippingtool.exe", + "sndvol.exe", "smartscreensettings.exe", "slidetoshutdown.exe", "settingsynchost.exe", + "setieinstalleddate.exe", "sensordataservice.exe", "secedit.exe", "searchprotocolhost.exe", + "searchindexer.exe", "searchfilterhost.exe", "sihclient.exe", "runtimebroker.exe", + "runlegacycplelevated.exe", "rpcping.exe", "rmclient.exe", "remoteposworker.exe", + "relpost.exe", "registeriepkeys.exe", "register-cimprovider.exe", "recoverydrive.exe", + "reagentc.exe", "rdpsauachelper.exe", "rdpsaproxy.exe", "rdpsa.exe", "route.exe", + "rmactivate_ssp_isv.exe", "rmactivate_ssp.exe", "rmactivate_isv.exe", "rmactivate.exe", + "rdspnf.exe", "proximityuxhost.exe", "printisolationhost.exe", "printdialoghost3d.exe", + "printdialoghost.exe", "printbrmui.exe", "presentationsettings.exe", "presentationhost.exe", + "pnputil.exe", "pnpunattend.exe", "pkgmgr.exe", "pickerhost.exe", "passwordonwakesettingflyout.exe", + "ping.exe", "pathping.exe", "optionalfeatures.exe", "openwith.exe", "networkuxbroker.exe", + "netplwiz.exe", "netproj.exe", "netevtfwdr.exe", "netcfgnotifyobjecthost.exe", "narrator.exe", + "netstat.exe", "napstat.exe", "musnotificationux.exe", "musnotification.exe", "multidigimon.exe", + "muiunattend.exe", "msspellcheckinghost.exe", "mpsigstub.exe", "migautoplay.exe", + "mdsched.exe", "mdres.exe", "mbaeparsertask.exe", "magnify.exe", "mschedexe.exe", + "mrt.exe", "mrinfo.exe", "mdmappinstaller.exe", "mdmagent.exe", "mdeserver.exe", + "lsaiso.exe", "logonui.exe", "lockscreencontentserver.exe", "lockapphost.exe", "locator.exe", + "locationnotifications.exe", "locationnotificationwindows.exe", "licensingui.exe", + "licensemanagershellext.exe", "legacynetuxhost.exe", "launchwinapp.exe", "launchtm.exe", + "languagecomponentsinstallercomhandler.exe", "installagent.exe", "infdefaultinstall.exe", + "icsentitlementhost.exe", "hostname.exe", "gettingstarted.exe", "genvalobj.exe", + "gamepanel.exe", "fondue.exe", "filehistory.exe", "fxsunatd.exe", "fxssvc.exe", + "fxscover.exe", "ehstorauthn.exe", "easeofaccessdialog.exe", "easpoliciesbrokerhost.exe", + "eap3host.exe", "eosnotify.exe", "edpcleanup.exe", "dxpserver.exe", "dsmusertask.exe", + "dpiscaling.exe", "dmomacpmo.exe", "dmnotificationbroker.exe", "displayswitch.exe", + "dism.exe", "disksnapshot.exe", "deviceproperties.exe", "devicepairingwizard.exe", + "deviceenroller.exe", "deviceeject.exe", "devicedisplayobjectprovider.exe", "defrag.exe", + "dataexchangehost.exe", "dwwin.exe", "dfdwiz.exe", "credentialuibroker.exe", "computerdefaults.exe", + "compattelrunner.exe", "compmgmtlauncher.exe", "cloudstoragewizard.exe", "cloudnotifications.exe", + "cloudexperiencehostbroker.exe", "clipup.exe", "checknetisolation.exe", "certenrollctrl.exe", + "castsrv.exe", "camerasettingsuihost.exe", "bytecodegenerator.exe", "bitlockerwizardelev.exe", + "bitlockerwizard.exe", "bitlockerdeviceencryption.exe", "bdeunlockwizard.exe", "bdeuisrv.exe", + "bdehdcfg.exe", "backgroundtransferhost.exe", "axinstui.exe", "autoworkplace.exe", + "authhost.exe", "atbroker.exe", "applicationframehost.exe", "adaptertroubleshooter.exe", + "arp.exe")) AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND + (NOT match(process_file_path, /(?i)\\windows\\system32/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index 58e4a72061..0246d7e2d6 100644 --- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -20,218 +20,118 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name="xwizard.exe" - OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" - OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" - OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" - OR process_file_name="write.exe" OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" - OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" - OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" - OR process_file_name="winver.exe" OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" - OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" - OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" - OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" - OR process_file_name="where.exe" OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" - OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" - OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" - OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" - OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" - OR process_file_name="vds.exe" OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" - OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" - OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" - OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" - OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" - OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" - OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe" - OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe" - OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe" - OR process_file_name="systeminfo.exe" OR process_file_name="syskey.exe" OR process_file_name="sxstrace.exe" - OR process_file_name="svchost.exe" OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe" - OR process_file_name="spreview.exe" OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe" - OR process_file_name="spinstall.exe" OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" - OR process_file_name="smss.exe" OR process_file_name="slui.exe" OR process_file_name="sihost.exe" - OR process_file_name="sigverif.exe" OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" - OR process_file_name="shadow.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" - OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe" - OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe" - OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe" - OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe" OR process_file_name="sc.exe" - OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe" - OR process_file_name="rundll32.exe" OR process_file_name="runas.exe" OR process_file_name="rstrui.exe" - OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe" - OR process_file_name="resmon.exe" OR process_file_name="reset.exe" OR process_file_name="replace.exe" - OR process_file_name="repair-bde.exe" OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe" - OR process_file_name="regsvr32.exe" OR process_file_name="regini.exe" OR process_file_name="regedt32.exe" - OR process_file_name="reg.exe" OR process_file_name="recover.exe" OR process_file_name="recdisc.exe" - OR process_file_name="rdrleakdiag.exe" OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe" - OR process_file_name="rasphone.exe" OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe" - OR process_file_name="rasautou.exe" OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe" - OR process_file_name="query.exe" OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe" - OR process_file_name="pwlauncher.exe" OR process_file_name="psr.exe" OR process_file_name="provtool.exe" - OR process_file_name="proquota.exe" OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe" - OR process_file_name="print.exe" OR process_file_name="prevhost.exe" OR process_file_name="powercfg.exe" - OR process_file_name="poqexec.exe" OR process_file_name="plasrv.exe" OR process_file_name="phoneactivate.exe" - OR process_file_name="perfmon.exe" OR process_file_name="pcwrun.exe" OR process_file_name="pcawrk.exe" - OR process_file_name="pcaui.exe" OR process_file_name="pcalua.exe" OR process_file_name="p2phost.exe" - OR process_file_name="osk.exe" OR process_file_name="openfiles.exe" OR process_file_name="omadmprc.exe" - OR process_file_name="omadmclient.exe" OR process_file_name="odbcconf.exe" OR process_file_name="odbcad32.exe" - OR process_file_name="ocsetup.exe" OR process_file_name="ntprint.exe" OR process_file_name="ntoskrnl.exe" - OR process_file_name="nslookup.exe" OR process_file_name="notepad.exe" OR process_file_name="nltest.exe" - OR process_file_name="newdev.exe" OR process_file_name="netsh.exe" OR process_file_name="netiougc.exe" - OR process_file_name="netcfg.exe" OR process_file_name="netbtugc.exe" OR process_file_name="net1.exe" - OR process_file_name="net.exe" OR process_file_name="ndadmin.exe" OR process_file_name="nbtstat.exe" - OR process_file_name="mtstocom.exe" OR process_file_name="mstsc.exe" OR process_file_name="msra.exe" - OR process_file_name="mspaint.exe" OR process_file_name="msinfo32.exe" OR process_file_name="msiexec.exe" - OR process_file_name="mshta.exe" OR process_file_name="msg.exe" OR process_file_name="msfeedssync.exe" - OR process_file_name="msdtc.exe" OR process_file_name="msdt.exe" OR process_file_name="msconfig.exe" - OR process_file_name="mpnotify.exe" OR process_file_name="mountvol.exe" OR process_file_name="mobsync.exe" - OR process_file_name="mmc.exe" OR process_file_name="mfpmp.exe" OR process_file_name="mctadmin.exe" - OR process_file_name="mcbuilder.exe" OR process_file_name="mblctr.exe" OR process_file_name="manage-bde.exe" - OR process_file_name="makecab.exe" OR process_file_name="lsm.exe" OR process_file_name="lsass.exe" - OR process_file_name="lpremove.exe" OR process_file_name="lpksetup.exe" OR process_file_name="lpkinstall.exe" - OR process_file_name="logoff.exe" OR process_file_name="logman.exe" OR process_file_name="logagent.exe" - OR process_file_name="lodctr.exe" OR process_file_name="licensingdiag.exe" OR process_file_name="label.exe" - OR process_file_name="ktmutil.exe" OR process_file_name="ksetup.exe" OR process_file_name="klist.exe" - OR process_file_name="isoburn.exe" OR process_file_name="iscsicpl.exe" OR process_file_name="iscsicli.exe" - OR process_file_name="irftp.exe" OR process_file_name="ipconfig.exe" OR process_file_name="immersivetpmvscmgrsvr.exe" - OR process_file_name="iexpress.exe" OR process_file_name="ieetwcollector.exe" OR - process_file_name="ieunatt.exe" OR process_file_name="ie4uinit.exe" OR process_file_name="icsunattend.exe" - OR process_file_name="icardagt.exe" OR process_file_name="icacls.exe" OR process_file_name="hwrreg.exe" - OR process_file_name="hwrcomp.exe" OR process_file_name="help.exe" OR process_file_name="hdwwiz.exe" - OR process_file_name="grpconv.exe" OR process_file_name="gpupdate.exe" OR process_file_name="gpscript.exe" - OR process_file_name="gpresult.exe" OR process_file_name="getmac.exe" OR process_file_name="fveprompt.exe" - OR process_file_name="fvenotify.exe" OR process_file_name="ftp.exe" OR process_file_name="fsutil.exe" - OR process_file_name="fsquirt.exe" OR process_file_name="fsavailux.exe" OR process_file_name="forfiles.exe" - OR process_file_name="fontview.exe" OR process_file_name="fontdrvhost.exe" OR process_file_name="fodhelper.exe" - OR process_file_name="fltmc.exe" OR process_file_name="fixmapi.exe" OR process_file_name="finger.exe" - OR process_file_name="findstr.exe" OR process_file_name="find.exe" OR process_file_name="fhmanagew.exe" - OR process_file_name="fc.exe" OR process_file_name="extrac32.exe" OR process_file_name="expand.exe" - OR process_file_name="eventvwr.exe" OR process_file_name="eventcreate.exe" OR process_file_name="eudcedit.exe" - OR process_file_name="esentutl.exe" OR process_file_name="embeddedapplauncher.exe" - OR process_file_name="efsui.exe" OR process_file_name="easinvoker.exe" OR process_file_name="dxdiag.exe" - OR process_file_name="dwm.exe" OR process_file_name="dvdupgrd.exe" OR process_file_name="dvdplay.exe" - OR process_file_name="dstokenclean.exe" OR process_file_name="dsregcmd.exe" OR process_file_name="drvinst.exe" - OR process_file_name="drvcfg.exe" OR process_file_name="driverquery.exe" OR process_file_name="dpnsvr.exe" - OR process_file_name="dpapimig.exe" OR process_file_name="doskey.exe" OR process_file_name="dnscacheugc.exe" - OR process_file_name="dmclient.exe" OR process_file_name="dmcfghost.exe" OR process_file_name="dmcertinst.exe" - OR process_file_name="dllhst3g.exe" OR process_file_name="dllhost.exe" OR process_file_name="djoin.exe" - OR process_file_name="dispdiag.exe" OR process_file_name="diskraid.exe" OR process_file_name="diskperf.exe" - OR process_file_name="diskpart.exe" OR process_file_name="dinotify.exe" OR process_file_name="diantz.exe" - OR process_file_name="dialer.exe" OR process_file_name="dfrgui.exe" OR process_file_name="ddodiag.exe" - OR process_file_name="dcomcnfg.exe" OR process_file_name="dccw.exe" OR process_file_name="dashost.exe" - OR process_file_name="cttunesvr.exe" OR process_file_name="cttune.exe" OR process_file_name="ctfmon.exe" - OR process_file_name="csrss.exe" OR process_file_name="cscript.exe" OR process_file_name="credwiz.exe" - OR process_file_name="convert.exe" OR process_file_name="control.exe" OR process_file_name="consent.exe" - OR process_file_name="conhost.exe" OR process_file_name="compact.exe" OR process_file_name="comp.exe" - OR process_file_name="colorcpl.exe" OR process_file_name="cofire.exe" OR process_file_name="cmstp.exe" - OR process_file_name="cmmon32.exe" OR process_file_name="cmdl32.exe" OR process_file_name="cmdkey.exe" - OR process_file_name="cmd.exe" OR process_file_name="clip.exe" OR process_file_name="cliconfg.exe" - OR process_file_name="cleanmgr.exe" OR process_file_name="cipher.exe" OR process_file_name="choice.exe" - OR process_file_name="chkntfs.exe" OR process_file_name="chkdsk.exe" OR process_file_name="chgusr.exe" - OR process_file_name="chgport.exe" OR process_file_name="chglogon.exe" OR process_file_name="charmap.exe" - OR process_file_name="changepk.exe" OR process_file_name="change.exe" OR process_file_name="certutil.exe" - OR process_file_name="certreq.exe" OR process_file_name="cdpreference.exe" OR process_file_name="calc.exe" - OR process_file_name="cacls.exe" OR process_file_name="bthudtask.exe" OR process_file_name="browser_broker.exe" - OR process_file_name="bridgeunattend.exe" OR process_file_name="bootsect.exe" OR - process_file_name="bootim.exe" OR process_file_name="bootcfg.exe" OR process_file_name="bitsadmin.exe" - OR process_file_name="bdeunlock.exe" OR process_file_name="bdechangepin.exe" OR - process_file_name="bcdedit.exe" OR process_file_name="bcdboot.exe" OR process_file_name="bcastdvr.exe" - OR process_file_name="backgroundtaskhost.exe" OR process_file_name="baaupdate.exe" - OR process_file_name="autofmt.exe" OR process_file_name="autoconv.exe" OR process_file_name="autochk.exe" - OR process_file_name="auditpol.exe" OR process_file_name="audiodg.exe" OR process_file_name="attrib.exe" - OR process_file_name="at.exe" OR process_file_name="appidpolicyconverter.exe" OR - process_file_name="appidcertstorecheck.exe" OR process_file_name="alg.exe" OR process_file_name="aitstatic.exe" - OR process_file_name="aitagent.exe" OR process_file_name="acu.exe" OR process_file_name="wpcmon.exe" - OR process_file_name="workfolders.exe" OR process_file_name="windowsupdateelevatedinstaller.exe" - OR process_file_name="windowsanytimeupgradeui.exe" OR process_file_name="windowsanytimeupgraderesults.exe" - OR process_file_name="windowsanytimeupgrade.exe" OR process_file_name="windowsactiondialog.exe" - OR process_file_name="windows.media.backgroundplayback.exe" OR process_file_name="winsat.exe" - OR process_file_name="werfaultsecure.exe" OR process_file_name="werfault.exe" OR - process_file_name="webcache.exe" OR process_file_name="wallpaperhost.exe" OR process_file_name="wwahost.exe" - OR process_file_name="wudfhost.exe" OR process_file_name="wsreset.exe" OR process_file_name="wsmanhttpconfig.exe" - OR process_file_name="wscollect.exe" OR process_file_name="wpdshextautoplay.exe" - OR process_file_name="wmpdmc.exe" OR process_file_name="wfs.exe" OR process_file_name="vaultsysui.exe" - OR process_file_name="vaultcmd.exe" OR process_file_name="vssvc.exe" OR process_file_name="utilman.exe" - OR process_file_name="usoclient.exe" OR process_file_name="useraccountcontrolsettings.exe" - OR process_file_name="useraccountbroker.exe" OR process_file_name="upgraderesultsui.exe" - OR process_file_name="ui0detect.exe" OR process_file_name="tswpfwrp.exe" OR process_file_name="tpminit.exe" - OR process_file_name="tokenbrokercookies.exe" OR process_file_name="thumbnailextractionhost.exe" - OR process_file_name="taskmgr.exe" OR process_file_name="tapiunattend.exe" OR process_file_name="tswbprxy.exe" - OR process_file_name="tstheme.exe" OR process_file_name="tracert.exe" OR process_file_name="tcpsvcs.exe" - OR process_file_name="systemsettingsremovedevice.exe" OR process_file_name="systemsettingsbroker.exe" - OR process_file_name="systemsettingsadminflows.exe" OR process_file_name="systempropertiesremote.exe" - OR process_file_name="systempropertiesprotection.exe" OR process_file_name="systempropertiesperformance.exe" - OR process_file_name="systempropertieshardware.exe" OR process_file_name="systempropertiesdataexecutionprevention.exe" - OR process_file_name="systempropertiescomputername.exe" OR process_file_name="systempropertiesadvanced.exe" - OR process_file_name="sysreseterr.exe" OR process_file_name="synchost.exe" OR process_file_name="stikynot.exe" - OR process_file_name="srtasks.exe" OR process_file_name="sppextcomobj.exe" OR process_file_name="spaceagent.exe" - OR process_file_name="soundrecorder.exe" OR process_file_name="snippingtool.exe" - OR process_file_name="sndvol.exe" OR process_file_name="smartscreensettings.exe" - OR process_file_name="slidetoshutdown.exe" OR process_file_name="settingsynchost.exe" - OR process_file_name="setieinstalleddate.exe" OR process_file_name="sensordataservice.exe" - OR process_file_name="secedit.exe" OR process_file_name="searchprotocolhost.exe" - OR process_file_name="searchindexer.exe" OR process_file_name="searchfilterhost.exe" - OR process_file_name="sihclient.exe" OR process_file_name="runtimebroker.exe" OR - process_file_name="runlegacycplelevated.exe" OR process_file_name="rpcping.exe" - OR process_file_name="rmclient.exe" OR process_file_name="remoteposworker.exe" OR - process_file_name="relpost.exe" OR process_file_name="registeriepkeys.exe" OR process_file_name="register-cimprovider.exe" - OR process_file_name="recoverydrive.exe" OR process_file_name="reagentc.exe" OR - process_file_name="rdpsauachelper.exe" OR process_file_name="rdpsaproxy.exe" OR - process_file_name="rdpsa.exe" OR process_file_name="route.exe" OR process_file_name="rmactivate_ssp_isv.exe" - OR process_file_name="rmactivate_ssp.exe" OR process_file_name="rmactivate_isv.exe" - OR process_file_name="rmactivate.exe" OR process_file_name="rdspnf.exe" OR process_file_name="proximityuxhost.exe" - OR process_file_name="printisolationhost.exe" OR process_file_name="printdialoghost3d.exe" - OR process_file_name="printdialoghost.exe" OR process_file_name="printbrmui.exe" - OR process_file_name="presentationsettings.exe" OR process_file_name="presentationhost.exe" - OR process_file_name="pnputil.exe" OR process_file_name="pnpunattend.exe" OR process_file_name="pkgmgr.exe" - OR process_file_name="pickerhost.exe" OR process_file_name="passwordonwakesettingflyout.exe" - OR process_file_name="ping.exe" OR process_file_name="pathping.exe" OR process_file_name="optionalfeatures.exe" - OR process_file_name="openwith.exe" OR process_file_name="networkuxbroker.exe" OR - process_file_name="netplwiz.exe" OR process_file_name="netproj.exe" OR process_file_name="netevtfwdr.exe" - OR process_file_name="netcfgnotifyobjecthost.exe" OR process_file_name="narrator.exe" - OR process_file_name="netstat.exe" OR process_file_name="napstat.exe" OR process_file_name="musnotificationux.exe" - OR process_file_name="musnotification.exe" OR process_file_name="multidigimon.exe" - OR process_file_name="muiunattend.exe" OR process_file_name="msspellcheckinghost.exe" - OR process_file_name="mpsigstub.exe" OR process_file_name="migautoplay.exe" OR process_file_name="mdsched.exe" - OR process_file_name="mdres.exe" OR process_file_name="mbaeparsertask.exe" OR process_file_name="magnify.exe" - OR process_file_name="mschedexe.exe" OR process_file_name="mrt.exe" OR process_file_name="mrinfo.exe" - OR process_file_name="mdmappinstaller.exe" OR process_file_name="mdmagent.exe" OR - process_file_name="mdeserver.exe" OR process_file_name="lsaiso.exe" OR process_file_name="logonui.exe" - OR process_file_name="lockscreencontentserver.exe" OR process_file_name="lockapphost.exe" - OR process_file_name="locator.exe" OR process_file_name="locationnotifications.exe" - OR process_file_name="locationnotificationwindows.exe" OR process_file_name="licensingui.exe" - OR process_file_name="licensemanagershellext.exe" OR process_file_name="legacynetuxhost.exe" - OR process_file_name="launchwinapp.exe" OR process_file_name="launchtm.exe" OR process_file_name="languagecomponentsinstallercomhandler.exe" - OR process_file_name="installagent.exe" OR process_file_name="infdefaultinstall.exe" - OR process_file_name="icsentitlementhost.exe" OR process_file_name="hostname.exe" - OR process_file_name="gettingstarted.exe" OR process_file_name="genvalobj.exe" OR - process_file_name="gamepanel.exe" OR process_file_name="fondue.exe" OR process_file_name="filehistory.exe" - OR process_file_name="fxsunatd.exe" OR process_file_name="fxssvc.exe" OR process_file_name="fxscover.exe" - OR process_file_name="ehstorauthn.exe" OR process_file_name="easeofaccessdialog.exe" - OR process_file_name="easpoliciesbrokerhost.exe" OR process_file_name="eap3host.exe" - OR process_file_name="eosnotify.exe" OR process_file_name="edpcleanup.exe" OR process_file_name="dxpserver.exe" - OR process_file_name="dsmusertask.exe" OR process_file_name="dpiscaling.exe" OR - process_file_name="dmomacpmo.exe" OR process_file_name="dmnotificationbroker.exe" - OR process_file_name="displayswitch.exe" OR process_file_name="dism.exe" OR process_file_name="disksnapshot.exe" - OR process_file_name="deviceproperties.exe" OR process_file_name="devicepairingwizard.exe" - OR process_file_name="deviceenroller.exe" OR process_file_name="deviceeject.exe" - OR process_file_name="devicedisplayobjectprovider.exe" OR process_file_name="defrag.exe" - OR process_file_name="dataexchangehost.exe" OR process_file_name="dwwin.exe" OR - process_file_name="dfdwiz.exe" OR process_file_name="credentialuibroker.exe" OR - process_file_name="computerdefaults.exe" OR process_file_name="compattelrunner.exe" - OR process_file_name="compmgmtlauncher.exe" OR process_file_name="cloudstoragewizard.exe" - OR process_file_name="cloudnotifications.exe" OR process_file_name="cloudexperiencehostbroker.exe" - OR process_file_name="clipup.exe" OR process_file_name="checknetisolation.exe" OR - process_file_name="certenrollctrl.exe" OR process_file_name="castsrv.exe" OR process_file_name="camerasettingsuihost.exe" - OR process_file_name="bytecodegenerator.exe" OR process_file_name="bitlockerwizardelev.exe" - OR process_file_name="bitlockerwizard.exe" OR process_file_name="bitlockerdeviceencryption.exe" - OR process_file_name="bdeunlockwizard.exe" OR process_file_name="bdeuisrv.exe" OR - process_file_name="bdehdcfg.exe" OR process_file_name="backgroundtransferhost.exe" - OR process_file_name="axinstui.exe" OR process_file_name="autoworkplace.exe" OR - process_file_name="authhost.exe" OR process_file_name="atbroker.exe" OR process_file_name="applicationframehost.exe" - OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe") - AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT match(process_file_path, - /(?i)\\windows\\system32/)=true) --finding_report--' + | eval device_hostname = device.hostname | where (process_file_name IN ("xwizard.exe", + "xpsrchvw.exe", "xcopy.exe", "wusa.exe", "wuauclt.exe", "wuapp.exe", "wuapihost.exe", + "wsqmcons.exe", "wsmprovhost.exe", "wscript.exe", "write.exe", "wpr.exe", "wpnpinst.exe", + "wowreg32.exe", "wlrmdr.exe", "wlanext.exe", "wksprt.exe", "wkspbroker.exe", "wisptis.exe", + "winver.exe", "winrshost.exe", "winrs.exe", "winresume.exe", "winlogon.exe", "winload.exe", + "wininit.exe", "wimserv.exe", "wifitask.exe", "wiawow64.exe", "wiaacmgr.exe", "whoami.exe", + "where.exe", "wextract.exe", "wevtutil.exe", "wermgr.exe", "wecutil.exe", "wbengine.exe", + "wbadmin.exe", "waitfor.exe", "w32tm.exe", "vssadmin.exe", "vmicsvc.exe", "verifiergui.exe", + "verifier.exe", "verclsid.exe", "vdsldr.exe", "vds.exe", "userinit.exe", "upnpcont.exe", + "unregmp2.exe", "unlodctr.exe", "ucsvc.exe", "tzutil.exe", "tzsync.exe", "typeperf.exe", + "tskill.exe", "tsdiscon.exe", "tscon.exe", "tracerpt.exe", "tpmvscmgrsvr.exe", "tpmvscmgr.exe", + "timeout.exe", "tcmsetup.exe", "taskmgr.exe", "tasklist.exe", "taskkill.exe", "taskhostw.exe", + "taskhost.exe", "taskeng.exe", "takeown.exe", "tabcal.exe", "systray.exe", "systemreset.exe", + "systeminfo.exe", "syskey.exe", "sxstrace.exe", "svchost.exe", "subst.exe", "srdelayed.exe", + "spreview.exe", "sppsvc.exe", "spoolsv.exe", "spinstall.exe", "sort.exe", "snmptrap.exe", + "smss.exe", "slui.exe", "sihost.exe", "sigverif.exe", "shutdown.exe", "shrpubw.exe", + "shadow.exe", "setx.exe", "setupugc.exe", "setupcl.exe", "setspn.exe", "sethc.exe", + "sessionmsg.exe", "services.exe", "secinit.exe", "sdiagnhost.exe", "sdclt.exe", + "sdchange.exe", "sdbinst.exe", "schtasks.exe", "sc.exe", "sbunattend.exe", "rwinsta.exe", + "runonce.exe", "rundll32.exe", "runas.exe", "rstrui.exe", "rrinstaller.exe", "rmttpmvscmgrsvr.exe", + "resmon.exe", "reset.exe", "replace.exe", "repair-bde.exe", "relog.exe", "rekeywiz.exe", + "regsvr32.exe", "regini.exe", "regedt32.exe", "reg.exe", "recover.exe", "recdisc.exe", + "rdrleakdiag.exe", "rdpinput.exe", "rdpclip.exe", "rasphone.exe", "raserver.exe", + "rasdial.exe", "rasautou.exe", "qwinsta.exe", "quser.exe", "query.exe", "qprocess.exe", + "qappsrv.exe", "pwlauncher.exe", "psr.exe", "provtool.exe", "proquota.exe", "printui.exe", + "printfilterpipelinesvc.exe", "print.exe", "prevhost.exe", "powercfg.exe", "poqexec.exe", + "plasrv.exe", "phoneactivate.exe", "perfmon.exe", "pcwrun.exe", "pcawrk.exe", "pcaui.exe", + "pcalua.exe", "p2phost.exe", "osk.exe", "openfiles.exe", "omadmprc.exe", "omadmclient.exe", + "odbcconf.exe", "odbcad32.exe", "ocsetup.exe", "ntprint.exe", "ntoskrnl.exe", "nslookup.exe", + "notepad.exe", "nltest.exe", "newdev.exe", "netsh.exe", "netiougc.exe", "netcfg.exe", + "netbtugc.exe", "net1.exe", "net.exe", "ndadmin.exe", "nbtstat.exe", "mtstocom.exe", + "mstsc.exe", "msra.exe", "mspaint.exe", "msinfo32.exe", "msiexec.exe", "mshta.exe", + "msg.exe", "msfeedssync.exe", "msdtc.exe", "msdt.exe", "msconfig.exe", "mpnotify.exe", + "mountvol.exe", "mobsync.exe", "mmc.exe", "mfpmp.exe", "mctadmin.exe", "mcbuilder.exe", + "mblctr.exe", "manage-bde.exe", "makecab.exe", "lsm.exe", "lsass.exe", "lpremove.exe", + "lpksetup.exe", "lpkinstall.exe", "logoff.exe", "logman.exe", "logagent.exe", "lodctr.exe", + "licensingdiag.exe", "label.exe", "ktmutil.exe", "ksetup.exe", "klist.exe", "isoburn.exe", + "iscsicpl.exe", "iscsicli.exe", "irftp.exe", "ipconfig.exe", "immersivetpmvscmgrsvr.exe", + "iexpress.exe", "ieetwcollector.exe", "ieunatt.exe", "ie4uinit.exe", "icsunattend.exe", + "icardagt.exe", "icacls.exe", "hwrreg.exe", "hwrcomp.exe", "help.exe", "hdwwiz.exe", + "grpconv.exe", "gpupdate.exe", "gpscript.exe", "gpresult.exe", "getmac.exe", "fveprompt.exe", + "fvenotify.exe", "ftp.exe", "fsutil.exe", "fsquirt.exe", "fsavailux.exe", "forfiles.exe", + "fontview.exe", "fontdrvhost.exe", "fodhelper.exe", "fltmc.exe", "fixmapi.exe", + "finger.exe", "findstr.exe", "find.exe", "fhmanagew.exe", "fc.exe", "extrac32.exe", + "expand.exe", "eventvwr.exe", "eventcreate.exe", "eudcedit.exe", "esentutl.exe", + "embeddedapplauncher.exe", "efsui.exe", "easinvoker.exe", "dxdiag.exe", "dwm.exe", + "dvdupgrd.exe", "dvdplay.exe", "dstokenclean.exe", "dsregcmd.exe", "drvinst.exe", + "drvcfg.exe", "driverquery.exe", "dpnsvr.exe", "dpapimig.exe", "doskey.exe", "dnscacheugc.exe", + "dmclient.exe", "dmcfghost.exe", "dmcertinst.exe", "dllhst3g.exe", "dllhost.exe", + "djoin.exe", "dispdiag.exe", "diskraid.exe", "diskperf.exe", "diskpart.exe", "dinotify.exe", + "diantz.exe", "dialer.exe", "dfrgui.exe", "ddodiag.exe", "dcomcnfg.exe", "dccw.exe", + "dashost.exe", "cttunesvr.exe", "cttune.exe", "ctfmon.exe", "csrss.exe", "cscript.exe", + "credwiz.exe", "convert.exe", "control.exe", "consent.exe", "conhost.exe", "compact.exe", + "comp.exe", "colorcpl.exe", "cofire.exe", "cmstp.exe", "cmmon32.exe", "cmdl32.exe", + "cmdkey.exe", "cmd.exe", "clip.exe", "cliconfg.exe", "cleanmgr.exe", "cipher.exe", + "choice.exe", "chkntfs.exe", "chkdsk.exe", "chgusr.exe", "chgport.exe", "chglogon.exe", + "charmap.exe", "changepk.exe", "change.exe", "certutil.exe", "certreq.exe", "cdpreference.exe", + "calc.exe", "cacls.exe", "bthudtask.exe", "browser_broker.exe", "bridgeunattend.exe", + "bootsect.exe", "bootim.exe", "bootcfg.exe", "bitsadmin.exe", "bdeunlock.exe", "bdechangepin.exe", + "bcdedit.exe", "bcdboot.exe", "bcastdvr.exe", "backgroundtaskhost.exe", "baaupdate.exe", + "autofmt.exe", "autoconv.exe", "autochk.exe", "auditpol.exe", "audiodg.exe", "attrib.exe", + "at.exe", "appidpolicyconverter.exe", "appidcertstorecheck.exe", "alg.exe", "aitstatic.exe", + "aitagent.exe", "acu.exe", "wpcmon.exe", "workfolders.exe", "windowsupdateelevatedinstaller.exe", + "windowsanytimeupgradeui.exe", "windowsanytimeupgraderesults.exe", "windowsanytimeupgrade.exe", + "windowsactiondialog.exe", "windows.media.backgroundplayback.exe", "winsat.exe", + "werfaultsecure.exe", "werfault.exe", "webcache.exe", "wallpaperhost.exe", "wwahost.exe", + "wudfhost.exe", "wsreset.exe", "wsmanhttpconfig.exe", "wscollect.exe", "wpdshextautoplay.exe", + "wmpdmc.exe", "wfs.exe", "vaultsysui.exe", "vaultcmd.exe", "vssvc.exe", "utilman.exe", + "usoclient.exe", "useraccountcontrolsettings.exe", "useraccountbroker.exe", "upgraderesultsui.exe", + "ui0detect.exe", "tswpfwrp.exe", "tpminit.exe", "tokenbrokercookies.exe", "thumbnailextractionhost.exe", + "taskmgr.exe", "tapiunattend.exe", "tswbprxy.exe", "tstheme.exe", "tracert.exe", + "tcpsvcs.exe", "systemsettingsremovedevice.exe", "systemsettingsbroker.exe", "systemsettingsadminflows.exe", + "systempropertiesremote.exe", "systempropertiesprotection.exe", "systempropertiesperformance.exe", + "systempropertieshardware.exe", "systempropertiesdataexecutionprevention.exe", "systempropertiescomputername.exe", + "systempropertiesadvanced.exe", "sysreseterr.exe", "synchost.exe", "stikynot.exe", + "srtasks.exe", "sppextcomobj.exe", "spaceagent.exe", "soundrecorder.exe", "snippingtool.exe", + "sndvol.exe", "smartscreensettings.exe", "slidetoshutdown.exe", "settingsynchost.exe", + "setieinstalleddate.exe", "sensordataservice.exe", "secedit.exe", "searchprotocolhost.exe", + "searchindexer.exe", "searchfilterhost.exe", "sihclient.exe", "runtimebroker.exe", + "runlegacycplelevated.exe", "rpcping.exe", "rmclient.exe", "remoteposworker.exe", + "relpost.exe", "registeriepkeys.exe", "register-cimprovider.exe", "recoverydrive.exe", + "reagentc.exe", "rdpsauachelper.exe", "rdpsaproxy.exe", "rdpsa.exe", "route.exe", + "rmactivate_ssp_isv.exe", "rmactivate_ssp.exe", "rmactivate_isv.exe", "rmactivate.exe", + "rdspnf.exe", "proximityuxhost.exe", "printisolationhost.exe", "printdialoghost3d.exe", + "printdialoghost.exe", "printbrmui.exe", "presentationsettings.exe", "presentationhost.exe", + "pnputil.exe", "pnpunattend.exe", "pkgmgr.exe", "pickerhost.exe", "passwordonwakesettingflyout.exe", + "ping.exe", "pathping.exe", "optionalfeatures.exe", "openwith.exe", "networkuxbroker.exe", + "netplwiz.exe", "netproj.exe", "netevtfwdr.exe", "netcfgnotifyobjecthost.exe", "narrator.exe", + "netstat.exe", "napstat.exe", "musnotificationux.exe", "musnotification.exe", "multidigimon.exe", + "muiunattend.exe", "msspellcheckinghost.exe", "mpsigstub.exe", "migautoplay.exe", + "mdsched.exe", "mdres.exe", "mbaeparsertask.exe", "magnify.exe", "mschedexe.exe", + "mrt.exe", "mrinfo.exe", "mdmappinstaller.exe", "mdmagent.exe", "mdeserver.exe", + "lsaiso.exe", "logonui.exe", "lockscreencontentserver.exe", "lockapphost.exe", "locator.exe", + "locationnotifications.exe", "locationnotificationwindows.exe", "licensingui.exe", + "licensemanagershellext.exe", "legacynetuxhost.exe", "launchwinapp.exe", "launchtm.exe", + "languagecomponentsinstallercomhandler.exe", "installagent.exe", "infdefaultinstall.exe", + "icsentitlementhost.exe", "hostname.exe", "gettingstarted.exe", "genvalobj.exe", + "gamepanel.exe", "fondue.exe", "filehistory.exe", "fxsunatd.exe", "fxssvc.exe", + "fxscover.exe", "ehstorauthn.exe", "easeofaccessdialog.exe", "easpoliciesbrokerhost.exe", + "eap3host.exe", "eosnotify.exe", "edpcleanup.exe", "dxpserver.exe", "dsmusertask.exe", + "dpiscaling.exe", "dmomacpmo.exe", "dmnotificationbroker.exe", "displayswitch.exe", + "dism.exe", "disksnapshot.exe", "deviceproperties.exe", "devicepairingwizard.exe", + "deviceenroller.exe", "deviceeject.exe", "devicedisplayobjectprovider.exe", "defrag.exe", + "dataexchangehost.exe", "dwwin.exe", "dfdwiz.exe", "credentialuibroker.exe", "computerdefaults.exe", + "compattelrunner.exe", "compmgmtlauncher.exe", "cloudstoragewizard.exe", "cloudnotifications.exe", + "cloudexperiencehostbroker.exe", "clipup.exe", "checknetisolation.exe", "certenrollctrl.exe", + "castsrv.exe", "camerasettingsuihost.exe", "bytecodegenerator.exe", "bitlockerwizardelev.exe", + "bitlockerwizard.exe", "bitlockerdeviceencryption.exe", "bdeunlockwizard.exe", "bdeuisrv.exe", + "bdehdcfg.exe", "backgroundtransferhost.exe", "axinstui.exe", "autoworkplace.exe", + "authhost.exe", "atbroker.exe", "applicationframehost.exe", "adaptertroubleshooter.exe", + "arp.exe")) AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND + (NOT match(process_file_path, /(?i)\\windows\\system32/)=true) --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: None references: [] From 3d55d6061b5ba1c96d9ae74ec9d2be8c2f7b5795 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 14 Aug 2023 12:46:35 +0200 Subject: [PATCH 07/14] Improved windows powershell hidden detection --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index f580d559a3..185c485bc6 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -26,7 +26,7 @@ search: - pwsh.exe - pwsh.exe selection2: - process.cmd_line|re: (?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-] + process.cmd_line|re: '[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+' condition: selection1 and selection2 how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 80aa84648f..9e113066db 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -20,7 +20,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, - /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true + /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 8b565f275c..bfedc21e2c 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -26,7 +26,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, - /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true --finding_report--' + /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. From fcb174d163798677b82bb09177c6e376c277ee84 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 18 Aug 2023 13:34:14 +0200 Subject: [PATCH 08/14] bug fix --- .../builder/backend_splunk_ba.py | 2 +- ...ted_credential_dump_from_registry_via_reg_exe.yml | 12 ++++++------ ...rshell_connect_to_internet_with_hidden_window.yml | 2 +- ...rshell_connect_to_internet_with_hidden_window.yml | 2 +- .../endpoint/ssa___windows_remote_create_service.yml | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index 1333e0cc4d..b6d745b595 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -34,7 +34,7 @@ class SplunkBABackend(TextQueryBackend): add_escaped : ClassVar[str] = "\\" re_expression : ClassVar[str] = "match({field}, /(?i){regex}/)=true" - re_escape_char : ClassVar[str] = "\\" + re_escape_char : ClassVar[str] = "" re_escape : ClassVar[Tuple[str]] = ('"',) cidr_expression : ClassVar[str] = "{value}" diff --git a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index d5f7875df1..63be50fb9f 100644 --- a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -17,12 +17,12 @@ search: - cmd.exe selection2: process.cmd_line|re: - - HKEY_LOCAL_MACHINE\System - - HKEY_LOCAL_MACHINE\SAM - - HKEY_LOCAL_MACHINE\Security - - HKLM\System - - HKLM\SAM - - HKLM\Security + - HKEY_LOCAL_MACHINE\\System + - HKEY_LOCAL_MACHINE\\SAM + - HKEY_LOCAL_MACHINE\\Security + - HKLM\\System + - HKLM\\SAM + - HKLM\\Security selection3: process.cmd_line|re: save condition: selection1 and (selection2) and selection3 diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 9e113066db..86140ae90b 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -20,7 +20,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, - /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true + /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index bfedc21e2c..d69a5fb387 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -26,7 +26,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, - /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true --finding_report--' + /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml index 74de00e694..82a3000a0b 100644 --- a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml +++ b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)create/)=true - OR match(process_cmd_line, /(?i)\\\\/)=true) AND process_file_name="sc.exe" --finding_report--' + OR match(process_cmd_line, /(?i)\\/)=true) AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, From 0c2ee7d288ebd7e586d39c5e49ac4f0ab4f41c84 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 13 Sep 2023 11:25:18 +0200 Subject: [PATCH 09/14] njrat --- ...ound_traffic_by_firewall_rule_registry.yml | 1 + .../allow_network_discovery_in_firewall.yml | 1 + ...cmd_carry_out_string_command_parameter.yml | 1 + .../endpoint/excessive_usage_of_taskkill.yml | 1 + ..._or_script_creation_in_suspicious_path.yml | 1 + .../firewall_allowed_program_enable.yml | 1 + ...e_process_accessing_chrome_default_dir.yml | 1 + ...fox_process_access_firefox_profile_dir.yml | 2 ++ ...script_contains_base64_encoded_content.yml | 1 + .../registry_keys_used_for_persistence.yml | 1 + ...eduled_task_deleted_or_created_via_cmd.yml | 1 + ..._autostart_execution_in_startup_folder.yml | 1 + ...ssword_stores_chrome_localstate_access.yml | 1 + ...ssword_stores_chrome_login_data_access.yml | 1 + ...ws_raw_access_to_disk_volume_partition.yml | 1 + ...raw_access_to_master_boot_record_drive.yml | 1 + ...ws_replication_through_removable_media.yml | 24 ++++++++--------- .../windows_system_logoff_commandline.yml | 3 ++- .../windows_system_reboot_commandline.yml | 3 ++- .../windows_system_shutdown_commandline.yml | 3 ++- .../windows_unsigned_dll_side_loading.yml | 3 ++- ...pt_or_cscript_suspicious_child_process.yml | 1 + stories/njrat.yml | 26 +++++++++++++++++++ 23 files changed, 64 insertions(+), 16 deletions(-) create mode 100644 stories/njrat.yml diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 72fac955c1..b41aa519dd 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -29,6 +29,7 @@ tags: - Prohibited Traffic Allowed or Protocol Mismatch - Windows Registry Abuse - Azorult + - NjRAT asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index 13fc33529a..bbf50765ba 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -33,6 +33,7 @@ tags: - Ransomware - Revil Ransomware - BlackByte Ransomware + - NjRAT asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 036a01fc20..fe126c5ee7 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -46,6 +46,7 @@ tags: - Azorult - Data Destruction - Warzone RAT + - NjRAT asset_type: Endpoint automated_detection_testing: passed confidence: 50 diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 73937a219d..4b0d1e539c 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -31,6 +31,7 @@ tags: - CISA AA22-264A - AgentTesla - CISA AA22-277A + - NjRAT asset_type: Endpoint confidence: 70 impact: 40 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index cf58957157..5f81c219c1 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -62,6 +62,7 @@ tags: - Amadey - BlackByte Ransomware - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 50 impact: 40 diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index 41cb565451..302e17d20f 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -34,6 +34,7 @@ tags: - Windows Defense Evasion Tactics - Azorult - BlackByte Ransomware + - NjRAT asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 0823d14c8f..f4632537f6 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -34,6 +34,7 @@ tags: - RedLine Stealer - FIN7 - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 70 impact: 50 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 25dded39df..8eefc06bef 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -34,6 +34,8 @@ tags: - AgentTesla - RedLine Stealer - FIN7 + - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 70 impact: 50 diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index f1bfcbf548..48d40271d2 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -44,6 +44,7 @@ tags: - AsyncRAT - Data Destruction - IcedID + - NjRAT confidence: 80 impact: 70 message: A suspicious powershell script contains base64 command in $ScriptBlockText$ diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 8e119c4e3c..2b457ad733 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -69,6 +69,7 @@ tags: - Sneaky Active Directory Persistence Tricks - BlackByte Ransomware - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 95 impact: 80 diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 8505c38fb5..81e592bf47 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -46,6 +46,7 @@ tags: - Azorult - Amadey - Scheduled Tasks + - NjRAT asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 515e19a157..c0e6e1c831 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Chaos Ransomware + - NjRAT asset_type: Endpoint confidence: 90 impact: 90 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index 42d159f29f..d1f7a5dcea 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -30,6 +30,7 @@ tags: - RedLine Stealer - Amadey - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index df3f1faa77..502c92cc19 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -30,6 +30,7 @@ tags: - RedLine Stealer - Amadey - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 6e41f44515..af21195353 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -33,6 +33,7 @@ tags: - Hermetic Wiper - Caddy Wiper - BlackByte Ransomware + - NjRAT asset_type: Endpoint confidence: 100 impact: 90 diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index e9ddffbcac..1cf01ee891 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -36,6 +36,7 @@ tags: - Hermetic Wiper - Caddy Wiper - BlackByte Ransomware + - NjRAT asset_type: Endpoint confidence: 100 impact: 90 diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index 54bc7b0cf6..7cb4039141 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -1,7 +1,7 @@ name: Windows Replication Through Removable Media id: 60df805d-4605-41c8-bbba-57baa6a4eb97 version: 1 -date: '2023-01-17' +date: '2023-09-07' author: Teoderick Contreras, Splunk status: production type: TTP @@ -18,17 +18,16 @@ description: This analytic is developed to detect suspicious executable or scrip and the reason why that executable or scripts are dropped in the root drive. data_source: - Sysmon Event ID 11 -search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = *.exe - OR Filesystem.file_name = *.dll OR Filesystem.file_name = *.sys OR Filesystem.file_name - = *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name = *.vbe OR Filesystem.file_name - = *.js OR Filesystem.file_name= *.bat OR Filesystem.file_name = *.cmd OR Filesystem.file_name - = *.pif) by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name - Filesystem.file_path Filesystem.user | `drop_dm_object_name(Filesystem)` | eval - dropped_file_path = split(file_path, "\\") | eval dropped_file_path_split_count - = mvcount(dropped_file_path) | eval root_drive = mvindex(dropped_file_path,0) | - where LIKE(root_drive, "%:") AND dropped_file_path_split_count = 2 AND root_drive!= - "C:" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.user + | `drop_dm_object_name(Filesystem)` + | eval dropped_file_path = split(file_path, "\\") + | eval dropped_file_path_split_count = mvcount(dropped_file_path) + | eval root_drive = mvindex(dropped_file_path,0) + | where LIKE(root_drive, "%:") AND dropped_file_path_split_count = 2 AND root_drive!= "C:" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_replication_through_removable_media_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from @@ -41,6 +40,7 @@ references: tags: analytic_story: - Chaos Ransomware + - NjRAT asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml index f611623f10..1308add224 100644 --- a/detections/endpoint/windows_system_logoff_commandline.yml +++ b/detections/endpoint/windows_system_logoff_commandline.yml @@ -16,7 +16,7 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) - Processes.process="*shutdown*" Processes.process="* /l*" Processes.process="* /t*" + Processes.process="*shutdown*" Processes.process IN ("* /l*", "* -l*") Processes.process IN ("* /t*","* -t*","* /f*","* -f*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -34,6 +34,7 @@ references: tags: analytic_story: - DarkCrystal RAT + - NjRAT asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml index f12df962ab..5e2eaf24c3 100644 --- a/detections/endpoint/windows_system_reboot_commandline.yml +++ b/detections/endpoint/windows_system_reboot_commandline.yml @@ -17,7 +17,7 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) - Processes.process="*shutdown*" Processes.process="* /r*" Processes.process="* /t*" + Processes.process="*shutdown*" Processes.process IN ("* /r*", "* -r*") Processes.process IN ("* /t*","* -t*","* /f*","* -f*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -35,6 +35,7 @@ references: tags: analytic_story: - DarkCrystal RAT + - NjRAT asset_type: Endpoint confidence: 50 impact: 60 diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml index 32d0824149..4b704fe2da 100644 --- a/detections/endpoint/windows_system_shutdown_commandline.yml +++ b/detections/endpoint/windows_system_shutdown_commandline.yml @@ -19,7 +19,7 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) - Processes.process="*shutdown*" AND Processes.process IN("* /s*", "* -s*", "* /r*", "* -r*") AND Processes.process="* /t*" + Processes.process="*shutdown*" AND Processes.process IN("* /s*", "* -s*") AND Processes.process IN ("* /t*","* -t*","* /f*","* -f*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -38,6 +38,7 @@ tags: analytic_story: - DarkCrystal RAT - Sandworm Tools + - NjRAT asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index 25159dabc3..1c20577301 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -7,7 +7,7 @@ status: production type: Anomaly data_source: - Sysmon Event ID 7 -description: This analysis focuses on detecting potentially malicious unsigned DLLs created in either the c:\windows\system32 or c:\windows\syswow64 folders. +description: This analytic focuses on detecting potentially malicious unsigned DLLs created in either the c:\windows\system32 or c:\windows\syswow64 folders. This particular technique was observed in the context of the Warzone (Ave Maria) RAT, where it employed a method known as DLL hijacking (dll-side-loading) by dropping the "dismcore.dll" to achieve privilege escalation. DLL hijacking is a stealthy attack technique used by cybercriminals to exploit the way Windows searches and loads DLLs. By placing a malicious DLL with the @@ -30,6 +30,7 @@ references: tags: analytic_story: - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index dab7c518b8..d86be7885b 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -36,6 +36,7 @@ tags: - Unusual Processes - Data Destruction - WhisperGate + - NjRAT asset_type: Endpoint confidence: 70 impact: 70 diff --git a/stories/njrat.yml b/stories/njrat.yml new file mode 100644 index 0000000000..8076793ff8 --- /dev/null +++ b/stories/njrat.yml @@ -0,0 +1,26 @@ +name: NjRat +id: f6d52454-6cf3-4759-9627-5868a3e2b2b1 +version: 2 +date: '2023-09-07' +author: Teoderick Contreras, Splunk +description: NjRat is a notorious remote access trojan (RAT) predominantly wielded by malicious operators to infiltrate and wield remote control over compromised systems. + This analytical story harnesses targeted search methodologies to uncover and investigate activities that could be indicative of NjRAT's presence. + These activities include tracking file write operations for dropped files, scrutinizing registry modifications aimed at establishing persistence mechanisms, + monitoring suspicious processes, self-deletion behaviors, browser credential parsing, firewall configuration alterations, spread itself via removable drive and an array of other potentially + malicious actions. +narrative: NjRat is also known as Bladabindi malware that was first discovered in the wild in 2012. Since then this malware remain active and uses different campaign to spred its malware. + While its primary infection vectors are phishing attacks and drive-by downloads, it also has "worm" capability to spread itself via infected removable drives. This RAT has various of capabilities including + keylogging, webcam access, browser credential parsing, file upload and downloads, file and process list, service list, shell command execution, registry modification, screen capture, view the desktop of the infected computer and many more. + NjRat does not target any industry in particular, but attacking a wide variety of individuals and organizations to gather sensitive information. +references: + - https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/what-is-njrat-malware/#:~:text=NJRat%20%E2%80%94%20also%20known%20as%20Bladabindi,malware%20variant%20in%20March%202023. + - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: NjRAT + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 8a8f5949e5bf050733fe0673d3223fd435f648c1 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 19 Sep 2023 14:35:11 -0700 Subject: [PATCH 10/14] updating type --- .../cloud/azure_ad_user_enabled_and_password_reset.yml | 10 +++++----- ...ct_certify_with_powershell_script_block_logging.yml | 2 +- ...s_steal_authentication_certificates___esc1_auth.yml | 4 ++-- ...ows_suspect_process_with_authentication_traffic.yml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml index 0ea877c255..2399b3bfef 100644 --- a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml +++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml @@ -14,8 +14,8 @@ search: ' `azuread` (operationName="Enable account" OR operationName="Reset pass OR operationName="Update user") | transaction properties.targetResources{}.userPrincipalName startsWith=(operationName="Enable account") endsWith=(operationName="Reset password (by admin)") maxspan=2m | rename properties.* as * | rename targetResources{}.userPrincipalName - as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy - | stats values(operationName) values(initiatedBy) as initiatedBy by _time, userPrincipalName, + as user | rename initiatedBy.user.userPrincipalName as initiatedBy + | stats values(operationName) values(initiatedBy) as initiatedBy by _time, user, result | `azure_ad_user_enabled_and_password_reset_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). @@ -36,12 +36,12 @@ tags: mitre_attack_id: - T1098 observable: - - name: userPrincipalName - type: User Name + - name: user + type: User role: - Victim - name: initiatedBy - type: User Name + type: User role: - Attacker product: diff --git a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml index 82999f056a..a49a723f23 100644 --- a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml @@ -39,7 +39,7 @@ tags: role: - Victim - name: user - type: User Name + type: User role: - Victim - name: command diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml index 9197b58229..1252e1fa58 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml @@ -57,11 +57,11 @@ tags: role: - Victim - name: src_user - type: User Name + type: User role: - Victim - name: user - type: User Name + type: User role: - Victim - name: ssl_hash diff --git a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml index 8fb98fd699..c63a41940f 100644 --- a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml +++ b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml @@ -55,7 +55,7 @@ tags: role: - Victim - name: user - type: User Name + type: User role: - Victim - name: process_name From 76ee731e877f1f040fbc6a4278fde9a0f5edf36c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 20 Sep 2023 12:06:59 -0600 Subject: [PATCH 11/14] Update juniper_networks_remote_code_execution_exploit_detection.yml --- .../juniper_networks_remote_code_execution_exploit_detection.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml b/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml index 36fded196d..b2d23e1275 100644 --- a/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml +++ b/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml @@ -21,6 +21,7 @@ references: - https://thehackernews.com/2023/08/new-juniper-junos-os-flaws-expose.html - https://github.com/watchtowrlabs/juniper-rce_cve-2023-36844 - https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/ +- https://vulncheck.com/blog/juniper-cve-2023-36845 tags: analytic_story: - Juniper JunOS Remote Code Execution From 82b699b444a42aa55a3ba8ba062746adde119bf1 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 20 Sep 2023 11:55:18 -0700 Subject: [PATCH 12/14] updating tor detection --- detections/network/tor_traffic.yml | 44 ++++++++++++++++-------------- 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/detections/network/tor_traffic.yml b/detections/network/tor_traffic.yml index 8445c8aa63..ee6a4c7b82 100644 --- a/detections/network/tor_traffic.yml +++ b/detections/network/tor_traffic.yml @@ -1,26 +1,22 @@ name: TOR Traffic id: ea688274-9c06-4473-b951-e4cb7a5d7a45 -version: 2 -date: '2020-07-22' -author: David Dorsey, Splunk -status: experimental +version: 3 +date: '2023-09-20' +author: David Dorsey, Bhavin Patel, Splunk +status: production type: TTP -description: This search looks for network traffic identified as The Onion Router - (TOR), a benign anonymity network which can be abused for a variety of nefarious - purposes. +description: The following analytic looks for allowed network traffic to The Onion Router(TOR), a benign anonymity network which can be abused for a variety of nefarious purposes. Detecting Tor traffic is paramount for upholding network security and mitigating potential threats. Tor's capacity to provide users with anonymity has been exploited by cybercriminals for activities like hacking, data breaches, and illicit content dissemination. Additionally, organizations must monitor Tor usage within their networks to ensure compliance with policies and regulations, as it can bypass conventional monitoring and filtering measures. Lastly, the ability to identify Tor traffic empowers security teams to promptly investigate and address potential security incidents, fortifying the protection of sensitive data and preserving the integrity of the network environment. data_source: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `tor_traffic_filter`' -how_to_implement: In order to properly run this search, Splunk needs to ingest data - from firewalls or other network control devices that mediate the traffic allowed - into an environment. This is necessary so that the search can identify an 'action' - taken on the traffic of interest. The search requires the Network_Traffic data model - be populated. +how_to_implement: In order to properly run this search, Splunk needs to ingest data from Next Generation Firewalls like Palo Alto Networks Firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model to be populated. known_false_positives: None at this time -references: [] +references: + - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRtCAK + - https://unit42.paloaltonetworks.com/tor-traffic-enterprise-networks/#:~:text=For%20enterprises%20concerned%20about%20the,the%20most%20important%20security%20risks. tags: analytic_story: - Prohibited Traffic Allowed or Protocol Mismatch @@ -28,15 +24,15 @@ tags: - NOBELIUM Group - Command And Control asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd + confidence: 80 + impact: 100 + message: Suspicious network traffic allowed using TOR has been detected from $src_ip$ to $dest_ip$ mitre_attack_id: - - T1071 - - T1071.001 + - T1090 + - T1090.003 observable: - - name: dest - type: Hostname + - name: src_ip + type: IP Address role: - Victim product: @@ -50,5 +46,11 @@ tags: - All_Traffic.src_ip - All_Traffic.dest_ip - All_Traffic.dest_port - risk_score: 25 + risk_score: 80 security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed.log + source: pan_tor_allowed + sourcetype: pan:traffic From 3743f161a8119cd112244adf26084abff685963c Mon Sep 17 00:00:00 2001 From: Namratha Sreekanta Date: Mon, 25 Sep 2023 12:55:51 -0700 Subject: [PATCH 13/14] DGA Performance fix --- notebooks/pretrained_dga_model_dsdl.ipynb | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/notebooks/pretrained_dga_model_dsdl.ipynb b/notebooks/pretrained_dga_model_dsdl.ipynb index 1d80c0c695..fad7ff971b 100644 --- a/notebooks/pretrained_dga_model_dsdl.ipynb +++ b/notebooks/pretrained_dga_model_dsdl.ipynb @@ -25,7 +25,7 @@ "cell_type": "markdown", "metadata": {}, "source": [ - "Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for Command And Control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the Command And Control channel, as there potentially could be thousands of domains that malware can check for instructions.\n", + "Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.\n", "\n", "DGAs can take the form of apparently random or \"gibberish\" strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders https://attack.mitre.org/techniques/T1568/002/" ] @@ -40,7 +40,7 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 32, "metadata": { "deletable": false, "name": "mltkc_import" @@ -228,8 +228,7 @@ "\n", " \n", "def is_in_alexa1m(domain,domains):\n", - " test_in_alexa_domains = set(alexa_domains) & domains\n", - " return ((domain in test_in_alexa_domains))\n", + " return ((domain in domains))\n", "\n", " \n", " \n", @@ -241,13 +240,13 @@ " print (\"2. Done adding entropy\")\n", " X_4 = df['domain'].map(lambda x: len(x))\n", " print (\"3. Done adding length of domain\")\n", - " domains = set(df['domain'])\n", - " X_5 = df['domain'].map(lambda x: is_in_alexa1m(x,domains))\n", + " in_alexa = set(alexa_domains) & set(df['domain'])\n", + " X_5 = df['domain'].map(lambda x: is_in_alexa1m(x, in_alexa))\n", " print (\"4. Done adding domain present in alexa domains\")\n", " X_5 = X_5.astype(int)\n", " input2 = np.c_[X_1,X_2,X_3,X_4,X_5] #\n", " print (\"appending done\")\n", - " return input2 \n", + " return input2\n", "\n", "def prep_text(texts):\n", " text_sequences = tokenizer.texts_to_sequences(texts)\n", @@ -309,7 +308,7 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 3, "metadata": { "deletable": false, "name": "mltkc_load" @@ -369,7 +368,7 @@ ], "metadata": { "kernelspec": { - "display_name": "Python 3", + "display_name": "Python 3 (ipykernel)", "language": "python", "name": "python3" }, @@ -383,7 +382,7 @@ "name": "python", "nbconvert_exporter": "python", "pygments_lexer": "ipython3", - "version": "3.8.5" + "version": "3.9.13" } }, "nbformat": 4, From b2d1f4f1ad01ecbe17383eaed99a1e7b60ee0a5d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 26 Sep 2023 14:03:04 -0700 Subject: [PATCH 14/14] minor change for creating PR --- detections/network/detect_arp_poisoning.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/detect_arp_poisoning.yml b/detections/network/detect_arp_poisoning.yml index 1e6f23b772..6db2bfa487 100644 --- a/detections/network/detect_arp_poisoning.yml +++ b/detections/network/detect_arp_poisoning.yml @@ -1,5 +1,5 @@ name: Detect ARP Poisoning -id: b44bebd6-bd39-467b-9321-73971bcd7aac +id: b44bebd6-bd39-467b-9321-73971bcd1aac version: 1 date: '2020-08-11' author: Mikael Bjerkeland, Splunk