diff --git a/.circleci/config.yml b/.circleci/config.yml index d594168494..f4a84c4a60 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -350,7 +350,7 @@ jobs: aws s3 cp deployments s3://security-content/deployments --recursive --exclude "*" --include "*.yml" - run: name: security content api smoke test - command: | + command: | API_URL='https://content.splunkresearch.com/detections' API_STATUS=$(curl -s -o /dev/null -w "%{http_code}" $API_URL) echo "Security Content API Status: $API_STATUS" @@ -359,6 +359,40 @@ jobs: exit 1 fi + create-report: + executor: content-executor + steps: + - run: + name: checkout repo + command: | + if [ "${CIRCLE_BRANCH}" == "" ]; then + git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git + else + git clone --branch ${CIRCLE_BRANCH} https://${GITHUB_TOKEN}@github.com/splunk/security-content.git + fi + - run: *apt-install + - run: + name: install python dependencies + command: | + cd security-content + rm -rf venv + virtualenv --python=/usr/bin/python3 --clear venv + source venv/bin/activate + pip install -q -r requirements.txt + - run: + name: run reporting + command: | + cd security-content + source venv/bin/activate + python bin/reporting.py + - aws-cli/setup: + profile-name: default + - run: + name: upload reporting + command: | + cd security-content + aws s3 cp bin/reporting s3://security-content/reporting --recursive --exclude "*" --include "*.svg" + workflows: version: 2.1 @@ -393,6 +427,15 @@ workflows: filters: tags: only: /.*/ + - create-report: + requires: + - validate-content + - build-sources + - build-package + - run-appinspect + filters: + tags: + only: /^v.*/ - update-sources-github: # update package and docs in github if is a tag requires: @@ -400,6 +443,7 @@ workflows: - build-sources - build-package - run-appinspect + - create-report filters: tags: only: /^v.*/ @@ -412,6 +456,7 @@ workflows: - build-sources - build-package - run-appinspect + - create-report - update-sources-github filters: tags: @@ -425,6 +470,7 @@ workflows: - build-sources - build-package - run-appinspect + - create-report - update-sources-github - publish-github-release filters: @@ -439,6 +485,7 @@ workflows: - build-sources - build-package - run-appinspect + - create-report - update-sources-github - publish-github-release - attack-range-update diff --git a/README.md b/README.md index 1e644d6b76..3a329b94a0 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,25 @@ +

+

+ + + + + + + + + + + + + + +

+ # Splunk Security Content ![security-content](docs/static/logo.png) ===== -| branch | build status | -| --- | --- | -| develop| [![develop status](https://circleci.com/gh/splunk/security-content/tree/develop.svg?style=svg&circle-token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269)](https://circleci.com/gh/splunk/security-content/tree/develop)| -| master | [![master status](https://circleci.com/gh/splunk/security-content/tree/master.svg?style=svg&circle-token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269)](https://circleci.com/gh/splunk/security-content/tree/master)| - Welcome to the Splunk Security Content This project gives you access to our repository of Analytic Stories that are security guides the provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats. diff --git a/bin/jinja2_templates/svg_badge.j2 b/bin/jinja2_templates/svg_badge.j2 new file mode 100644 index 0000000000..b598da6aac --- /dev/null +++ b/bin/jinja2_templates/svg_badge.j2 @@ -0,0 +1,19 @@ + + + + + + + + + + + + + + + coverage + coverage + {{ detection_coverage }} + + diff --git a/bin/reporting.py b/bin/reporting.py new file mode 100644 index 0000000000..ced2479ed1 --- /dev/null +++ b/bin/reporting.py @@ -0,0 +1,67 @@ +#!/usr/bin/python + +import glob +import yaml +import argparse +import os +from os import path +import sys +import datetime +from jinja2 import Environment, FileSystemLoader + + +def load_objects(file_path, REPO_PATH): + files = [] + manifest_files = path.join(path.expanduser(REPO_PATH), file_path) + for file in sorted(glob.glob(manifest_files)): + files.append(load_file(file)) + return files + + +def load_file(file_path): + with open(file_path, 'r', encoding="utf-8") as stream: + try: + file = list(yaml.safe_load_all(stream))[0] + except yaml.YAMLError as exc: + print(exc) + sys.exit("ERROR: reading {0}".format(file_path)) + return file + + + +def main(args): + + # process all detections + REPO_PATH = os.path.join(os.path.dirname(__file__), '../') + detections = [] + detections = load_objects("detections/application/*.yml", REPO_PATH) + detections.extend(load_objects("detections/cloud/*.yml", REPO_PATH)) + detections.extend(load_objects("detections/endpoint/*.yml", REPO_PATH)) + detections.extend(load_objects("detections/network/*.yml", REPO_PATH)) + detections.extend(load_objects("detections/web/*.yml", REPO_PATH)) + + tests = load_objects("tests/*/*.yml", REPO_PATH) + + counter_tests=0 + counter_detection=0 + + for detection in detections: + counter_detection=counter_detection+1 + + for test in tests: + counter_tests=counter_tests+1 + + detection_coverage = "{:.0%}".format(counter_tests/counter_detection) + + TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), 'jinja2_templates') + OUTPUT_PATH = os.path.join(os.path.dirname(__file__), 'reporting') + j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), trim_blocks=True) + template = j2_env.get_template('svg_badge.j2') + output_path = path.join(OUTPUT_PATH, 'detection_coverage.svg') + output = template.render(detection_coverage=detection_coverage) + with open(output_path, 'w', encoding="utf-8") as f: + f.write(output) + + +if __name__ == "__main__": + main(sys.argv[1:]) diff --git a/bin/reporting/detection_coverage.svg b/bin/reporting/detection_coverage.svg new file mode 100644 index 0000000000..c94bb338b0 --- /dev/null +++ b/bin/reporting/detection_coverage.svg @@ -0,0 +1,19 @@ + + + + + + + + + + + + + + + coverage + coverage + 80%% + + \ No newline at end of file diff --git a/detections/network/clients_connecting_to_multiple_dns_servers.yml b/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml similarity index 100% rename from detections/network/clients_connecting_to_multiple_dns_servers.yml rename to detections/deprecated/clients_connecting_to_multiple_dns_servers.yml diff --git a/detections/network/detect_long_dns_txt_record_response.yml b/detections/deprecated/detect_long_dns_txt_record_response.yml similarity index 95% rename from detections/network/detect_long_dns_txt_record_response.yml rename to detections/deprecated/detect_long_dns_txt_record_response.yml index 8b583b918a..cb10f9672b 100644 --- a/detections/network/detect_long_dns_txt_record_response.yml +++ b/detections/deprecated/detect_long_dns_txt_record_response.yml @@ -6,6 +6,7 @@ description: This search is used to detect attempts to use DNS tunneling, by cal the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. + Deprecated because this detection should focus on DNS queries instead of DNS responses. how_to_implement: To successfully implement this search you need to ingest data from your DNS logs, or monitor DNS traffic using Stream, Bro or something similar. Specifically, this query requires that the DNS data model is populated with information regarding @@ -31,7 +32,7 @@ tags: - Suspicious DNS Traffic - Command and Control mitre_attack_id: - - T1071.004 + - T1048.003 kill_chain_phases: - Command and Control cis20: diff --git a/detections/web/detect_web_traffic_to_dynamic_domain_providers.yml b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml similarity index 95% rename from detections/web/detect_web_traffic_to_dynamic_domain_providers.yml rename to detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml index 81d069ad2d..f54409a169 100644 --- a/detections/web/detect_web_traffic_to_dynamic_domain_providers.yml +++ b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml @@ -19,7 +19,8 @@ how_to_implement: 'This search requires you to be ingesting web-traffic logs. Yo **Label:** IsDynamicDNS, **Field:** isDynDNS\ Detailed documentation on how to create a new field within Incident Review may be - found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`' + found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` + Deprecated because duplicate.' type: ESCU references: [] author: Bhavin Patel, Splunk diff --git a/detections/network/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml similarity index 97% rename from detections/network/detection_of_dns_tunnels.yml rename to detections/deprecated/detection_of_dns_tunnels.yml index 235c0f52a5..381cfd8f74 100644 --- a/detections/network/detection_of_dns_tunnels.yml +++ b/detections/deprecated/detection_of_dns_tunnels.yml @@ -9,6 +9,7 @@ description: This search is used to detect DNS tunneling, by calculating the sum method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. + Deprecated because existing detection is doing the same. how_to_implement: To successfully implement this search, we must ensure that DNS data is being ingested and mapped to the appropriate fields in the Network_Resolution data model. Fields like src_category are automatically provided by the Assets and @@ -43,7 +44,7 @@ tags: - Suspicious DNS Traffic - Command and Control mitre_attack_id: - - T1071.004 + - T1048.003 kill_chain_phases: - Command and Control - Actions on Objectives diff --git a/detections/network/dns_query_requests_resolved_by_unauthorized_dns_servers.yml b/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml similarity index 100% rename from detections/network/dns_query_requests_resolved_by_unauthorized_dns_servers.yml rename to detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml diff --git a/detections/endpoint/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml b/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml similarity index 93% rename from detections/endpoint/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml rename to detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml index 41bdf87da8..640a6e97e5 100644 --- a/detections/endpoint/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml +++ b/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml @@ -1,13 +1,14 @@ name: Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments id: 2cdb91d2-542c-497f-b252-be495e71f38c -version: 5 -date: '2020-11-20' +version: 6 +date: '2021-01-19' description: This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. + Deprecated because almost the same as Malicious PowerShell Process - Encoded Command how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -21,7 +22,7 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* AND process=*-NonI* + search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* | `malicious_powershell_process___multiple_suspicious_command_line_arguments_filter`' known_false_positives: Legitimate process can have this combination of command-line options, but it's not common. @@ -29,7 +30,7 @@ tags: analytics_story: - Malicious PowerShell mitre_attack_id: - - T1027 + - T1059.001 kill_chain_phases: - Command and Control - Actions on Objectives diff --git a/detections/network/monitor_dns_for_brand_abuse.yml b/detections/deprecated/monitor_dns_for_brand_abuse.yml similarity index 100% rename from detections/network/monitor_dns_for_brand_abuse.yml rename to detections/deprecated/monitor_dns_for_brand_abuse.yml diff --git a/detections/application/open_redirect_in_splunk_web.yml b/detections/deprecated/open_redirect_in_splunk_web.yml similarity index 100% rename from detections/application/open_redirect_in_splunk_web.yml rename to detections/deprecated/open_redirect_in_splunk_web.yml diff --git a/detections/application/splunk_enterprise_information_disclosure.yml b/detections/deprecated/splunk_enterprise_information_disclosure.yml similarity index 100% rename from detections/application/splunk_enterprise_information_disclosure.yml rename to detections/deprecated/splunk_enterprise_information_disclosure.yml diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 3e13290e9b..2dd7302b37 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -17,7 +17,7 @@ author: Rico Valdez, Splunk search: '| tstats `security_content_summariesonly` values(Processes.process_id) as process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name=powershell.exe AND (Processes.process="* -ex*" OR Processes.process="* + where Processes.process_name=powershell.exe (Processes.process="* -ex*" OR Processes.process="* bypass *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`' known_false_positives: There may be legitimate reasons to bypass the PowerShell execution @@ -41,3 +41,6 @@ tags: - PR.IP security_domain: endpoint asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index 334c8f08bb..76f06b3dc0 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -1,14 +1,14 @@ name: Malicious PowerShell Process With Obfuscation Techniques id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4 -version: 3 -date: '2020-07-21' +version: 4 +date: '2021-01-19' description: This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line. how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data - model. Deprecated because the detection need rework and would need to work base on powershell logs. + model. type: ESCU references: [] author: David Dorsey, Splunk @@ -17,9 +17,9 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process, - "`"))-1) + (mvcount(split(process, "^"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter` - | search num_obfuscation > 0' + `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,"`"))-1) + + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "''"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter` + | search num_obfuscation > 10 ' known_false_positives: These characters might be legitimately on the command-line, but it is not common. tags: @@ -40,3 +40,6 @@ tags: - PR.IP security_domain: endpoint asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/obfuscated_powershell/windows-sysmon.log diff --git a/detections/endpoint/sunburst_correlation_dll_and_network_event.yml b/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml similarity index 100% rename from detections/endpoint/sunburst_correlation_dll_and_network_event.yml rename to detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml diff --git a/detections/network/detect_arp_poisoning.yml b/detections/experimental/network/detect_arp_poisoning.yml similarity index 100% rename from detections/network/detect_arp_poisoning.yml rename to detections/experimental/network/detect_arp_poisoning.yml diff --git a/detections/network/dns_record_changed.yml b/detections/experimental/network/dns_record_changed.yml similarity index 100% rename from detections/network/dns_record_changed.yml rename to detections/experimental/network/dns_record_changed.yml diff --git a/detections/network/excessive_dns_failures.yml b/detections/experimental/network/excessive_dns_failures.yml similarity index 100% rename from detections/network/excessive_dns_failures.yml rename to detections/experimental/network/excessive_dns_failures.yml diff --git a/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml b/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml similarity index 100% rename from detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml rename to detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml diff --git a/detections/network/large_volume_of_dns_any_queries.yml b/detections/experimental/network/large_volume_of_dns_any_queries.yml similarity index 100% rename from detections/network/large_volume_of_dns_any_queries.yml rename to detections/experimental/network/large_volume_of_dns_any_queries.yml diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/experimental/network/prohibited_network_traffic_allowed.yml similarity index 100% rename from detections/network/prohibited_network_traffic_allowed.yml rename to detections/experimental/network/prohibited_network_traffic_allowed.yml diff --git a/detections/network/protocol_or_port_mismatch.yml b/detections/experimental/network/protocol_or_port_mismatch.yml similarity index 100% rename from detections/network/protocol_or_port_mismatch.yml rename to detections/experimental/network/protocol_or_port_mismatch.yml diff --git a/detections/network/protocols_passing_authentication_in_cleartext.yml b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml similarity index 100% rename from detections/network/protocols_passing_authentication_in_cleartext.yml rename to detections/experimental/network/protocols_passing_authentication_in_cleartext.yml diff --git a/detections/web/sql_injection_with_long_urls.yml b/detections/experimental/web/sql_injection_with_long_urls.yml similarity index 100% rename from detections/web/sql_injection_with_long_urls.yml rename to detections/experimental/web/sql_injection_with_long_urls.yml diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 6c15cec868..701e72bd21 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -1,7 +1,7 @@ name: DNS Query Length With High Standard Deviation id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 -version: 2 -date: '2020-07-21' +version: 3 +date: '2021-01-18' description: This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. @@ -11,9 +11,9 @@ type: ESCU references: [] author: Bhavin Patel, Splunk search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution - by DNS.query DNS.record_type | `drop_dm_object_name("DNS")` | eval query_length - = len(query) | table query query_length record_type count | eventstats stdev(query_length) - AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) + by DNS.query | `drop_dm_object_name("DNS")` | eval query_length = len(query) | + table query query_length record_type count | eventstats stdev(query_length) AS stdev + avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter` ' known_false_positives: It's possible there can be long domain names that are legitimate. tags: @@ -22,7 +22,7 @@ tags: - Suspicious DNS Traffic - Command and Control mitre_attack_id: - - T1071.004 + - T1048.003 kill_chain_phases: - Command and Control cis20: @@ -34,3 +34,6 @@ tags: - DE.CM security_domain: network asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/long_dns_queries/windows-sysmon.log diff --git a/package/default/analytic_stories.conf b/package/default/analytic_stories.conf index 8abfe6b204..9d0f63689b 100644 --- a/package/default/analytic_stories.conf +++ b/package/default/analytic_stories.conf @@ -121,7 +121,7 @@ version = 1 reference = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] detection_searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"] mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 3", "CIS 4", "CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT", "RS.MI"]} -investigative_searches = ["ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Investigate Web POSTs From src", "ESCU - Get Notable History"] +investigative_searches = ["ESCU - Get Notable History", "ESCU - Investigate Web POSTs From src", "ESCU - Investigate Suspicious Strings in HTTP Header"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1366,7 +1366,7 @@ version = 1 reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"] detection_searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule"] mappings = {"cis20": ["CIS 16", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078", "T1136"], "nist": ["DE.AE", "DE.CM", "DE.DP"]} -investigative_searches = ["ESCU - Get Web Session Information via session id", "ESCU - Get Notable History", "ESCU - Get Emails From Specific Sender"] +investigative_searches = ["ESCU - Get Web Session Information via session id", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History"] support_searches = [] data_models = [] providing_technologies = none diff --git a/package/default/es_investigations.conf b/package/default/es_investigations.conf index 53f23fecf3..37bf8d1552 100644 --- a/package/default/es_investigations.conf +++ b/package/default/es_investigations.conf @@ -46,7 +46,7 @@ label = Apache Struts Vulnerability description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. disabled = 0 -panels = ["panel://workbench_panel_investigate_suspicious_strings_in_http_header", "panel://workbench_panel_investigate_web_posts_from_src", "panel://workbench_panel_get_notable_history"] +panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_web_posts_from_src", "panel://workbench_panel_investigate_suspicious_strings_in_http_header"] [panel_group://workbench_panel_group_asset_tracking] label = Asset Tracking @@ -522,7 +522,7 @@ label = Web Fraud Detection description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. disabled = 0 -panels = ["panel://workbench_panel_get_web_session_information_via_session_id", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_emails_from_specific_sender"] +panels = ["panel://workbench_panel_get_web_session_information_via_session_id", "panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_notable_history"] [panel_group://workbench_panel_group_windows_dns_sigred_cve_2020_1350] label = Windows DNS SIGRed CVE-2020-1350 diff --git a/package/default/savedsearches.conf b/package/default/savedsearches.conf index b428b858c3..4fbf3457e7 100644 --- a/package/default/savedsearches.conf +++ b/package/default/savedsearches.conf @@ -2033,13 +2033,13 @@ search = | tstats `security_content_summariesonly` count min(_time) as start_tim action.escu = 0 action.escu.enabled = 1 description = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} action.escu.data_models = ["Network_Resolution"] action.escu.eli5 = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. action.escu.known_false_positives = It's possible there can be long domain names that are legitimate. -action.escu.creation_date = 2020-07-21 -action.escu.modification_date = 2020-07-21 +action.escu.creation_date = 2021-01-18 +action.escu.modification_date = 2021-01-18 action.escu.confidence = high action.escu.full_search_name = ESCU - DNS Query Length With High Standard Deviation - Rule action.escu.search_type = detection @@ -2050,7 +2050,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DNS Query Length With High Standard Deviation - Rule -action.correlationsearch.annotations = {"analytics_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytics_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. @@ -2894,10 +2894,10 @@ search = | tstats `security_content_summariesonly` count earliest(_time) as firs [ESCU - Detect Long DNS TXT Record Response - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} +description = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. Deprecated because this detection should focus on DNS queries instead of DNS responses. +action.escu.mappings = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} action.escu.data_models = ["Network_Resolution"] -action.escu.eli5 = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. +action.escu.eli5 = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. Deprecated because this detection should focus on DNS queries instead of DNS responses. action.escu.how_to_implement = To successfully implement this search you need to ingest data from your DNS logs, or monitor DNS traffic using Stream, Bro or something similar. Specifically, this query requires that the DNS data model is populated with information regarding the DNS record type that is being returned as well as the data in the answer section of the protocol. action.escu.known_false_positives = It's possible that legitimate TXT record responses can be long enough to trigger this search. You can modify the packet threshold for this search to help mitigate false positives. action.escu.creation_date = 2020-07-21 @@ -2912,7 +2912,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Long DNS TXT Record Response - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytics_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -4492,7 +4492,7 @@ action.escu.data_models = ["Web"] action.escu.eli5 = This search looks for web connections to dynamic DNS providers. action.escu.how_to_implement = This search requires you to be ingesting web-traffic logs. You can obtain these logs from indexing data from a web proxy or by using a network-traffic-analysis tool, such as Bro or Splunk Stream. The web data model must contain the URL being requested, the IP address of the host initiating the request, and the destination IP. This search also leverages a lookup file, `dynamic_dns_providers_default.csv`, which contains a non-exhaustive list of dynamic DNS providers. Consider periodically updating this local lookup file with new domains.\ This search produces fields (`isDynDNS`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** IsDynamicDNS, **Field:** isDynDNS\ -Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` +Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` Deprecated because duplicate. action.escu.known_false_positives = It is possible that list of dynamic DNS providers is outdated and/or that the URL being requested is legitimate. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 @@ -4527,10 +4527,10 @@ search = | tstats `security_content_summariesonly` count values(Web.url) as url [ESCU - Detection of DNS Tunnels - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "PR.DS"]} +description = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same. +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]} action.escu.data_models = ["Network_Resolution"] -action.escu.eli5 = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. +action.escu.eli5 = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same. action.escu.how_to_implement = To successfully implement this search, we must ensure that DNS data is being ingested and mapped to the appropriate fields in the Network_Resolution data model. Fields like src_category are automatically provided by the Assets and Identity Framework shipped with Splunk Enterprise Security. You will need to ensure you are using the Assets and Identity Framework and populating the src_category field. You will also need to enable the `cim_corporate_web_domain_search()` macro which will essentially filter out the DNS queries made to the corporate web domains to reduce alert fatigue. action.escu.known_false_positives = It's possible that normal DNS traffic will exhibit this behavior. If an alert is generated, please investigate and validate as appropriate. The threshold can also be modified to better suit your environment. action.escu.creation_date = 2017-09-18 @@ -4545,7 +4545,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detection of DNS Tunnels - Rule -action.correlationsearch.annotations = {"analytics_story": ["Data Protection", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "PR.DS"]} +action.correlationsearch.annotations = {"analytics_story": ["Data Protection", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['src'] @@ -5576,10 +5576,10 @@ search = | tstats `security_content_summariesonly` count min(_time) values(Proce [ESCU - High Number of Login Failures from a single source - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. +description = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. Deprecated because duplicate. action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] -action.escu.eli5 = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. +action.escu.eli5 = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. Deprecated because duplicate. action.escu.how_to_implement = none action.escu.known_false_positives = unknown action.escu.creation_date = 2020-12-16 @@ -6647,13 +6647,13 @@ search = | tstats `security_content_summariesonly` values(Processes.process_id) action.escu = 0 action.escu.enabled = 1 description = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. action.escu.known_false_positives = Legitimate process can have this combination of command-line options, but it's not common. -action.escu.creation_date = 2020-11-20 -action.escu.modification_date = 2020-11-20 +action.escu.creation_date = 2021-01-19 +action.escu.modification_date = 2021-01-19 action.escu.confidence = high action.escu.full_search_name = ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule action.escu.search_type = detection @@ -6664,7 +6664,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule -action.correlationsearch.annotations = {"analytics_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytics_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6680,7 +6680,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* AND process=*-NonI* | `malicious_powershell_process___multiple_suspicious_command_line_arguments_filter` +search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* | `malicious_powershell_process___multiple_suspicious_command_line_arguments_filter` [ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule] action.escu = 0 @@ -6691,8 +6691,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. Deprecated because the detection need rework and would need to work base on powershell logs. action.escu.known_false_positives = These characters might be legitimately on the command-line, but it is not common. -action.escu.creation_date = 2020-07-21 -action.escu.modification_date = 2020-07-21 +action.escu.creation_date = 2021-01-19 +action.escu.modification_date = 2021-01-19 action.escu.confidence = high action.escu.full_search_name = ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule action.escu.search_type = detection @@ -6719,7 +6719,8 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process, "`"))-1) + (mvcount(split(process, "^"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter` | search num_obfuscation > 0 +search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,"`"))-1) + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "'"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter` | search num_obfuscation > 10 + [ESCU - Monitor DNS For Brand Abuse - Rule] action.escu = 0 diff --git a/package/default/use_case_library.conf b/package/default/use_case_library.conf index 77f05cb6f8..abd3111f45 100644 --- a/package/default/use_case_library.conf +++ b/package/default/use_case_library.conf @@ -554,7 +554,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Detect Oulook exe writing a zip file - Rule", "ESCU - Suspicious LNK file launching a process - Rule", "ESCU - Get Parent Process Info"] +searches = ["ESCU - Suspicious LNK file launching a process - Rule", "ESCU - Detect Oulook exe writing a zip file - Rule", "ESCU - Get Parent Process Info"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ @@ -1010,7 +1010,7 @@ version = 1 references = ["https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", "https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Get Notable History"] +searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get Notable History"] description = Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise. The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit. narrative = When a client requests a DNS record for a particular domain, that request gets routed first through the client's locally configured DNS server, then to any DNS server(s) configured as forwarders, and then onto the target domain's own DNS server(s). If a attacker wanted to, they could host a malicious DNS server that responds to the initial request with a specially crafted large response (~65KB). This response would flow through to the client's local DNS server, which if not patched for CVE-2020-1350, would cause the buffer overflow. The detection searches in this Analytic Story use wire data to detect the malicious behavior. Searches for Splunk Stream and Zeek are included. The Splunk Stream search correlates across stream:dns and stream:tcp, while the Zeek search correlates across bro:dns:json and bro:conn:json. These correlations are required to pick up both the DNS record types (SIG and KEY) along with the payload size (>65KB). @@ -1615,7 +1615,7 @@ asset_type = Endpoint confidence = medium explanation = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. -annotations = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} known_false_positives = It's possible there can be long domain names that are legitimate. providing_technologies = [] @@ -1847,9 +1847,9 @@ providing_technologies = [] type = detection asset_type = Endpoint confidence = medium -explanation = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. +explanation = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. Deprecated because this detection should focus on DNS queries instead of DNS responses. how_to_implement = To successfully implement this search you need to ingest data from your DNS logs, or monitor DNS traffic using Stream, Bro or something similar. Specifically, this query requires that the DNS data model is populated with information regarding the DNS record type that is being returned as well as the data in the answer section of the protocol. -annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} known_false_positives = It's possible that legitimate TXT record responses can be long enough to trigger this search. You can modify the packet threshold for this search to help mitigate false positives. providing_technologies = [] @@ -2262,7 +2262,7 @@ confidence = medium explanation = This search looks for web connections to dynamic DNS providers. how_to_implement = This search requires you to be ingesting web-traffic logs. You can obtain these logs from indexing data from a web proxy or by using a network-traffic-analysis tool, such as Bro or Splunk Stream. The web data model must contain the URL being requested, the IP address of the host initiating the request, and the destination IP. This search also leverages a lookup file, `dynamic_dns_providers_default.csv`, which contains a non-exhaustive list of dynamic DNS providers. Consider periodically updating this local lookup file with new domains.\ This search produces fields (`isDynDNS`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** IsDynamicDNS, **Field:** isDynDNS\ -Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` +Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` Deprecated because duplicate. annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.001"], "nist": ["PR.IP", "DE.DP"]} known_false_positives = It is possible that list of dynamic DNS providers is outdated and/or that the URL being requested is legitimate. providing_technologies = [] @@ -2271,9 +2271,9 @@ providing_technologies = [] type = detection asset_type = Endpoint confidence = medium -explanation = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. +explanation = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same. how_to_implement = To successfully implement this search, we must ensure that DNS data is being ingested and mapped to the appropriate fields in the Network_Resolution data model. Fields like src_category are automatically provided by the Assets and Identity Framework shipped with Splunk Enterprise Security. You will need to ensure you are using the Assets and Identity Framework and populating the src_category field. You will also need to enable the `cim_corporate_web_domain_search()` macro which will essentially filter out the DNS queries made to the corporate web domains to reduce alert fatigue. -annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "PR.DS"]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]} known_false_positives = It's possible that normal DNS traffic will exhibit this behavior. If an alert is generated, please investigate and validate as appropriate. The threshold can also be modified to better suit your environment. providing_technologies = [] @@ -2543,7 +2543,7 @@ providing_technologies = [] type = detection asset_type = Office 365 confidence = medium -explanation = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. +explanation = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. Deprecated because duplicate. how_to_implement = none annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = unknown @@ -2825,7 +2825,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} known_false_positives = Legitimate process can have this combination of command-line options, but it's not common. providing_technologies = [] diff --git a/tests/endpoint/malicious_powershell_process___execution_policy_bypass.test.yml b/tests/endpoint/malicious_powershell_process___execution_policy_bypass.test.yml new file mode 100644 index 0000000000..dcebf3ae8d --- /dev/null +++ b/tests/endpoint/malicious_powershell_process___execution_policy_bypass.test.yml @@ -0,0 +1,12 @@ +name: Malicious PowerShell Process - Execution Policy Bypass Unit Test +tests: +- name: Malicious PowerShell Process - Execution Policy Bypass + file: endpoint/malicious_powershell_process___execution_policy_bypass.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/malicious_powershell_process_with_obfuscation_techniques.test.yml b/tests/endpoint/malicious_powershell_process_with_obfuscation_techniques.test.yml new file mode 100644 index 0000000000..9ea73ba45a --- /dev/null +++ b/tests/endpoint/malicious_powershell_process_with_obfuscation_techniques.test.yml @@ -0,0 +1,12 @@ +name: Malicious PowerShell Process With Obfuscation Techniques Unit Test +tests: +- name: Malicious PowerShell Process With Obfuscation Techniques + file: endpoint/malicious_powershell_process_with_obfuscation_techniques.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/obfuscated_powershell/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/network/dns_query_length_with_high_standard_deviation.test.yml b/tests/network/dns_query_length_with_high_standard_deviation.test.yml new file mode 100644 index 0000000000..fd304f15fe --- /dev/null +++ b/tests/network/dns_query_length_with_high_standard_deviation.test.yml @@ -0,0 +1,12 @@ +name: DNS Query Length With High Standard Deviation Unit Test +tests: + - name: DNS Query Length With High Standard Deviation + file: network/dns_query_length_with_high_standard_deviation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/long_dns_queries/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog