admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated all required fields and datamodels again.

Browse Source
This commit is contained in:
pyth0n1c
2022-03-17 13:10:22 -07:00
parent d24c95bd3a
commit 84e65bb3fb
558 changed files with 12668 additions and 12948 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
+14 -14
View File
@@ -1,13 +1,16 @@
name: Abnormally High Number Of Cloud Infrastructure API Calls
id: 0840ddf1-8c89-46ff-b730-c8d6722478c0
version: 1
date: '2020-09-07'
author: David Dorsey, Splunk
type: Anomaly
datamodel:
- Change.All_Changes
date: '2020-09-07'
description: This search will detect a spike in the number of API calls made to your
cloud infrastructure environment by a user.
how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to
create the probability density function.
id: 0840ddf1-8c89-46ff-b730-c8d6722478c0
known_false_positives: ''
name: Abnormally High Number Of Cloud Infrastructure API Calls
references: []
search: '| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change.All_Changes
where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time
span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time,
@@ -19,11 +22,6 @@ search: '| tstats count as api_calls values(All_Changes.command) as command from
-1), ":"), 0) | where api_calls > expected_upper_threshold | eval distance_from_threshold
= api_calls - expected_upper_threshold | table _time, user, command, api_calls,
expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`'
how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to
create the probability density function.
known_false_positives: ''
references: []
tags:
analytic_story:
- Suspicious Cloud User Activities
@@ -51,20 +49,22 @@ tags:
- PR.AC
observable:
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Change.All_Changes.command
- Change.All_Changes.status
- Change.All_Changes.user
- _time
- All_Changes.command
- All_Changes.user
- All_Changes.status
risk_score: 15
security_domain: network
supported_tas:
- Splunk_TA_aws-kinesis-firehose
type: Anomaly
version: 1
detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
+23 -23
View File
@@ -1,30 +1,28 @@
name: Abnormally High Number Of Cloud Security Group API Calls
id: d4dfb7f3-7a37-498a-b5df-f19334e871af
version: 1
date: '2020-09-07'
author: David Dorsey, Splunk
type: Anomaly
datamodel:
- Change
- Change.All_Changes
date: '2020-09-07'
description: This search will detect a spike in the number of API calls made to your
cloud infrastructure environment about security groups by a user.
search: '| tstats count as security_group_api_calls values(All_Changes.command) as
command from datamodel=Change.All_Changes where All_Changes.object_category=firewall AND All_Changes.status=success
by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval
HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time,
"%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay
isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality
>=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename
"IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold
= mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls
> expected_upper_threshold | eval distance_from_threshold = security_group_api_calls
- expected_upper_threshold | table _time, user, command, security_group_api_calls,
expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`'
how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to
create the probability density function model.
id: d4dfb7f3-7a37-498a-b5df-f19334e871af
known_false_positives: ''
name: Abnormally High Number Of Cloud Security Group API Calls
references: []
search: '| tstats count as security_group_api_calls values(All_Changes.command) as
command from datamodel=Change.All_Changes where All_Changes.object_category=firewall
AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
| eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
<= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1]
| where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005
| rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1
| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"),
0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold
= security_group_api_calls - expected_upper_threshold | table _time, user, command,
security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`'
tags:
analytic_story:
- Suspicious Cloud User Activities
@@ -56,21 +54,23 @@ tags:
- PR.AC
observable:
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Change.All_Changes.command
- Change.All_Changes.object_category
- Change.All_Changes.status
- Change.All_Changes.user
- _time
- All_Changes.command
- All_Changes.object_category
- All_Changes.status
- All_Changes.user
risk_score: 15
security_domain: network
supported_tas:
- Splunk_TA_aws-kinesis-firehose
type: Anomaly
version: 1
detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
+16 -17
View File
@@ -1,12 +1,19 @@
name: AWS Create Policy Version to allow all resources
id: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4
version: 2
date: '2021-02-22'
author: Bhavin Patel, Splunk
type: TTP
datamodel: []
date: '2021-02-22'
description: This search looks for AWS CloudTrail events where a user created a policy
version that allows them to access any resource in their account
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a policy to allow a user to access all
resources. That said, AWS strongly advises against granting full control to all
AWS resources
name: AWS Create Policy Version to allow all resources
references:
- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com
errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements
path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements
@@ -15,15 +22,6 @@ search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.
as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID
awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a policy to allow a user to access all
resources. That said, AWS strongly advises against granting full control to all
AWS resources
references:
- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
tags:
analytic_story:
- AWS IAM Privilege Escalation
@@ -53,9 +51,9 @@ tags:
- DE.CM
observable:
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -63,9 +61,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- errorCode
- eventName
- userAgent
- errorCode
- requestParameters.userName
risk_score: 49
security_domain: network
type: TTP
version: 2
detections/cloud/aws_createaccesskey.yml
+15 -20
View File
@@ -1,31 +1,25 @@
name: AWS CreateAccessKey
id: 2a9b80d3-6340-4345-11ad-212bf3d0d111
version: 3
date: '2022-03-03'
author: Bhavin Patel, Splunk
type: Hunting
datamodel: []
date: '2022-03-03'
description: This search looks for AWS CloudTrail events where a user A who has already
permission to create access keys, makes an API call to create access keys for another
user B. Attackers have been know to use this technique for Privilege Escalation
in case new victim(user B) has more permissions than old victim(user B)
search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success
| eval match=if(match(userIdentity.userName,requestParameters.userName),1,0)
| search match=0
| stats
count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName
src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId
user_arn
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
|`aws_createaccesskey_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: 2a9b80d3-6340-4345-11ad-212bf3d0d111
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created keys for another user.
name: AWS CreateAccessKey
references:
- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com
errorCode = success | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0)
| search match=0 | stats count min(_time) as firstTime max(_time) as lastTime by
requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent
eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` |`aws_createaccesskey_filter`'
tags:
analytic_story:
- AWS IAM Privilege Escalation
@@ -55,13 +49,13 @@ tags:
- DE.CM
observable:
- name: src
role:
- Attacker
type: IP Address
role:
- Attacker
- name: user_arn
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -69,9 +63,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- errorCode
- eventName
- userAgent
- errorCode
- requestParameters.userName
risk_score: 63
security_domain: network
type: Hunting
version: 3
detections/cloud/aws_createloginprofile.yml
+16 -17
View File
@@ -1,14 +1,19 @@
name: AWS CreateLoginProfile
id: 2a9b80d3-6340-4345-11ad-212bf444d111
version: 2
date: '2021-07-19'
author: Bhavin Patel, Splunk
type: TTP
datamodel: []
date: '2021-07-19'
description: This search looks for AWS CloudTrail events where a user A(victim A)
creates a login profile for user B, followed by a AWS Console login event from user
B from the same src_ip as user B. This correlated event can be indicative of privilege
escalation since both events happened from the same src_ip
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: 2a9b80d3-6340-4345-11ad-212bf444d111
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a login profile for another user.
name: AWS CreateLoginProfile
references:
- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
search: '`cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName
as new_login_profile | table src_ip eventName new_login_profile userIdentity.userName |
join new_login_profile src_ip [| search `cloudtrail` eventName = ConsoleLogin |
@@ -17,13 +22,6 @@ search: '`cloudtrail` eventName = CreateLoginProfile | rename requestParameters.
userAgent eventID awsRegion userIdentity.principalId user_arn new_login_profile
src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`]
| `aws_createloginprofile_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a login profile for another user.
references:
- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
tags:
analytic_story:
- AWS IAM Privilege Escalation
@@ -53,13 +51,13 @@ tags:
- DE.CM
observable:
- name: src_ip
role:
- Attacker
type: IP Address
role:
- Attacker
- name: user_arn
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -67,9 +65,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- errorCode
- eventName
- userAgent
- errorCode
- requestParameters.userName
risk_score: 72
security_domain: network
type: TTP
version: 2
detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
+24 -24
View File
@@ -1,13 +1,22 @@
name: AWS Cross Account Activity From Previously Unseen Account
id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
version: 1
date: '2020-05-28'
author: Rico Valdez, Splunk
type: Anomaly
datamodel:
- Authentication
- Authentication.Authentication
date: '2020-05-28'
description: This search looks for AssumeRole events where an IAM role in a different
account is requested for the first time.
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen AWS Cross Account
Activity - Initial` to build the initial table of source IP address, geographic
locations, and times. You must also enable the second baseline search `Previously
Seen AWS Cross Account Activity - Update` to keep this table up to date and to age
out old data. You can also provide additional filtering for this search by customizing
the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
It's suspicious when an account requests privileges of an account it hasn't before.
You should validate with the account owner that this is a legitimate request.
name: AWS Cross Account Activity From Previously Unseen Account
references: []
search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user
Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)`
@@ -18,17 +27,6 @@ search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=
Cross Account Activity","Previously Seen") | where status = "New Cross Account
Activity" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
`aws_cross_account_activity_from_previously_unseen_account_filter`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen AWS Cross Account
Activity - Initial` to build the initial table of source IP address, geographic
locations, and times. You must also enable the second baseline search `Previously
Seen AWS Cross Account Activity - Update` to keep this table up to date and to age
out old data. You can also provide additional filtering for this search by customizing
the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
It's suspicious when an account requests privileges of an account it hasn't before.
You should validate with the account owner that this is a legitimate request.
references: []
tags:
analytic_story:
- Suspicious Cloud Authentication Activities
@@ -55,24 +53,26 @@ tags:
- DE.AE
observable:
- name: requestingAccountId
type: Other
role:
- Attacker
- name: requestedAccountId
type: Other
- name: requestedAccountId
role:
- Victim
type: Other
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Authentication.Authentication.signature
- Authentication.Authentication.src
- Authentication.Authentication.user
- Authentication.Authentication.user_role
- Authentication.Authentication.vendor_account
- _time
- Authentication.signature
- Authentication.vendor_account
- Authentication.user
- Authentication.user_role
- Authentication.src
risk_score: 15
security_domain: network
type: Anomaly
version: 1
detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
+15 -17
View File
@@ -1,14 +1,19 @@
name: AWS Detect Users creating keys with encrypt policy without MFA
id: c79c164f-4b21-4847-98f9-cf6a9f49179e
version: 1
date: '2021-01-11'
author: Rod Soto, Patrick Bareiss Splunk
type: TTP
datamodel: []
date: '2021-01-11'
description: This search provides detection of KMS keys where action kms:Encrypt is
accessible for everyone (also outside of your organization). This is an indicator
that your account is compromised and the attacker uses the encryption key to compromise
another company.
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs
id: c79c164f-4b21-4847-98f9-cf6a9f49179e
known_false_positives: unknown
name: AWS Detect Users creating keys with encrypt policy without MFA
references:
- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
- https://github.com/d1vious/git-wild-hunt
- https://www.youtube.com/watch?v=PgzNib37g0M
search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath input=requestParameters.policy
output=key_policy_statements path=Statement{} | mvexpand key_policy_statements |
spath input=key_policy_statements output=key_policy_action_1 path=Action | spath
@@ -18,13 +23,6 @@ search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath inpu
| stats count min(_time) as firstTime max(_time) as lastTime by eventName eventSource
eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs
known_false_positives: unknown
references:
- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
- https://github.com/d1vious/git-wild-hunt
- https://www.youtube.com/watch?v=PgzNib37g0M
tags:
analytic_story:
- Ransomware Cloud
@@ -45,9 +43,9 @@ tags:
- T1486
observable:
- name: userIdentity.principalId
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -55,11 +53,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- awsRegion
- eventID
- eventName
- eventSource
- eventID
- awsRegion
- requestParameters.policy
- userIdentity.principalId
risk_score: 25
security_domain: threat
type: TTP
version: 1
detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
+15 -19
View File
@@ -1,25 +1,23 @@
name: AWS Detect Users with KMS keys performing encryption S3
id: 884a5f59-eec7-4f4a-948b-dbde18225fdc
version: 1
date: '2021-01-11'
author: Rod Soto, Patrick Bareiss Splunk
type: Anomaly
datamodel: []
date: '2021-01-11'
description: This search provides detection of users with KMS keys performing encryption
specifically against S3 buckets.
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs
id: 884a5f59-eec7-4f4a-948b-dbde18225fdc
known_false_positives: bucket with S3 encryption
name: AWS Detect Users with KMS keys performing encryption S3
references:
- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
- https://github.com/d1vious/git-wild-hunt
- https://www.youtube.com/watch?v=PgzNib37g0M
search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms"
| rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source
AS src_file, requestParameters.key AS dest_file | stats count min(_time) as firstTime
max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file
values(userAgent) AS userAgent values(region) AS region values(src) AS src by user
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs
known_false_positives: bucket with S3 encryption
references:
- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
- https://github.com/d1vious/git-wild-hunt
- https://www.youtube.com/watch?v=PgzNib37g0M
tags:
analytic_story:
- Ransomware Cloud
@@ -40,13 +38,13 @@ tags:
- T1486
observable:
- name: user
type: User
role:
- Attacker
type: User
- name: dest_file
type: File
role:
- Target
type: File
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -55,11 +53,9 @@ tags:
required_fields:
- _time
- eventName
- requestParameters.x-amz-server-side-encryption
- requestParameters.bucketName
- requestParameters.x-amz-copy-source
- requestParameters.key
- userAgent
- region
- userAgent
risk_score: 15
security_domain: threat
type: Anomaly
version: 1
detections/cloud/aws_ecr_container_scanning_findings_high.yml
+16 -19
View File
@@ -1,13 +1,16 @@
name: AWS ECR Container Scanning Findings High
id: 62721bd2-1d82-4623-b6e6-aac170014423
version: 1
date: '2021-08-17'
author: Patrick Bareiss, Splunk
type: TTP
datamodel: []
date: '2021-08-17'
description: This search looks for AWS CloudTrail events from AWS Elastic Container
Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
with the results.
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: 62721bd2-1d82-4623-b6e6-aac170014423
known_false_positives: unknown
name: AWS ECR Container Scanning Findings High
references:
- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
| spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
findings | spath input=findings| search severity=HIGH | rename name as finding_name,
@@ -17,11 +20,6 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName,
src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `aws_ecr_container_scanning_findings_high_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: unknown
references:
- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
tags:
analytic_story:
- Dev Sec Ops
@@ -29,10 +27,10 @@ tags:
cis20:
- CIS 13
confidence: 100
deployments:
- Slack Alert
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
deployments:
- Slack Alert
impact: 70
kill_chain_phases:
- Actions on Objectives
@@ -46,23 +44,22 @@ tags:
- DE.CM
observable:
- name: image
type: System
role:
- Victim
type: System
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- eventSource
- eventName
- responseElements.imageScanFindings.findings{}
- awsRegion
- requestParameters.imageId.imageDigest
- requestParameters.repositoryName
- eventName
- eventSource
- src_ip
- user
- userName
- src_ip
risk_score: 70
security_domain: network
type: TTP
version: 1
detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+14 -17
View File
@@ -1,13 +1,16 @@
name: AWS ECR Container Scanning Findings Low Informational Unknown
id: cbc95e44-7c22-443f-88fd-0424478f5589
version: 1
date: '2021-08-17'
author: Patrick Bareiss, Splunk
type: Hunting
datamodel: []
date: '2021-08-17'
description: This search looks for AWS CloudTrail events from AWS Elastic Container
Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
with the results.
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: cbc95e44-7c22-443f-88fd-0424478f5589
known_false_positives: unknown
name: AWS ECR Container Scanning Findings Low Informational Unknown
references:
- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
| spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON)
@@ -18,11 +21,6 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase,
severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `aws_ecr_container_scanning_findings_low_informational_unknown_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: unknown
references:
- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
tags:
analytic_story:
- Dev Sec Ops
@@ -45,23 +43,22 @@ tags:
- DE.CM
observable:
- name: repositoryName
type: System
role:
- Victim
type: System
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- eventSource
- eventName
- responseElements.imageScanFindings.findings{}
- awsRegion
- requestParameters.imageId.imageDigest
- requestParameters.repositoryName
- eventName
- eventSource
- src_ip
- user
- userName
- src_ip
risk_score: 7
security_domain: network
type: Hunting
version: 1
detections/cloud/aws_ecr_container_scanning_findings_medium.yml
+14 -17
View File
@@ -1,13 +1,16 @@
name: AWS ECR Container Scanning Findings Medium
id: 0b80e2c8-c746-4ddb-89eb-9efd892220cf
version: 1
date: '2021-08-17'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
date: '2021-08-17'
description: This search looks for AWS CloudTrail events from AWS Elastic Container
Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
with the results.
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: 0b80e2c8-c746-4ddb-89eb-9efd892220cf
known_false_positives: unknown
name: AWS ECR Container Scanning Findings Medium
references:
- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
| spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
findings | spath input=findings| search severity=MEDIUM | rename name as finding_name,
@@ -17,11 +20,6 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image,
user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: unknown
references:
- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
tags:
analytic_story:
- Dev Sec Ops
@@ -44,23 +42,22 @@ tags:
- DE.CM
observable:
- name: image
type: System
role:
- Victim
type: System
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- eventSource
- eventName
- responseElements.imageScanFindings.findings{}
- awsRegion
- requestParameters.imageId.imageDigest
- requestParameters.repositoryName
- eventName
- eventSource
- src_ip
- user
- userName
- src_ip
risk_score: 21
security_domain: network
type: Anomaly
version: 1
detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
+17 -20
View File
@@ -1,25 +1,23 @@
name: AWS ECR Container Upload Outside Business Hours
id: d4c4d4eb-3994-41ca-a25e-a82d64e125bb
version: 1
date: '2021-08-19'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
date: '2021-08-19'
description: This search looks for AWS CloudTrail events from AWS Elastic Container
Service (ECR). A upload of a new container is normally done during business hours.
When done outside business hours, we want to take a look into it.
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: d4c4d4eb-3994-41ca-a25e-a82d64e125bb
known_false_positives: When your development is spreaded in different time zones,
applying this rule can be difficult.
name: AWS ECR Container Upload Outside Business Hours
references:
- https://attack.mitre.org/techniques/T1204/003/
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20
OR date_hour<8 NOT (date_wday=saturday OR date_wday=sunday) | rename requestParameters.*
as * | rename repositoryName AS image | eval phase="release" | eval severity="medium"
| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName,
eventSource, user, userName, src_ip, imageTag, registryId, image, phase, severity
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_outside_business_hours_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: When your development is spreaded in different time zones,
applying this rule can be difficult.
references:
- https://attack.mitre.org/techniques/T1204/003/
tags:
analytic_story:
- Dev Sec Ops
@@ -42,27 +40,26 @@ tags:
- DE.CM
observable:
- name: src_ip
role:
- Attacker
type: IP Address
role:
- Attacker
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- eventSource
- eventName
- awsRegion
- requestParameters.imageTag
- requestParameters.registryId
- requestParameters.repositoryName
- eventName
- eventSource
- src_ip
- user
- userName
- src_ip
risk_score: 49
security_domain: network
type: Anomaly
version: 1
detections/cloud/aws_ecr_container_upload_unknown_user.yml
+16 -19
View File
@@ -1,25 +1,23 @@
name: AWS ECR Container Upload Unknown User
id: 300688e4-365c-4486-a065-7c884462b31d
version: 1
date: '2021-08-19'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
date: '2021-08-19'
description: This search looks for AWS CloudTrail events from AWS Elastic Container
Service (ECR). A upload of a new container is normally done from only a few known
users. When the user was never seen before, we should have a closer look into the
event.
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: 300688e4-365c-4486-a065-7c884462b31d
known_false_positives: unknown
name: AWS ECR Container Upload Unknown User
references:
- https://attack.mitre.org/techniques/T1204/003/
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users`
| rename requestParameters.* as * | rename repositoryName AS image | eval phase="release"
| eval severity="high" | stats min(_time) as firstTime max(_time) as lastTime by
awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId,
image, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `aws_ecr_container_upload_unknown_user_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: unknown
references:
- https://attack.mitre.org/techniques/T1204/003/
tags:
analytic_story:
- Dev Sec Ops
@@ -42,27 +40,26 @@ tags:
- DE.CM
observable:
- name: src_ip
role:
- Attacker
type: IP Address
role:
- Attacker
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- eventSource
- eventName
- awsRegion
- requestParameters.imageTag
- requestParameters.registryId
- requestParameters.repositoryName
- eventName
- eventSource
- src_ip
- user
- userName
- src_ip
risk_score: 49
security_domain: network
type: Anomaly
version: 1
detections/cloud/aws_excessive_security_scanning.yml
+14 -15
View File
@@ -1,23 +1,21 @@
name: AWS Excessive Security Scanning
id: 1fdd164a-def8-4762-83a9-9ffe24e74d5a
version: 1
date: '2021-04-13'
author: Patrick Bareiss, Splunk
type: TTP
datamodel: []
date: '2021-04-13'
description: This search looks for AWS CloudTrail events and analyse the amount of
eventNames which starts with Describe by a single user. This indicates that this
user scans the configuration of your AWS cloud environment.
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: 1fdd164a-def8-4762-83a9-9ffe24e74d5a
known_false_positives: While this search has no known false positives.
name: AWS Excessive Security Scanning
references:
- https://github.com/aquasecurity/cloudsploit
search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* |
stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime
values(eventName) as eventName values(src) as src values(userAgent) as userAgent
by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives.
references:
- https://github.com/aquasecurity/cloudsploit
tags:
analytic_story:
- AWS User Monitoring
@@ -46,13 +44,13 @@ tags:
- DE.CM
observable:
- name: src
role:
- Attacker
type: IP Address
role:
- Attacker
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -62,10 +60,11 @@ tags:
- _time
- eventName
- src
- userAgent
- user
- userIdentity.arn
- userAgent
risk_object: src
risk_object_type: system
risk_score: 18
security_domain: network
type: TTP
version: 1
detections/cloud/aws_iam_accessdenied_discovery_events.yml
+16 -17
View File
@@ -1,26 +1,24 @@
name: AWS IAM AccessDenied Discovery Events
id: 3e1f1568-9633-11eb-a69c-acde48001122
version: 2
date: '2021-11-12'
author: Michael Haag, Splunk
type: Anomaly
datamodel: []
date: '2021-11-12'
description: The following detection identifies excessive AccessDenied events within
an hour timeframe. It is possible that an access key to AWS may have been stolen
and is being misused to perform discovery events. In these instances, the access
is not available with the key stolen therefore these events will be generated.
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
this data. The search requires AWS Cloudtrail logs.
id: 3e1f1568-9633-11eb-a69c-acde48001122
known_false_positives: It is possible to start this detection will need to be tuned
by source IP or user. In addition, change the count values to an upper threshold
to restrict false positives.
name: AWS IAM AccessDenied Discovery Events
references:
- https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/
search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com)
| bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time)
as lastTime, dc(eventName) as methods, dc(eventSource) as sources by src_ip, userIdentity.arn,
_time | where failures >= 5 and methods >= 1 and sources >= 1 | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_iam_accessdenied_discovery_events_filter`'
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
this data. The search requires AWS Cloudtrail logs.
known_false_positives: It is possible to start this detection will need to be tuned
by source IP or user. In addition, change the count values to an upper threshold
to restrict false positives.
references:
- https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/
tags:
analytic_story:
- Suspicious Cloud User Activities
@@ -42,13 +40,13 @@ tags:
- T1580
observable:
- name: src_ip
role:
- Attacker
type: IP Address
role:
- Attacker
- name: userIdentity.arn
type: User
role:
- Attacker
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -56,12 +54,13 @@ tags:
- Splunk Security Analytics for AWS
required_fields:
- _time
- errorCode
- eventName
- eventSource
- userAgent
- errorCode
- userIdentity.type
risk_object: src_ip
risk_object_type: system
risk_score: 10
security_domain: access
type: Anomaly
version: 2
detections/cloud/aws_iam_assume_role_policy_brute_force.yml
+18 -19
View File
@@ -1,32 +1,30 @@
name: AWS IAM Assume Role Policy Brute Force
id: f19e09b0-9308-11eb-b7ec-acde48001122
version: 1
date: '2021-04-01'
author: Michael Haag, Splunk
type: TTP
datamodel: []
date: '2021-04-01'
description: The following detection identifies any malformed policy document exceptions
with a status of `failure`. A malformed policy document exception occurs in instances
where roles are attempted to be assumed, or brute forced. In a brute force attempt,
using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`. Meaning,
when an adversary is attempting to identify a role name, multiple failures will
occur. This detection focuses on the errors of a remote attempt that is failing.
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
this data. The search requires AWS Cloudtrail logs. Set the `where count` greater
than a value to identify suspicious activity in your environment.
id: f19e09b0-9308-11eb-b7ec-acde48001122
known_false_positives: This detection will require tuning to provide high fidelity
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
or by groups of users.
name: AWS IAM Assume Role Policy Brute Force
references:
- https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities
- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
- https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html
search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure
(userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as
lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource
aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion
userIdentity.principalId user_arn | where count >= 2 | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`'
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
this data. The search requires AWS Cloudtrail logs. Set the `where count` greater
than a value to identify suspicious activity in your environment.
known_false_positives: This detection will require tuning to provide high fidelity
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
or by groups of users.
references:
- https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities
- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
- https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html
tags:
analytic_story:
- AWS IAM Privilege Escalation
@@ -49,13 +47,13 @@ tags:
- T1110
observable:
- name: src
type: IP Address
role:
- Attacker
type: IP Address
- name: user_arn
type: User
role:
- Victim
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -63,9 +61,10 @@ tags:
- Splunk Security Analytics for AWS
required_fields:
- _time
- errorCode
- eventName
- userAgent
- errorCode
- requestParameters.policyName
risk_score: 28
security_domain: access
type: TTP
version: 1
detections/cloud/aws_iam_delete_policy.yml
+13 -14
View File
@@ -1,30 +1,28 @@
name: AWS IAM Delete Policy
id: ec3a9362-92fe-11eb-99d0-acde48001122
version: 1
date: '2021-04-01'
author: Michael Haag, Splunk
type: Hunting
datamodel: []
date: '2021-04-01'
description: The following detection identifes when a policy is deleted on AWS. This
does not identify whether successful or failed, but the error messages tell a story
of suspicious attempts. There is a specific process to follow when deleting a policy.
First, detach the policy from all users, groups, and roles that the policy is attached
to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats
count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn)
as policyArn by src eventName eventSource aws_account_id errorCode errorMessage
userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`'
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
this data. The search requires AWS Cloudtrail logs.
id: ec3a9362-92fe-11eb-99d0-acde48001122
known_false_positives: This detection will require tuning to provide high fidelity
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
or by groups of users. Not every user with AWS access should have permission to
delete policies (least privilege). In addition, this may be saved seperately and
tuned for failed or success attempts only.
name: AWS IAM Delete Policy
references:
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html
- https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html
search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats
count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn)
as policyArn by src eventName eventSource aws_account_id errorCode errorMessage
userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`'
tags:
analytic_story:
- AWS IAM Privilege Escalation
@@ -46,13 +44,13 @@ tags:
- T1098
observable:
- name: src
type: IP Address
role:
- Attacker
type: IP Address
- name: user_arn
type: User
role:
- Victim
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -60,9 +58,10 @@ tags:
- Splunk Security Analytics for AWS
required_fields:
- _time
- errorCode
- eventName
- userAgent
- errorCode
- requestParameters.policyArn
risk_score: 10
security_domain: access
type: Hunting
version: 1
detections/cloud/aws_iam_failure_group_deletion.yml
+18 -19
View File
@@ -1,30 +1,28 @@
name: AWS IAM Failure Group Deletion
id: 723b861a-92eb-11eb-93b8-acde48001122
version: 1
date: '2021-04-01'
author: Michael Haag, Splunk
type: Anomaly
datamodel: []
date: '2021-04-01'
description: This detection identifies failure attempts to delete groups. We want
to identify when a group is attempting to be deleted, but either access is denied,
there is a conflict or there is no group. This is indicative of administrators performing
an action, but also could be suspicious behavior occurring. Review parallel IAM
events - recently added users, new groups and so forth.
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
this data. The search requires AWS Cloudtrail logs.
id: 723b861a-92eb-11eb-93b8-acde48001122
known_false_positives: This detection will require tuning to provide high fidelity
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
or by groups of users. Not every user with AWS access should have permission to
delete groups (least privilege).
name: AWS IAM Failure Group Deletion
references:
- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode
IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com)
| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName)
as group_name by src eventName eventSource aws_account_id errorCode errorMessage
userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_iam_failure_group_deletion_filter`'
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
this data. The search requires AWS Cloudtrail logs.
known_false_positives: This detection will require tuning to provide high fidelity
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
or by groups of users. Not every user with AWS access should have permission to
delete groups (least privilege).
references:
- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
tags:
analytic_story:
- AWS IAM Privilege Escalation
@@ -45,17 +43,17 @@ tags:
- T1098
observable:
- name: src
type: IP Address
role:
- Attacker
type: IP Address
- name: user_arn
type: User
role:
- Victim
type: User
- name: group_name
type: User
role:
- Victim
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -63,9 +61,10 @@ tags:
- Splunk Security Analytics for AWS
required_fields:
- _time
- errorCode
- eventName
- userAgent
- errorCode
- requestParameters.groupName
risk_score: 5
security_domain: cloud
type: Anomaly
version: 1
detections/cloud/aws_iam_successful_group_deletion.yml
+18 -19
View File
@@ -1,28 +1,26 @@
name: AWS IAM Successful Group Deletion
id: e776d06c-9267-11eb-819b-acde48001122
version: 1
date: '2021-03-31'
author: Michael Haag, Splunk
type: Hunting
datamodel: []
date: '2021-03-31'
description: The following query uses IAM events to track the success of a group being
deleted on AWS. This is typically not indicative of malicious behavior, but a precurser
to additional events thay may unfold. Review parallel IAM events - recently added
users, new groups and so forth. Inversely, review failed attempts in a similar manner.
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
this data. The search requires AWS Cloudtrail logs.
id: e776d06c-9267-11eb-819b-acde48001122
known_false_positives: This detection will require tuning to provide high fidelity
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
or by groups of users. Not every user with AWS access should have permission to
delete groups (least privilege).
name: AWS IAM Successful Group Deletion
references:
- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success
(userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as
lastTime values(requestParameters.groupName) as group_deleted by src eventName eventSource
errorCode user_agent awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_iam_successful_group_deletion_filter`'
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
this data. The search requires AWS Cloudtrail logs.
known_false_positives: This detection will require tuning to provide high fidelity
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
or by groups of users. Not every user with AWS access should have permission to
delete groups (least privilege).
references:
- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
tags:
analytic_story:
- AWS IAM Privilege Escalation
@@ -45,17 +43,17 @@ tags:
- T1069
observable:
- name: src
type: IP Address
role:
- Attacker
type: IP Address
- name: user_arn
type: User
role:
- Victim
type: User
- name: group_deleted
type: User
role:
- Victim
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -63,9 +61,10 @@ tags:
- Splunk Security Analytics for AWS
required_fields:
- _time
- errorCode
- eventName
- userAgent
- errorCode
- requestParameters.groupName
risk_score: 5
security_domain: cloud
type: Hunting
version: 1
detections/cloud/aws_lambda_updatefunctioncode.yml
+16 -17
View File
@@ -1,26 +1,24 @@
name: AWS Lambda UpdateFunctionCode
id: 211b80d3-6340-4345-11ad-212bf3d0d111
version: 1
date: '2022-02-24'
author: Bhavin Patel, Splunk
type: Hunting
datamodel: []
date: '2022-02-24'
description: This analytic is designed to detect IAM users attempting to update/modify
AWS lambda code via the AWS CLI to gain persistence, futher access into your AWS
environment and to facilitate planting backdoors. In this instance, an attacker
may upload malicious code/binary to a lambda function which will be executed automatically
when the funnction is triggered.
how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in
your AWS Environment.
id: 211b80d3-6340-4345-11ad-212bf3d0d111
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately.
name: AWS Lambda UpdateFunctionCode
references:
- http://detectioninthe.cloud/execution/modify_lambda_function_code/
- https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/
search: '`cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode* errorCode
= success user_type=IAMUser | stats count min(_time) as firstTime max(_time) as
lastTime values(requestParameters.functionName) as function_updated by src_ip user_arn
user_agent user_type eventName aws_account_id |`aws_lambda_updatefunctioncode_filter`'
how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in
your AWS Environment.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately.
references:
- http://detectioninthe.cloud/execution/modify_lambda_function_code/
- https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/
tags:
analytic_story:
- Suspicious Cloud User Activities
@@ -48,21 +46,22 @@ tags:
- DE.CM
observable:
- name: src_ip
role:
- Attacker
type: IP Address
role:
- Attacker
- name: user_arn
type: User
role:
- Attacker
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- eventName
- userAgent
- errorCode
- eventName
risk_score: 63
security_domain: cloud
type: Hunting
version: 1
detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
+19 -26
View File
@@ -1,12 +1,17 @@
name: AWS Network Access Control List Created with All Open Ports
id: ada0f478-84a8-4641-a3f1-d82362d6bd75
version: 2
date: '2021-01-11'
author: Bhavin Patel, Patrick Bareiss, Splunk
type: TTP
datamodel: []
date: '2021-01-11'
description: The search looks for AWS CloudTrail events to detect if any network ACLs
were created with all the ports open to a specified CIDR.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail
inputs.
id: ada0f478-84a8-4641-a3f1-d82362d6bd75
known_false_positives: It's possible that an admin has created this ACL with all ports
open for some legitimate purpose however, this should be scoped and not allowed
in production environment.
name: AWS Network Access Control List Created with All Open Ports
references: []
search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1
| append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
@@ -17,13 +22,6 @@ search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor
requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to
requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail
inputs.
known_false_positives: It's possible that an admin has created this ACL with all ports
open for some legitimate purpose however, this should be scoped and not allowed
in production environment.
references: []
tags:
analytic_story:
- AWS Network ACL Activity
@@ -52,17 +50,17 @@ tags:
- DE.AE
observable:
- name: src
type: IP Address
role:
- Attacker
- name: userName
type: User
role:
- Victim
- name: requestParameters.cidrBlock
type: IP Address
- name: userName
role:
- Victim
type: User
- name: requestParameters.cidrBlock
role:
- Victim
type: IP Address
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -71,14 +69,9 @@ tags:
required_fields:
- _time
- eventName
- requestParameters.ruleAction
- requestParameters.egress
- requestParameters.aclProtocol
- requestParameters.portRange.to
- requestParameters.portRange.from
- requestParameters.cidrBlock
- userName
- userIdentity.principalId
- userAgent
- userName
risk_score: 48
security_domain: network
type: TTP
version: 2
detections/cloud/aws_network_access_control_list_deleted.yml
+14 -16
View File
@@ -1,25 +1,23 @@
name: AWS Network Access Control List Deleted
id: ada0f478-84a8-4641-a3f1-d82362d6fd75
version: 2
date: '2021-01-12'
author: Bhavin Patel, Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
date: '2021-01-12'
description: Enforcing network-access controls is one of the defensive mechanisms
used by cloud administrators to restrict access to a cloud instance. After the attacker
has gained control of the AWS console by compromising an admin account, they can
delete a network ACL and gain access to the instance from anywhere. This search
will query the AWS CloudTrail logs to detect users deleting network ACLs.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs.
id: ada0f478-84a8-4641-a3f1-d82362d6fd75
known_false_positives: It's possible that a user has legitimately deleted a network
ACL.
name: AWS Network Access Control List Deleted
references: []
search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
| fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName
userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs.
known_false_positives: It's possible that a user has legitimately deleted a network
ACL.
references: []
tags:
analytic_story:
- AWS Network ACL Activity
@@ -47,13 +45,13 @@ tags:
- DE.AE
observable:
- name: src
type: IP Address
role:
- Attacker
type: IP Address
- name: user_arn
type: User
role:
- Victim
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -62,10 +60,10 @@ tags:
required_fields:
- _time
- eventName
- requestParameters.egress
- userName
- userIdentity.principalId
- src
- userAgent
- userName
risk_score: 5
security_domain: network
type: Anomaly
version: 2
detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
+12 -16
View File
@@ -1,32 +1,30 @@
name: AWS SAML Access by Provider User and Principal
id: bbe23980-6019-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
author: Rod Soto, Splunk
type: Anomaly
datamodel: []
date: '2021-01-26'
description: This search provides specific SAML access from specific Service Provider,
user and targeted principal at AWS. This search provides specific information to
detect abnormal access or potential credential hijack or forgery, specially in federated
environments using SAML protocol inside the perimeter or cloud provider.
search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime
max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn
requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress
userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|`aws_saml_access_by_provider_user_and_principal_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs
id: bbe23980-6019-11eb-ae93-0242ac130002
known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries
are very difficult to detect as accessing cloud providers with these assertions
looks exactly like normal access, however things such as source IP sourceIPAddress
user, and principal targeted at receiving cloud provider along with endpoint credential
access and abuse detection searches can provide the necessary context to detect
these attacks.
name: AWS SAML Access by Provider User and Principal
references:
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime
max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn
requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress
userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|`aws_saml_access_by_provider_user_and_principal_filter`'
tags:
analytic_story:
- Cloud Federated Credential Abuse
@@ -47,14 +45,14 @@ tags:
- T1078
observable:
- name: sourceIPAddress
type: IP Address
role:
- Attacker
type: IP Address
- name: recipientAccountId
type: Other
role:
- Victim
- Target
type: Other
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -63,12 +61,10 @@ tags:
required_fields:
- _time
- eventName
- requestParameters.principalArn
- requestParameters.roleArn
- requestParameters.roleSessionName
- recipientAccountId
- responseElements.issuer
- sourceIPAddress
- userAgent
risk_score: 64
security_domain: threat
type: Anomaly
version: 1
detections/cloud/aws_saml_update_identity_provider.yml
+12 -16
View File
@@ -1,28 +1,26 @@
name: AWS SAML Update identity provider
id: 2f0604c6-6030-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
author: Rod Soto, Splunk
type: TTP
datamodel: []
date: '2021-01-26'
description: This search provides detection of updates to SAML provider in AWS. Updates
to SAML provider need to be monitored closely as they may indicate possible perimeter
compromise of federated credentials, or backdoor access from another cloud provider
set by attacker.
search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as firstTime
max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn
userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId
userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|`aws_saml_update_identity_provider_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: 2f0604c6-6030-11eb-ae93-0242ac130002
known_false_positives: Updating a SAML provider or creating a new one may not necessarily
be malicious however it needs to be closely monitored.
name: AWS SAML Update identity provider
references:
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as firstTime
max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn
userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId
userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|`aws_saml_update_identity_provider_filter`'
tags:
analytic_story:
- Cloud Federated Credential Abuse
@@ -42,14 +40,14 @@ tags:
- T1078
observable:
- name: sourceIPAddress
type: IP Address
role:
- Attacker
type: IP Address
- name: userIdentity.principalId
type: User
role:
- Victim
- Target
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -59,10 +57,8 @@ tags:
- _time
- eventName
- eventType
- requestParameters.sAMLProviderArn
- userIdentity.sessionContext.sessionIssuer.arn
- sourceIPAddress
- userIdentity.accessKeyId
- userIdentity.principalId
risk_score: 64
security_domain: threat
type: TTP
version: 1
detections/cloud/aws_setdefaultpolicyversion.yml
+18 -19
View File
@@ -1,28 +1,26 @@
name: AWS SetDefaultPolicyVersion
id: 2a9b80d3-6340-4345-11ad-212bf3d0dac4
version: 1
date: '2021-03-02'
author: Bhavin Patel, Splunk
type: TTP
datamodel: []
date: '2021-03-02'
description: This search looks for AWS CloudTrail events where a user has set a default
policy versions. Attackers have been know to use this technique for Privilege Escalation
in case the previous versions of the policy had permissions to access more resources
than the current version of the policy
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: 2a9b80d3-6340-4345-11ad-212bf3d0dac4
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately set a default policy to allow a user to access
all resources. That said, AWS strongly advises against granting full control to
all AWS resources
name: AWS SetDefaultPolicyVersion
references:
- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
search: '`cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazonaws.com
| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn)
as policy_arn by src requestParameters.versionId eventName eventSource aws_account_id
errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_setdefaultpolicyversion_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately set a default policy to allow a user to access
all resources. That said, AWS strongly advises against granting full control to
all AWS resources
references:
- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
tags:
analytic_story:
- AWS IAM Privilege Escalation
@@ -52,13 +50,13 @@ tags:
- DE.CM
observable:
- name: src
type: IP Address
role:
- Attacker
type: IP Address
- name: user_arn
type: User
role:
- Victim
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -66,10 +64,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- eventName
- userAgent
- errorCode
- requestParameters.userName
- eventName
- eventSource
- userAgent
risk_score: 30
security_domain: threat
type: TTP
version: 1
detections/cloud/aws_updateloginprofile.yml
+14 -19
View File
@@ -1,31 +1,25 @@
name: AWS UpdateLoginProfile
id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111
version: 3
date: '2022-03-03'
author: Bhavin Patel, Splunk
type: TTP
datamodel: []
date: '2022-03-03'
description: This search looks for AWS CloudTrail events where a user A who has already
permission to update login profile, makes an API call to update login profile for
another user B . Attackers have been know to use this technique for Privilege Escalation
in case new victim(user B) has more permissions than old victim(user B)
search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success
| eval match=if(match(userIdentity.userName,requestParameters.userName), 1,0)
| search match=0
| stats
count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName
src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName
user_arn
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_updateloginprofile_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created keys for another user.
name: AWS UpdateLoginProfile
references:
- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com
errorCode = success | eval match=if(match(userIdentity.userName,requestParameters.userName),
1,0) | search match=0 | stats count min(_time) as firstTime max(_time) as lastTime
by requestParameters.userName src eventName eventSource aws_account_id errorCode
userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_updateloginprofile_filter`'
tags:
analytic_story:
- AWS IAM Privilege Escalation
@@ -51,13 +45,13 @@ tags:
- DE.CM
observable:
- name: src
type: IP Address
role:
- Attacker
type: IP Address
- name: user_arn
type: User
role:
- Victim
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -65,9 +59,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- errorCode
- eventName
- userAgent
- errorCode
- requestParameters.userName
risk_score: 30
security_domain: threat
type: TTP
version: 3
detections/cloud/circle_ci_disable_security_job.yml
+10 -11
View File
@@ -1,11 +1,12 @@
name: Circle CI Disable Security Job
id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2
version: 1
date: '2021-09-02'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
date: '2021-09-02'
description: This search looks for disable security job in CircleCI pipeline.
how_to_implement: You must index CircleCI logs.
id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2
known_false_positives: unknown
name: Circle CI Disable Security Job
references: []
search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_message
vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id
workflow_name user commit_message url branch | lookup mandatory_job_for_workflow
@@ -13,9 +14,6 @@ search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_me
mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where
mandatory_job_executed=0 | eval phase="build" | rex field=url "(?<repository>[^\/]*\/[^\/]*)$"
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `circle_ci_disable_security_job_filter`'
how_to_implement: You must index CircleCI logs.
known_false_positives: unknown
references: []
tags:
analytic_story:
- Dev Sec Ops
@@ -39,15 +37,16 @@ tags:
- DE.CM
observable:
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _times
required_fields: []
risk_score: 72
security_domain: network
type: Anomaly
version: 1
detections/cloud/circle_ci_disable_security_step.yml
+10 -11
View File
@@ -1,11 +1,12 @@
name: Circle CI Disable Security Step
id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97
version: 1
date: '2021-09-01'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
date: '2021-09-01'
description: This search looks for disable security step in CircleCI pipeline.
how_to_implement: You must index CircleCI logs.
id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97
known_false_positives: unknown
name: Circle CI Disable Security Step
references: []
search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search `circleci`
| stats values(name) as step_names count by job_id job_name ] | stats count by step_names
job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as
@@ -14,9 +15,6 @@ search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search
"%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | rex field=url
"(?<repository>[^\/]*\/[^\/]*)$" | eval phase="build" | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter`'
how_to_implement: You must index CircleCI logs.
known_false_positives: unknown
references: []
tags:
analytic_story:
- Dev Sec Ops
@@ -39,15 +37,16 @@ tags:
- DE.CM
observable:
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _times
required_fields: []
risk_score: 72
security_domain: network
type: Anomaly
version: 1
detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
+22 -22
View File
@@ -1,12 +1,20 @@
name: Cloud API Calls From Previously Unseen User Roles
id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
version: 1
date: '2020-09-04'
author: David Dorsey, Splunk
type: Anomaly
datamodel:
- Change
- Change.All_Changes
date: '2020-09-04'
description: This search looks for new commands from each user role.
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud API Calls Per
User Role - Initial` to build the initial table of user roles, commands, and times.
You must also enable the second baseline search `Previously Seen Cloud API Calls
Per User Role - Update` to keep this table up to date and to age out old data. You
can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window`
macro. You can also provide additional filtering for this search by customizing
the `cloud_api_calls_from_previously_unseen_user_roles_filter`
id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
known_false_positives: .
name: Cloud API Calls From Previously Unseen User Roles
references: []
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user,
All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` |
@@ -16,16 +24,6 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d
OR firstTimeSeenUserApiCall > relative_time(now(),"-24h@h") | table firstTime, user,
object, command |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
`cloud_api_calls_from_previously_unseen_user_roles_filter`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud API Calls Per
User Role - Initial` to build the initial table of user roles, commands, and times.
You must also enable the second baseline search `Previously Seen Cloud API Calls
Per User Role - Update` to keep this table up to date and to age out old data. You
can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window`
macro. You can also provide additional filtering for this search by customizing
the `cloud_api_calls_from_previously_unseen_user_roles_filter`
known_false_positives: .
references: []
tags:
analytic_story:
- Suspicious Cloud User Activities
@@ -51,22 +49,24 @@ tags:
- ID.AM
observable:
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Change.All_Changes.command
- Change.All_Changes.object
- Change.All_Changes.status
- Change.All_Changes.user
- Change.All_Changes.user_type
- _time
- All_Changes.user
- All_Changes.user_type
- All_Changes.status
- All_Changes.command
- All_Changes.object
risk_score: 36
security_domain: threat
supported_tas:
- Splunk_TA_aws-kinesis-firehose
type: Anomaly
version: 1
detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
+19 -19
View File
@@ -1,13 +1,18 @@
name: Cloud Compute Instance Created By Previously Unseen User
id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
version: 2
date: '2021-07-13'
author: Rico Valdez, Splunk
type: Anomaly
datamodel:
- Change
- Change.All_Changes
date: '2021-07-13'
description: This search looks for cloud compute instances created by users who have
not created them before.
how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs
Run the "Previously Seen Cloud Compute Creations By User" support search to create
of baseline of previously seen users.
id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
known_false_positives: It's possible that a user will start to create compute instances
for the first time, for any number of reasons. Verify with the user launching instances
that this is the intended behavior.
name: Cloud Compute Instance Created By Previously Unseen User
references: []
search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change.All_Changes
where All_Changes.action=created by All_Changes.user All_Changes.vendor_region |
@@ -17,13 +22,6 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs
| where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h")
| table firstTime, user, dest, count vendor_region | `security_content_ctime(firstTime)`
| `cloud_compute_instance_created_by_previously_unseen_user_filter`'
how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs
Run the "Previously Seen Cloud Compute Creations By User" support search to create
of baseline of previously seen users.
known_false_positives: It's possible that a user will start to create compute instances
for the first time, for any number of reasons. Verify with the user launching instances
that this is the intended behavior.
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -49,25 +47,27 @@ tags:
- ID.AM
observable:
- name: user
type: User
role:
- Attacker
type: User
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Change.All_Changes.action
- Change.All_Changes.object
- Change.All_Changes.user
- Change.All_Changes.vendor_region
- _time
- All_Changes.object
- All_Changes.action
- All_Changes.user
- All_Changes.vendor_region
risk_score: 18
security_domain: threat
supported_tas:
- Splunk_TA_aws-kinesis-firehose
type: Anomaly
version: 2
detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
+20 -20
View File
@@ -1,22 +1,10 @@
name: Cloud Compute Instance Created In Previously Unused Region
id: fa4089e2-50e3-40f7-8469-d2cc1564ca59
version: 1
date: '2020-09-02'
author: David Dorsey, Splunk
type: Anomaly
datamodel:
- Change
- Change.All_Changes
date: '2020-09-02'
description: This search looks at cloud-infrastructure events where an instance is
created in any region within the last hour and then compares it to a lookup file
of previously seen regions where instances have been created.
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id)
as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region,
All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions
vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats
max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen)
| where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(),
"-24h@h") | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)`
| `cloud_compute_instance_created_in_previously_unused_region_filter`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Regions - Initial`
to build the initial table of images observed and times. You must also enable the
@@ -24,9 +12,19 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
up to date and to age out old data. You can also provide additional filtering for
this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter`
macro.
id: fa4089e2-50e3-40f7-8469-d2cc1564ca59
known_false_positives: It's possible that a user has unknowingly started an instance
in a new region. Please verify that this activity is legitimate.
name: Cloud Compute Instance Created In Previously Unused Region
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id)
as dest, count from datamodel=Change.All_Changes where All_Changes.action=created
by All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")`
| lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW
firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion)
OR firstTimeSeenRegion > relative_time(now(), "-24h@h") | table firstTime, user,
dest, count , vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_in_previously_unused_region_filter`'
tags:
analytic_story:
- Cloud Cryptomining
@@ -54,25 +52,27 @@ tags:
- DE.AE
observable:
- name: user
type: user
role:
- Attacker
type: user
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Change.All_Changes.action
- Change.All_Changes.object_id
- Change.All_Changes.user
- Change.All_Changes.vendor_region
- _time
- All_Changes.object_id
- All_Changes.action
- All_Changes.vendor_region
- All_Changes.user
risk_score: 42
security_domain: threat
supported_tas:
- Splunk_TA_aws-kinesis-firehose
type: Anomaly
version: 1
detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
+19 -24
View File
@@ -1,13 +1,21 @@
name: Cloud Compute Instance Created With Previously Unseen Image
id: bc24922d-987c-4645-b288-f8c73ec194c4
version: 1
date: '2018-10-12'
author: David Dorsey, Splunk
type: Anomaly
datamodel:
- Change
datamodel: []
date: '2018-10-12'
description: This search looks for cloud compute instances being created with previously
unseen image IDs.
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Compute Images
- Initial` to build the initial table of images observed and times. You must also
enable the second baseline search `Previously Seen Cloud Compute Images - Update`
to keep this table up to date and to age out old data. You can also provide additional
filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter`
macro.
id: bc24922d-987c-4645-b288-f8c73ec194c4
known_false_positives: After a new image is created, the first systems created with
that image will cause this alert to fire. Verify that the image being used was
created by a legitimate user.
name: Cloud Compute Instance Created With Previously Unseen Image
references: []
search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id,
All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
@@ -16,17 +24,6 @@ search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime
| where enough_data=1 | eval firstTimeSeenImage=min(firstTimeSeen) | where isnull(firstTimeSeenImage)
OR firstTimeSeenImage > relative_time(now(), "-24h@h") | table firstTime, user,
image_id, count, dest | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_image_filter`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Compute Images
- Initial` to build the initial table of images observed and times. You must also
enable the second baseline search `Previously Seen Cloud Compute Images - Update`
to keep this table up to date and to age out old data. You can also provide additional
filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter`
macro.
known_false_positives: After a new image is created, the first systems created with
that image will cause this alert to fire. Verify that the image being used was
created by a legitimate user.
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -49,13 +46,13 @@ tags:
- ID.AM
observable:
- name: user
type: User
role:
- Attacker
type: User
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -63,11 +60,9 @@ tags:
- Splunk Cloud
required_fields:
- _time
- All_Changes.object_id
- All_Changes.action
- All_Changes.Instance_Changes.image_id
- All_Changes.user
risk_score: 36
security_domain: threat
supported_tas:
- Splunk_TA_aws-kinesis-firehose
type: Anomaly
version: 1
detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+19 -24
View File
@@ -1,12 +1,20 @@
name: Cloud Compute Instance Created With Previously Unseen Instance Type
id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
version: 1
date: '2020-09-12'
author: David Dorsey, Splunk
type: Anomaly
datamodel:
- Change
datamodel: []
date: '2020-09-12'
description: Find EC2 instances being created with previously unseen instance types.
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Compute Instance
Types - Initial` to build the initial table of instance types observed and times.
You must also enable the second baseline search `Previously Seen Cloud Compute Instance
Types - Update` to keep this table up to date and to age out old data. You can also
provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`
macro.
id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
known_false_positives: It is possible that an admin will create a new system using
a new instance type that has never been used before. Verify with the creator that
they intended to create the system with the new instance type.
name: Cloud Compute Instance Created With Previously Unseen Instance Type
references: []
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type,
All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
@@ -16,17 +24,6 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values
| where isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(),
"-24h@h") | table firstTime, user, dest, count, instance_type | `security_content_ctime(firstTime)`
| `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Compute Instance
Types - Initial` to build the initial table of instance types observed and times.
You must also enable the second baseline search `Previously Seen Cloud Compute Instance
Types - Update` to keep this table up to date and to age out old data. You can also
provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`
macro.
known_false_positives: It is possible that an admin will create a new system using
a new instance type that has never been used before. Verify with the creator that
they intended to create the system with the new instance type.
references: []
tags:
analytic_story:
- Cloud Cryptomining
@@ -49,13 +46,13 @@ tags:
- ID.AM
observable:
- name: user
type: User
role:
- Attacker
type: User
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -63,11 +60,9 @@ tags:
- Splunk Cloud
required_fields:
- _time
- All_Changes.object_id
- All_Changes.action
- All_Changes.Instance_Changes.instance_type
- All_Changes.user
risk_score: 30
security_domain: threat
supported_tas:
- Splunk_TA_aws-kinesis-firehose
type: Anomaly
version: 1
detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
+22 -22
View File
@@ -1,13 +1,19 @@
name: Cloud Instance Modified By Previously Unseen User
id: 7fb15084-b14e-405a-bd61-a6de15a40722
version: 1
date: '2020-07-29'
author: Rico Valdez, Splunk
type: Anomaly
datamodel:
- Change
- Change.All_Changes
date: '2020-07-29'
description: This search looks for cloud instances being modified by users who have
not previously modified them.
how_to_implement: This search has a dependency on other searches to create and update
a baseline of users observed to be associated with this activity. The search "Previously
Seen Cloud Instance Modifications By User - Update" should be enabled for this detection
to properly work.
id: 7fb15084-b14e-405a-bd61-a6de15a40722
known_false_positives: It's possible that a new user will start to modify EC2 instances
when they haven't before for any number of reasons. Verify with the user that is
modifying instances that this is the intended behavior.
name: Cloud Instance Modified By Previously Unseen User
references: []
search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command)
as command from datamodel=Change.All_Changes where All_Changes.action=modified All_Changes.change_type=EC2
@@ -17,14 +23,6 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs
enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) | where isnull(firstTimeSeenUser)
OR firstTimeSeenUser > relative_time(now(), "-24h@h") | table firstTime user command
object_id count | `security_content_ctime(firstTime)` | `cloud_instance_modified_by_previously_unseen_user_filter`'
how_to_implement: This search has a dependency on other searches to create and update
a baseline of users observed to be associated with this activity. The search "Previously
Seen Cloud Instance Modifications By User - Update" should be enabled for this detection
to properly work.
known_false_positives: It's possible that a new user will start to modify EC2 instances
when they haven't before for any number of reasons. Verify with the user that is
modifying instances that this is the intended behavior.
references: []
tags:
analytic_story:
- Suspicious Cloud Instance Activities
@@ -49,27 +47,29 @@ tags:
- ID.AM
observable:
- name: user
type: User
role:
- Attacker
type: User
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Change.All_Changes.action
- Change.All_Changes.change_type
- Change.All_Changes.command
- Change.All_Changes.object_id
- Change.All_Changes.status
- Change.All_Changes.user
- _time
- All_Changes.object_id
- All_Changes.command
- All_Changes.action
- All_Changes.change_type
- All_Changes.status
- All_Changes.user
risk_score: 42
security_domain: threat
supported_tas:
- Splunk_TA_aws-kinesis-firehose
type: Anomaly
version: 1
detections/cloud/cloud_provisioning_from_previously_unseen_city.yml
+26 -26
View File
@@ -1,24 +1,10 @@
name: Cloud Provisioning Activity From Previously Unseen City
id: e7ecc5e0-88df-48b9-91af-51104c68f02f
version: 1
date: '2020-10-09'
author: Rico Valdez, Bhavin Patel, Splunk
type: Anomaly
datamodel:
- Change
- Change.All_Changes
date: '2020-10-09'
description: This search looks for cloud provisioning activities from previously unseen
cities. Provisioning activities are defined broadly as any event that runs or creates
something.
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) |
lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen,
enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 |
eval firstTimeSeenCity=min(firstTimeSeen) | where isnull(firstTimeSeenCity) OR firstTimeSeenCity
> relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) |
table firstTime, src, City, user, object, command | `cloud_provisioning_activity_from_previously_unseen_city_filter`
| `security_content_ctime(firstTime)`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Provisioning
Activity Sources - Initial` to build the initial table of source IP address, geographic
@@ -28,6 +14,7 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_city_filter`
macro.
id: e7ecc5e0-88df-48b9-91af-51104c68f02f
known_false_positives: "This is a strictly behavioral search, so we define \"false\
\ positive\" slightly differently. Every time this fires, it will accurately reflect\
\ the first occurrence in the time period you're searching within, plus what is\
@@ -39,7 +26,18 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal
\ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
\ has weak resolution (particularly small countries in less economically powerful\
\ regions), this may be much less valuable to you."
name: Cloud Provisioning Activity From Previously Unseen City
references: []
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) |
lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen,
enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 |
eval firstTimeSeenCity=min(firstTimeSeen) | where isnull(firstTimeSeenCity) OR firstTimeSeenCity
> relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) |
table firstTime, src, City, user, object, command | `cloud_provisioning_activity_from_previously_unseen_city_filter`
| `security_content_ctime(firstTime)`'
tags:
analytic_story:
- Suspicious Cloud Provisioning Activities
@@ -64,31 +62,33 @@ tags:
- ID.AM
observable:
- name: user
role:
- Attacker
type: User
role:
- Attacker
- name: src
type: IP Address
role:
- Attacker
type: IP Address
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Change.All_Changes.action
- Change.All_Changes.command
- Change.All_Changes.object
- Change.All_Changes.src
- Change.All_Changes.status
- Change.All_Changes.user
- _time
- All_Changes.action
- All_Changes.status
- All_Changes.src
- All_Changes.user
- All_Changes.object
- All_Changes.command
risk_score: 18
security_domain: threat
supported_tas:
- Splunk_TA_aws-kinesis-firehose
type: Anomaly
version: 1
detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
+26 -26
View File
@@ -1,24 +1,10 @@
name: Cloud Provisioning Activity From Previously Unseen Country
id: 94994255-3acf-4213-9b3f-0494df03bb31
version: 1
date: '2020-10-09'
author: Rico Valdez, Bhavin Patel, Splunk
type: Anomaly
datamodel:
- Change
- Change.All_Changes
date: '2020-10-09'
description: This search looks for cloud provisioning activities from previously unseen
countries. Provisioning activities are defined broadly as any event that runs or
creates something.
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country)
| lookup previously_seen_cloud_provisioning_activity_sources Country as Country
OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data |
where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry)
OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src,
Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter`
| `security_content_ctime(firstTime)`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Provisioning
Activity Sources - Initial` to build the initial table of source IP address, geographic
@@ -28,6 +14,7 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter`
macro.
id: 94994255-3acf-4213-9b3f-0494df03bb31
known_false_positives: "This is a strictly behavioral search, so we define \"false\
\ positive\" slightly differently. Every time this fires, it will accurately reflect\
\ the first occurrence in the time period you're searching within, plus what is\
@@ -39,7 +26,18 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal
\ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
\ has weak resolution (particularly small countries in less economically powerful\
\ regions), this may be much less valuable to you."
name: Cloud Provisioning Activity From Previously Unseen Country
references: []
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country)
| lookup previously_seen_cloud_provisioning_activity_sources Country as Country
OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data |
where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry)
OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src,
Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter`
| `security_content_ctime(firstTime)`'
tags:
analytic_story:
- Suspicious Cloud Provisioning Activities
@@ -64,31 +62,33 @@ tags:
- ID.AM
observable:
- name: user
role:
- Attacker
type: User
role:
- Attacker
- name: src
type: IP Address
role:
- Attacker
type: IP Address
- name: object
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Change.All_Changes.action
- Change.All_Changes.command
- Change.All_Changes.object
- Change.All_Changes.src
- Change.All_Changes.status
- Change.All_Changes.user
- _time
- All_Changes.action
- All_Changes.status
- All_Changes.src
- All_Changes.user
- All_Changes.object
- All_Changes.command
risk_score: 42
security_domain: threat
supported_tas:
- Splunk_TA_aws-kinesis-firehose
type: Anomaly
version: 1
detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml
+25 -25
View File
@@ -1,23 +1,10 @@
name: Cloud Provisioning Activity From Previously Unseen IP Address
id: f86a8ec9-b042-45eb-92f4-e9ed1d781078
version: 1
date: '2020-08-16'
author: Rico Valdez, Splunk
type: Anomaly
datamodel:
- Change
- Change.All_Changes
date: '2020-08-16'
description: This search looks for cloud provisioning activities from previously unseen
IP addresses. Provisioning activities are defined broadly as any event that runs
or creates something.
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id)
as object_id from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created)
All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command
| `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources
src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data
| where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc)
OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
| table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`
| `security_content_ctime(firstTime)`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Provisioning
Activity Sources - Initial` to build the initial table of source IP address, geographic
@@ -27,6 +14,7 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`
macro.
id: f86a8ec9-b042-45eb-92f4-e9ed1d781078
known_false_positives: "This is a strictly behavioral search, so we define \"false\
\ positive\" slightly differently. Every time this fires, it will accurately reflect\
\ the first occurrence in the time period you're searching within, plus what is\
@@ -38,7 +26,17 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal
\ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
\ has weak resolution (particularly small countries in less economically powerful\
\ regions), this may be much less valuable to you."
name: Cloud Provisioning Activity From Previously Unseen IP Address
references: []
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id)
as object_id from datamodel=Change.All_Changes where (All_Changes.action=started
OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user,
All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources
src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data
| where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc)
OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
| table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`
| `security_content_ctime(firstTime)`'
tags:
analytic_story:
- Suspicious Cloud Provisioning Activities
@@ -63,31 +61,33 @@ tags:
- ID.AM
observable:
- name: user
role:
- Attacker
type: User
role:
- Attacker
- name: src
type: IP Address
role:
- Attacker
type: IP Address
- name: object_id
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Change.All_Changes.action
- Change.All_Changes.command
- Change.All_Changes.object_id
- Change.All_Changes.src
- Change.All_Changes.status
- Change.All_Changes.user
- _time
- All_Changes.object_id
- All_Changes.action
- All_Changes.status
- All_Changes.src
- All_Changes.user
- All_Changes.command
risk_score: 42
security_domain: threat
supported_tas:
- Splunk_TA_aws-kinesis-firehose
type: Anomaly
version: 1
detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
+26 -26
View File
@@ -1,24 +1,10 @@
name: Cloud Provisioning Activity From Previously Unseen Region
id: 5aba1860-9617-4af9-b19d-aecac16fe4f2
version: 1
date: '2020-08-16'
author: Rico Valdez, Bhavin Patel, Splunk
type: Anomaly
datamodel:
- Change
- Change.All_Changes
date: '2020-08-16'
description: This search looks for cloud provisioning activities from previously unseen
regions. Provisioning activities are defined broadly as any event that runs or creates
something.
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region)
| lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT
firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion)
OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
| table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter`
| `security_content_ctime(firstTime)`'
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Provisioning
Activity Sources - Initial` to build the initial table of source IP address, geographic
@@ -28,6 +14,7 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_region_filter`
macro.
id: 5aba1860-9617-4af9-b19d-aecac16fe4f2
known_false_positives: "This is a strictly behavioral search, so we define \"false\
\ positive\" slightly differently. Every time this fires, it will accurately reflect\
\ the first occurrence in the time period you're searching within, plus what is\
@@ -39,7 +26,18 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal
\ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
\ has weak resolution (particularly small countries in less economically powerful\
\ regions), this may be much less valuable to you."
name: Cloud Provisioning Activity From Previously Unseen Region
references: []
search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
`drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region)
| lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT
firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion)
OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
| table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter`
| `security_content_ctime(firstTime)`'
tags:
analytic_story:
- Suspicious Cloud Provisioning Activities
@@ -64,31 +62,33 @@ tags:
- ID.AM
observable:
- name: user
role:
- Attacker
type: User
role:
- Attacker
- name: src
type: IP Address
role:
- Attacker
type: IP Address
- name: object
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Change.All_Changes.action
- Change.All_Changes.command
- Change.All_Changes.object
- Change.All_Changes.src
- Change.All_Changes.status
- Change.All_Changes.user
- _time
- All_Changes.action
- All_Changes.status
- All_Changes.src
- All_Changes.user
- All_Changes.object
- All_Changes.command
risk_score: 42
security_domain: threat
supported_tas:
- Splunk_TA_aws-kinesis-firehose
type: Anomaly
version: 1
detections/cloud/detect_aws_console_login_by_new_user.yml
+16 -16
View File
@@ -1,23 +1,12 @@
name: Detect AWS Console Login by New User
id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
version: 1
date: '2020-05-28'
author: Rico Valdez, Splunk
type: Hunting
datamodel:
- Authentication
- Authentication.Authentication
date: '2020-05-28'
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)`
| join user type=outer [ inputlookup previously_seen_users_console_logins | stats
min(firstTime) as earliestseen by user] | eval userStatus=if(earliestseen >= relative_time(now(),
"-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously
Seen User") | where userStatus="First Time Logging into AWS Console" | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `detect_aws_console_login_by_new_user_filter`'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
@@ -25,10 +14,19 @@ how_to_implement: You must install and configure the Splunk Add-on for AWS (vers
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines.
id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
name: Detect AWS Console Login by New User
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)`
| join user type=outer [ inputlookup previously_seen_users_console_logins | stats
min(firstTime) as earliestseen by user] | eval userStatus=if(earliestseen >= relative_time(now(),
"-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously
Seen User") | where userStatus="First Time Logging into AWS Console" | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `detect_aws_console_login_by_new_user_filter`'
tags:
analytic_story:
- Suspicious Cloud Authentication Activities
@@ -53,17 +51,19 @@ tags:
- DE.AE
observable:
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Authentication.Authentication.signature
- Authentication.Authentication.user
- _time
- Authentication.signature
- Authentication.user
risk_score: 30
security_domain: threat
type: Hunting
version: 1
detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+23 -23
View File
@@ -1,16 +1,27 @@
name: Detect AWS Console Login by User from New City
id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a
version: 1
date: '2020-10-07'
author: Bhavin Patel, Splunk
type: Hunting
datamodel:
- Authentication
- Authentication.Authentication
date: '2020-10-07'
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter`
macro.
id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
name: Detect AWS Console Login by User from New City
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
@@ -21,19 +32,6 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND
userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| table firstTime lastTime user City userStatus userCity | `detect_aws_console_login_by_user_from_new_city_filter`'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter`
macro.
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
references: []
tags:
analytic_story:
- Suspicious AWS Login Activities
@@ -62,18 +60,20 @@ tags:
- DE.AE
observable:
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Authentication.Authentication.signature
- Authentication.Authentication.src
- Authentication.Authentication.user
- _time
- Authentication.signature
- Authentication.user
- Authentication.src
risk_score: 18
security_domain: threat
type: Hunting
version: 1
detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+23 -23
View File
@@ -1,16 +1,27 @@
name: Detect AWS Console Login by User from New Country
id: 67bd3def-c41c-4bf6-837b-ae196b4257c6
version: 1
date: '2020-10-07'
author: Bhavin Patel, Splunk
type: Hunting
datamodel:
- Authentication
- Authentication.Authentication
date: '2020-10-07'
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter`
macro.
id: 67bd3def-c41c-4bf6-837b-ae196b4257c6
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
name: Detect AWS Console Login by User from New Country
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
@@ -21,19 +32,6 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country"
AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| table firstTime lastTime user Country userStatus userCountry | `detect_aws_console_login_by_user_from_new_country_filter`'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter`
macro.
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
references: []
tags:
analytic_story:
- Suspicious AWS Login Activities
@@ -62,18 +60,20 @@ tags:
- DE.AE
observable:
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Authentication.Authentication.signature
- Authentication.Authentication.src
- Authentication.Authentication.user
- _time
- Authentication.signature
- Authentication.user
- Authentication.src
risk_score: 42
security_domain: threat
type: Hunting
version: 1
detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+23 -23
View File
@@ -1,16 +1,27 @@
name: Detect AWS Console Login by User from New Region
id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026
version: 1
date: '2020-10-07'
author: Bhavin Patel, Splunk
type: Hunting
datamodel:
- Authentication
- Authentication.Authentication
date: '2020-10-07'
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter`
macro.
id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
name: Detect AWS Console Login by User from New Region
references: []
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
@@ -21,19 +32,6 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
OR isnull(earliestseen), "New User","Old User") | where userRegion = "New Region"
AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| table firstTime lastTime user Region userStatus userRegion | `detect_aws_console_login_by_user_from_new_region_filter`'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter`
macro.
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
references: []
tags:
analytic_story:
- Suspicious AWS Login Activities
@@ -62,18 +60,20 @@ tags:
- DE.AE
observable:
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Authentication.Authentication.signature
- Authentication.Authentication.src
- Authentication.Authentication.user
- _time
- Authentication.signature
- Authentication.user
- Authentication.src
risk_score: 36
security_domain: threat
type: Hunting
version: 1
detections/cloud/detect_new_open_s3_buckets.yml
+17 -19
View File
@@ -1,12 +1,16 @@
name: Detect New Open S3 buckets
id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4
version: 3
date: '2021-07-19'
author: Bhavin Patel, Patrick Bareiss, Splunk
type: TTP
datamodel: []
date: '2021-07-19'
description: This search looks for AWS CloudTrail events where a user has created
an open/public S3 bucket.
how_to_implement: You must install the AWS App for Splunk.
id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a public bucket for a specific purpose.
That said, AWS strongly advises against granting full control to the "All Users"
group.
name: Detect New Open S3 buckets
references: []
search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw
"(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{}
| search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI
@@ -16,12 +20,6 @@ search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex
max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission
bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `detect_new_open_s3_buckets_filter` '
how_to_implement: You must install the AWS App for Splunk.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a public bucket for a specific purpose.
That said, AWS strongly advises against granting full control to the "All Users"
group.
references: []
tags:
analytic_story:
- Suspicious AWS S3 Activities
@@ -50,13 +48,13 @@ tags:
- DE.CM
observable:
- name: user_arn
type: User
role:
- Attacker
type: User
- name: bucketName
type: Other
role:
- Victim
type: Other
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -64,13 +62,13 @@ tags:
- Splunk Cloud
required_fields:
- _time
- eventSource
- eventName
- requestParameters.bucketName
- user_arn
- userIdentity.principalId
- userAgent
- uri
- eventSource
- permission
- uri
- userAgent
- user_arn
risk_score: 48
security_domain: threat
type: TTP
version: 3
detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
+16 -23
View File
@@ -1,12 +1,16 @@
name: Detect New Open S3 Buckets over AWS CLI
id: 39c61d09-8b30-4154-922b-2d0a694ecc22
version: 2
date: '2021-07-19'
author: Patrick Bareiss, Splunk
type: TTP
datamodel: []
date: '2021-07-19'
description: This search looks for AWS CloudTrail events where a user has created
an open/public S3 bucket over the aws cli.
how_to_implement: ''
id: 39c61d09-8b30-4154-922b-2d0a694ecc22
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a public bucket for a specific purpose.
That said, AWS strongly advises against granting full control to the "All Users"
group.
name: Detect New Open S3 Buckets over AWS CLI
references: []
search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli*
) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write
@@ -18,12 +22,6 @@ search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR u
requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write
requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` '
how_to_implement: ''
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a public bucket for a specific purpose.
That said, AWS strongly advises against granting full control to the "All Users"
group.
references: []
tags:
analytic_story:
- Suspicious AWS S3 Activities
@@ -54,13 +52,13 @@ tags:
- DE.CM
observable:
- name: userIdentity.userName
type: User
role:
- Attacker
type: User
- name: bucketName
type: Other
role:
- Victim
type: Other
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -68,16 +66,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- eventSource
- eventName
- requestParameters.accessControlList.x-amz-grant-read-acp
- requestParameters.accessControlList.x-amz-grant-write
- requestParameters.accessControlList.x-amz-grant-write-acp
- requestParameters.accessControlList.x-amz-grant-full-control
- requestParameters.bucketName
- userIdentity.userName
- userIdentity.principalId
- userAgent
- bucketName
- eventName
- eventSource
- userAgent
risk_score: 48
security_domain: threat
type: TTP
version: 2
detections/cloud/detect_shared_ec2_snapshot.yml
+18 -19
View File
@@ -1,23 +1,21 @@
name: Detect shared ec2 snapshot
id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4
version: 2
date: '2021-07-20'
author: Bhavin Patel, Splunk
type: TTP
datamodel: []
date: '2021-07-20'
description: The following analytic utilizes AWS CloudTrail events to identify when
an EC2 snapshot permissions are modified to be shared with a different AWS account.
This method is used by adversaries to exfiltrate the EC2 snapshot.
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4
known_false_positives: It is possible that an AWS admin has legitimately shared a
snapshot with others for a specific purpose.
name: Detect shared ec2 snapshot
references:
- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId
as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No
Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id
aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` '
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: It is possible that an AWS admin has legitimately shared a
snapshot with others for a specific purpose.
references:
- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
tags:
analytic_story:
- Suspicious Cloud Instance Activities
@@ -48,13 +46,13 @@ tags:
- DE.CM
observable:
- name: user_arn
role:
- Attacker
type: User
role:
- Attacker
- name: src_ip
type: IP Address
role:
- Attacker
type: IP Address
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -62,12 +60,13 @@ tags:
- Splunk Cloud
required_fields:
- _time
- eventName
- user_arn
- src_ip
- requestParameters.attributeType
- aws_account_id
- vendor_region
- eventName
- src_ip
- user_agent
- user_arn
- vendor_region
risk_score: 48
security_domain: threat
type: TTP
version: 2
detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
+15 -16
View File
@@ -1,12 +1,16 @@
name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
version: 3
date: '2021-01-26'
author: Bhavin Patel, Splunk
type: Anomaly
datamodel: []
date: '2021-01-26'
description: This search looks for a spike in number of of AWS security Hub alerts
for an EC2 instance in 4 hours intervals
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security
Hub inputs. The threshold_value should be tuned to your environment and schedule
these searches according to the bucket span interval.
id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
known_false_positives: None
name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
references: []
search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h
_time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account)
as vendor_account values(vendor_region) as vendor_region values(severity) as severity
@@ -14,12 +18,6 @@ search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket sp
| eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev
* threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types
vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security
Hub inputs. The threshold_value should be tuned to your environment and schedule
these searches according to the bucket span interval.
known_false_positives: None
references: []
tags:
analytic_story:
- AWS Security Hub Alerts
@@ -39,22 +37,23 @@ tags:
- DE.DP
observable:
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Resources{}.Type
- Title
- Types{}
- _time
- dest
- severity
- vendor_account
- vendor_region
- severity
- dest
risk_score: 15
security_domain: endpoint
type: Anomaly
version: 3
detections/cloud/github_dependabot_alert.yml
+11 -21
View File
@@ -1,22 +1,20 @@
name: GitHub Dependabot Alert
id: 05032b04-4469-4034-9df7-05f607d75cba
version: 1
date: '2021-09-01'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
date: '2021-09-01'
description: This search looks for Dependabot Alerts in Github logs.
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.
id: 05032b04-4469-4034-9df7-05f607d75cba
known_false_positives: unknown
name: GitHub Dependabot Alert
references:
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
search: '`github` alert.id=* action=create | rename repository.full_name as repository,
repository.html_url as repository_url sender.login as user | stats min(_time) as
firstTime max(_time) as lastTime by action alert.affected_package_name alert.affected_range
alert.created_at alert.external_identifier alert.external_reference alert.fixed_in
alert.severity repository repository_url user | eval phase="code" | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `github_dependabot_alert_filter`'
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.
known_false_positives: unknown
references:
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
tags:
analytic_story:
- Dev Sec Ops
@@ -40,9 +38,9 @@ tags:
- DE.CM
observable:
- name: repository
type: System
role:
- Victim
type: System
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -50,16 +48,8 @@ tags:
- Dev Sec Ops Analytics
required_fields:
- _time
- alert.id
- repository.full_name
- repository.html_url
- action
- alert.affected_package_name
- alert.affected_range
- alert.created_at
- alert.external_identifier
- alert.external_reference
- alert.fixed_in
- alert.severity
risk_score: 27
security_domain: network
type: Anomaly
version: 1
detections/cloud/github_pull_request_from_unknown_user.yml
+12 -24
View File
@@ -1,22 +1,20 @@
name: GitHub Pull Request from Unknown User
id: 9d7b9100-8878-4404-914e-ca5e551a641e
version: 1
date: '2021-09-01'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
date: '2021-09-01'
description: This search looks for Pull Request from unknown user.
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.
id: 9d7b9100-8878-4404-914e-ca5e551a641e
known_false_positives: unknown
name: GitHub Pull Request from Unknown User
references:
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name
repository.full_name check_suite.pull_requests{}.head.ref check_suite.head_commit.message
| rename check_suite.head_commit.author.name as user repository.full_name as repository
check_suite.pull_requests{}.head.ref as ref_head check_suite.head_commit.message
as commit_message | search NOT `github_known_users` | eval phase="code" | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter`'
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.
known_false_positives: unknown
references:
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
tags:
analytic_story:
- Dev Sec Ops
@@ -40,26 +38,16 @@ tags:
- DE.CM
observable:
- name: repository
type: System
role:
- Victim
type: System
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- _time
- alert.id
- repository.full_name
- repository.html_url
- action
- alert.affected_package_name
- alert.affected_range
- alert.created_at
- alert.external_identifier
- alert.external_reference
- alert.fixed_in
- alert.severity
required_fields: []
risk_score: 27
security_domain: network
type: Anomaly
version: 1
detections/cloud/gsuite_drive_share_in_external_email.yml
+17 -21
View File
@@ -1,13 +1,20 @@
name: Gsuite Drive Share In External Email
id: f6ee02d6-fea0-11eb-b2c2-acde48001122
version: 1
date: '2021-08-16'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel: []
date: '2021-08-16'
description: This search is to detect suspicious google drive or google docs files
shared outside or externally. This behavior might be a good hunting query to monitor
exfitration of data made by an attacker or insider to a targetted machine.
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc. In order
for the search to work for your environment, please edit the query to use your company
specific email domain instead of `internal_test_email.com`.
id: f6ee02d6-fea0-11eb-b2c2-acde48001122
known_false_positives: network admin or normal user may share files to customer and
external team.
name: Gsuite Drive Share In External Email
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?<src_domain>[^@]+)"
| rex field=email "[^@]+@(?<dest_domain>[^@]+)" | where src_domain = "internal_test_email.com"
and not dest_domain = "internal_test_email.com" | eval phase="plan" | eval severity="low"
@@ -17,15 +24,6 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner
lastTime by parameters.owner ip_address phase severity | rename parameters.owner
as user ip_address as src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `gsuite_drive_share_in_external_email_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc. In order
for the search to work for your environment, please edit the query to use your company
specific email domain instead of `internal_test_email.com`.
known_false_positives: network admin or normal user may share files to customer and
external team.
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
tags:
analytic_story:
- Dev Sec Ops
@@ -46,13 +44,13 @@ tags:
- T1567
observable:
- name: parameters.owner
type: User
role:
- Attacker
- name: email
type: User
- name: email
role:
- Victim
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -60,12 +58,10 @@ tags:
- Dev Sec Ops Analytics
required_fields:
- _time
- parameters.doc_title
- src_domain
- dest_domain
- email
- parameters.visibility
- parameters.owner
- parameters.doc_type
- src_domain
risk_score: 72
security_domain: endpoint
type: Anomaly
version: 1
detections/cloud/gsuite_email_suspicious_attachment.yml
+15 -20
View File
@@ -1,15 +1,21 @@
name: GSuite Email Suspicious Attachment
id: 6d663014-fe92-11eb-ab07-acde48001122
version: 1
date: '2021-08-16'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel: []
date: '2021-08-16'
description: This search is to detect a suspicious attachment file extension in Gsuite
email that may related to spear phishing attack. This file type is commonly used
by malware to lure user to click on it to execute malicious code to compromised
targetted machine. But this search can also catch some normal files related to this
file type that maybe send by employee or network admin.
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc.
id: 6d663014-fe92-11eb-ab07-acde48001122
known_false_positives: network admin and normal user may send this file attachment
as part of their day to day work. having a good protocol in attaching this file
type to an e-mail may reduce the risk of having a spear phishing attack.
name: GSuite Email Suspicious Attachment
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh",
"bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go")
| eval phase="plan" | eval severity="medium" | stats count min(_time) as firstTime
@@ -18,14 +24,6 @@ search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb",
by destination{}.service num_message_attachments subject destination{}.address
source.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `gsuite_email_suspicious_attachment_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc.
known_false_positives: network admin and normal user may send this file attachment
as part of their day to day work. having a good protocol in attaching this file
type to an e-mail may reduce the risk of having a spear phishing attack.
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
tags:
analytic_story:
- Dev Sec Ops
@@ -44,13 +42,13 @@ tags:
- T1566
observable:
- name: source.address
type: User
role:
- attacker
- name: destination{}.address
type: User
- name: destination{}.address
role:
- Victim
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -58,13 +56,10 @@ tags:
- Dev Sec Ops Analytics
required_fields:
- _time
- attachment{}.file_extension_type
- attachment{}.sha256
- destination{}.service
- num_message_attachments
- payload_size
- subject
- destination{}.address
- source.address
risk_score: 49
security_domain: endpoint
type: Anomaly
version: 1
detections/cloud/gsuite_suspicious_shared_file_name.yml
+17 -22
View File
@@ -1,16 +1,24 @@
name: Gsuite Suspicious Shared File Name
id: 07eed200-03f5-11ec-98fb-acde48001122
version: 1
date: '2021-08-23'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel: []
date: '2021-08-23'
description: This search is to detect a shared file in google drive with suspicious
file name that are commonly used by spear phishing campaign. This technique is very
popular to lure the user by running a malicious document or click a malicious link
within the shared file that will redirected to malicious website. This detection
can also catch some normal email communication between organization and its external
customer.
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc. In order
for the search to work for your environment, please edit the query to use your company
specific email domain instead of `internal_test_email.com`.
id: 07eed200-03f5-11ec-98fb-acde48001122
known_false_positives: normal user or normal transaction may contain the subject and
file type attachment that this detection try to search
name: Gsuite Suspicious Shared File Name
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title"
IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*",
"*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*",
@@ -22,16 +30,6 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit
parameters.target_user parameters.doc_title parameters.doc_type phase severity |
rename parameters.target_user AS user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `gsuite_suspicious_shared_file_name_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc. In order
for the search to work for your environment, please edit the query to use your company
specific email domain instead of `internal_test_email.com`.
known_false_positives: normal user or normal transaction may contain the subject and
file type attachment that this detection try to search
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
tags:
analytic_story:
- Dev Sec Ops
@@ -51,13 +49,13 @@ tags:
- T1566
observable:
- name: parameters.owner
type: User
role:
- attacker
- name: email
type: User
- name: email
role:
- Victim
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -65,12 +63,9 @@ tags:
- Dev Sec Ops Analytics
required_fields:
- _time
- parameters.doc_title
- src_domain
- dest_domain
- email
- parameters.visibility
- parameters.owner
- parameters.doc_type
risk_score: 21
security_domain: endpoint
type: Anomaly
version: 1
detections/cloud/kubernetes_scanner_image_pulling.yml
+10 -17
View File
@@ -1,22 +1,20 @@
name: Kubernetes Scanner Image Pulling
id: 4890cd6b-0112-4974-a272-c5c153aee551
version: 1
date: '2021-08-24'
author: Patrick Bareiss, Splunk
type: TTP
datamodel: []
date: '2021-08-24'
description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes
to detect Kubernetes Security Scanner.
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
id: 4890cd6b-0112-4974-a272-c5c153aee551
known_false_positives: unknown
name: Kubernetes Scanner Image Pulling
references:
- https://github.com/splunk/splunk-connect-for-kubernetes
search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling
image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
| rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host
| eval phase="operate" | eval severity="high" | stats min(_time) as firstTime max(_time)
as lastTime count by host, name, namespace, kind, reason, message, phase, severity
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter`'
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
known_false_positives: unknown
references:
- https://github.com/splunk/splunk-connect-for-kubernetes
tags:
analytic_story:
- Dev Sec Ops
@@ -47,13 +45,8 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
- Dev Sec Ops Analytics
required_fields:
- object.message
- source.host
- object.involvedObject.name
- object.involvedObject.namespace
- object.involvedObject.kind
- object.message
- object.reason
required_fields: []
risk_score: 81
security_domain: network
type: TTP
version: 1
detections/cloud/o365_add_app_role_assignment_grant_user.yml
+21 -23
View File
@@ -1,25 +1,23 @@
name: O365 Add App Role Assignment Grant User
id: b2c81cc6-6040-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
author: Rod Soto, Splunk
type: TTP
datamodel: []
date: '2021-01-26'
description: This search detects the creation of a new Federation setting by alerting
about an specific event related to its creation.
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
id: b2c81cc6-6040-11eb-ae93-0242ac130002
known_false_positives: The creation of a new Federation is not necessarily malicious,
however this events need to be followed closely, as it may indicate federated credential
abuse or backdoor via federated identities at a different cloud provider.
name: O365 Add App Role Assignment Grant User
references:
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app
role assignment grant to user." | stats count min(_time) as firstTime max(_time)
as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by
ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `o365_add_app_role_assignment_grant_user_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
known_false_positives: The creation of a new Federation is not necessarily malicious,
however this events need to be followed closely, as it may indicate federated credential
abuse or backdoor via federated identities at a different cloud provider.
references:
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
tags:
analytic_story:
- Office 365 Detections
@@ -44,30 +42,30 @@ tags:
- T1136
observable:
- name: ActorIpAddress
role:
- Attacker
type: IP Address
role:
- Attacker
- name: Actor.ID
type: User
role:
- Attacker
type: User
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Workload
- Operation
- Actor{}.ID
- Actor{}.Type
- ActorIpAddress
- dest
- Operation
- ResultStatus
- Workload
- _time
- dest
risk_score: 18
security_domain: threat
type: TTP
version: 1
detections/cloud/o365_added_service_principal.yml
+19 -24
View File
@@ -1,28 +1,26 @@
name: O365 Added Service Principal
id: 1668812a-6047-11eb-ae93-0242ac130002
version: 1
date: '2022-02-03'
author: Rod Soto, Splunk
type: TTP
datamodel: []
date: '2022-02-03'
description: This search detects the creation of a new Federation setting by alerting
about an specific event related to its creation.
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
id: 1668812a-6047-11eb-ae93-0242ac130002
known_false_positives: The creation of a new Federation is not necessarily malicious,
however these events need to be followed closely, as it may indicate federated credential
abuse or backdoor via federated identities at a different cloud provider.
name: O365 Added Service Principal
references:
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- https://www.sygnia.co/golden-saml-advisory
search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add service
principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID)
as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue)
as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress
Operation | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `o365_added_service_principal_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
known_false_positives: The creation of a new Federation is not necessarily malicious,
however these events need to be followed closely, as it may indicate federated credential
abuse or backdoor via federated identities at a different cloud provider.
references:
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- https://www.sygnia.co/golden-saml-advisory
tags:
analytic_story:
- Office 365 Detections
@@ -47,26 +45,23 @@ tags:
- T1136
observable:
- name: ActorIpAddress
type: IP Address
role:
- Attacker
type: IP Address
- name: Target.ID
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Workload
- signature
- Actor{}.ID
- ModifiedProperties{}.Name
- ModifiedProperties{}.NewValue
- Target{}.ID
- ActorIpAddress
- Workload
- _time
risk_score: 42
security_domain: threat
type: TTP
version: 1
detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
+19 -23
View File
@@ -1,13 +1,18 @@
name: O365 Bypass MFA via Trusted IP
id: c783dd98-c703-4252-9e8a-f19d9f66949e
version: 2
date: '2022-02-03'
author: Bhavin Patel, Splunk
type: TTP
datamodel: []
date: '2022-02-03'
description: This search detects newly added IP addresses/CIDR blocks to the list
of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known
to use this technique so that they can bypass the MFA system.
how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
id: c783dd98-c703-4252-9e8a-f19d9f66949e
known_false_positives: Unless it is a special case, it is uncommon to continually
update Trusted IPs to MFA configuration.
name: O365 Bypass MFA via Trusted IP
references:
- https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf
- https://attack.mitre.org/techniques/T1562/007/
search: '`o365_management_activity` Operation="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy
| rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
| rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
@@ -17,13 +22,6 @@ search: '`o365_management_activity` Operation="Set Company Information." Modifie
as ip_addresses_old by user ip_addresses_new_added Operation Workload vendor_account
status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`o365_bypass_mfa_via_trusted_ip_filter`'
how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
known_false_positives: Unless it is a special case, it is uncommon to continually
update Trusted IPs to MFA configuration.
references:
- https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf
- https://attack.mitre.org/techniques/T1562/007/
tags:
analytic_story:
- Office 365 Detections
@@ -48,13 +46,13 @@ tags:
- T1562
observable:
- name: ip_addresses_new_added
role:
- Attacker
type: IP Address
role:
- Attacker
- name: user_id
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -62,14 +60,12 @@ tags:
- Splunk Cloud
required_fields:
- _time
- signature
- ModifiedProperties{}.Name
- ModifiedProperties{}.NewValue
- ModifiedProperties{}.OldValue
- user
- vendor_account
- status
- user_id
- action
- status
- user
- user_id
- vendor_account
risk_score: 42
security_domain: threat
type: TTP
version: 2
detections/cloud/o365_disable_mfa.yml
+15 -19
View File
@@ -1,22 +1,20 @@
name: O365 Disable MFA
id: c783dd98-c703-4252-9e8a-f19d9f5c949e
version: 1
date: '2022-02-03'
author: Rod Soto, Splunk
type: TTP
datamodel: []
date: '2022-02-03'
description: This search detects when multi factor authentication has been disabled,
what entitiy performed the action and against what user
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
id: c783dd98-c703-4252-9e8a-f19d9f5c949e
known_false_positives: Unless it is a special case, it is uncommon to disable MFA
or Strong Authentication
name: O365 Disable MFA
references:
- https://attack.mitre.org/techniques/T1556/
search: '`o365_management_activity` Operation="Disable Strong Authentication." | stats
count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation
UserId ResultStatus |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
| `o365_disable_mfa_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
known_false_positives: Unless it is a special case, it is uncommon to disable MFA
or Strong Authentication
references:
- https://attack.mitre.org/techniques/T1556/
tags:
analytic_story:
- Office 365 Detections
@@ -40,26 +38,24 @@ tags:
- T1556
observable:
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
- name: user
type: User
role:
- Attacker
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Operation
- UserType
- user
- status
- signature
- dest
- ResultStatus
- UserType
- _time
risk_score: 64
security_domain: threat
type: TTP
version: 1
detections/cloud/o365_new_federated_domain_added.yml
+16 -17
View File
@@ -1,27 +1,25 @@
name: O365 New Federated Domain Added
id: e155876a-6048-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
author: Rod Soto, Splunk
type: TTP
datamodel: []
date: '2021-01-26'
description: This search detects the addition of a new Federated domain.
search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain"
| stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value)
as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId
UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `o365_new_federated_domain_added_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity.
id: e155876a-6048-11eb-ae93-0242ac130002
known_false_positives: The creation of a new Federated domain is not necessarily malicious,
however these events need to be followed closely, as it may indicate federated credential
abuse or backdoor via federated identities at a similar or different cloud provider.
name: O365 New Federated Domain Added
references:
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
- https://www.sygnia.co/golden-saml-advisory
- https://o365blog.com/post/aadbackdoor/
search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain"
| stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value)
as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId
UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `o365_new_federated_domain_added_filter`'
tags:
analytic_story:
- Office 365 Detections
@@ -47,27 +45,28 @@ tags:
- T1136
observable:
- name: OrganizationName
role:
- Victim
type: Other
role:
- Victim
- name: UserId
type: User
role:
- Victim
type: User
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Workload
- Operation
- Parameters{}.Value
- ObjectId
- Operation
- OrganizationName
- OriginatingServer
- UserId
- UserKey
- Workload
- _time
risk_score: 64
security_domain: threat
type: TTP
version: 1
detections/endpoint/7zip_commandline_to_smb_share_path.yml
+24 -23
View File
@@ -1,16 +1,21 @@
name: 7zip CommandLine To SMB Share Path
id: 01d29b48-ff6f-11eb-b81e-acde48001122
version: 1
date: '2021-08-17'
author: Teoderick Contreras, Splunk
type: Hunting
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-08-17'
description: This search is to detect a suspicious 7z process with commandline pointing
to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z
to archive a sensitive files and place it in network share tmp folder. This search
is a good hunting query that may give analyst a hint why specific user try to archive
a file pointing to SMB user which is un usual.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used.
id: 01d29b48-ff6f-11eb-b81e-acde48001122
known_false_positives: unknown
name: 7zip CommandLine To SMB Share Path
references:
- https://threadreaderapp.com/thread/1423361119926816776.html
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe"
OR Processes.process_name = "7za.exe" OR Processes.original_file_name = "7z.exe"
@@ -20,13 +25,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.parent_process_id Processes.process_id Processes.dest Processes.user
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `7zip_commandline_to_smb_share_path_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used.
known_false_positives: unknown
references:
- https://threadreaderapp.com/thread/1423361119926816776.html
tags:
analytic_story:
- Ransomware
@@ -47,26 +45,29 @@ tags:
- T1560
observable:
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: SourceImage
type: process name
role:
- Attacker
type: process name
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 25
security_domain: endpoint
type: Hunting
version: 1
detections/endpoint/account_discovery_with_net_app.yml
+27 -31
View File
@@ -1,11 +1,7 @@
name: Account Discovery With Net App
id: 339805ce-ac30-11eb-b87d-acde48001122
version: 3
date: '2021-09-16'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-09-16'
description: this search is to detect a potential account discovery series of command
used by several malware or attack to recon the target machine. This technique is
also seen in some note worthy malware like trickbot where it runs a cmd process,
@@ -13,6 +9,18 @@ description: this search is to detect a potential account discovery series of co
of command are good correlation search and indicator of attacker recon if seen in
the machines within a none technical user or department (HR, finance, ceo and etc)
network.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product..
id: 339805ce-ac30-11eb-b87d-acde48001122
known_false_positives: admin or power user may used this series of command.
name: Account Discovery With Net App
references:
- https://labs.vipre.com/trickbot-and-its-modules/
- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
- https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
values(Processes.parent_process) as parent_process values(Processes.process_id)
as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
@@ -20,16 +28,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
OR Processes.process="*view /all*") by Processes.process_name Processes.dest Processes.user
Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product..
known_false_positives: admin or power user may used this series of command.
references:
- https://labs.vipre.com/trickbot-and-its-modules/
- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
- https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/
tags:
analytic_story:
- Trickbot
@@ -50,35 +48,33 @@ tags:
- T1087
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
- name: process_name
type: Process Name
role:
- Process
type: Process Name
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 5
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 3
detections/endpoint/active_setup_registry_autostart.yml
+33 -24
View File
@@ -1,11 +1,8 @@
name: Active Setup Registry Autostart
id: f64579c0-203f-11ec-abcc-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
- Endpoint.Registry
date: '2022-01-26'
description: This analytic is to detect a suspicious modification of the active setup
registry for persistence and privilege escalation. This technique was seen in several
malware (poisonIvy), adware and APT to gain persistence to the compromised machine
@@ -13,6 +10,18 @@ description: This analytic is to detect a suspicious modification of the active
do the modification since modification of this registry is not commonly done. check
the legitimacy of the file and process involve in this rules to check if it is a
valid setup installer that creating or modifying this registry.
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
id: f64579c0-203f-11ec-abcc-acde48001122
known_false_positives: Active setup installer may add or modify this registry.
name: Active Setup Registry Autostart
references:
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E
- https://attack.mitre.org/techniques/T1547/014/
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active
Setup\\Installed Components*" by _time span=1h Registry.dest Registry.user Registry.registry_path
@@ -26,16 +35,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name
parent_process process_name process_path process proc_guid registry_path registry_value_name
registry_value_data | `active_setup_registry_autostart_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
known_false_positives: Active setup installer may add or modify this registry.
references:
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E
- https://attack.mitre.org/techniques/T1547/014/
tags:
analytic_story:
- Windows Persistence Techniques
@@ -56,25 +55,35 @@ tags:
- T1547
observable:
- name: dest
role:
- Victim
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
type: user
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_guid
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Registry.dest
- Endpoint.Registry.process_guid
- Endpoint.Registry.registry_path
- Endpoint.Registry.registry_value_data
- Endpoint.Registry.registry_value_name
- Endpoint.Registry.user
- _time
- Registry.dest
- Registry.user
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
risk_score: 64
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/add_defaultuser_and_password_in_registry.yml
+29 -18
View File
@@ -1,17 +1,23 @@
name: Add DefaultUser And Password In Registry
id: d4a3eb62-0f1e-11ec-a971-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
- Endpoint.Processes
- Endpoint.Registry
date: '2022-01-26'
description: this search is to detect a suspicious registry modification to implement
auto admin logon to a host. This technique was seen in BlackMatter ransomware to
automatically logon to the compromise host after triggering a safemode boot to
continue encrypting the whole network. This behavior is not a common practice and
really a suspicious TTP or alert need to be consider if found within then network
premise.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
id: d4a3eb62-0f1e-11ec-a971-acde48001122
known_false_positives: unknown
name: Add DefaultUser And Password In Registry
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*"
AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name=
@@ -27,13 +33,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name | `add_defaultuser_and_password_in_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
tags:
analytic_story:
- BlackMatter Ransomware
@@ -54,20 +53,32 @@ tags:
- T1552
observable:
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_guid
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Registry.dest
- Endpoint.Registry.process_guid
- Endpoint.Registry.registry_key_name
- Endpoint.Registry.registry_path
- Endpoint.Registry.registry_value_data
- Endpoint.Registry.registry_value_name
- Endpoint.Registry.user
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.dest
risk_score: 25
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: Anomaly
version: 2
detections/endpoint/add_or_set_windows_defender_exclusion.yml
+28 -30
View File
@@ -1,17 +1,25 @@
name: Add or Set Windows Defender Exclusion
id: 773b66fe-4dd9-11ec-8289-acde48001122
version: 1
date: '2021-11-25'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-11-25'
description: This analytic will identify a suspicious process command-line related
to Windows Defender exclusion feature. This command is abused by adversaries, malware
authors and red teams to bypass Windows Defender Antivirus products by excluding
folder path, file path, process and extensions. From its real time or schedule scan
to execute their malicious code. This is a good indicator for defense evasion and
to look further for events after this behavior.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
id: 773b66fe-4dd9-11ec-8289-acde48001122
known_false_positives: Admin or user may choose to use this windows features. Filter
as needed.
name: Add or Set Windows Defender Exclusion
references:
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*Add-MpPreference
*" OR Processes.process = "*Set-MpPreference *") AND Processes.process="*-exclusion*"
@@ -19,16 +27,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_name Processes.original_file_name Processes.process Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `add_or_set_windows_defender_exclusion_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Admin or user may choose to use this windows features. Filter
as needed.
references:
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
tags:
analytic_story:
- Remcos
@@ -50,31 +48,31 @@ tags:
- T1562
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 64
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 1
detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+25 -27
View File
@@ -1,14 +1,22 @@
name: Allow File And Printing Sharing In Firewall
id: ce27646e-d411-11eb-8a00-acde48001122
version: 2
date: '2021-06-23'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-06-23'
description: This search is to detect a suspicious modification of firewall to allow
file and printer sharing. This technique was seen in ransomware to be able to discover
more machine connected to the compromised host to encrypt more files
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: ce27646e-d411-11eb-8a00-acde48001122
known_false_positives: network admin may modify this firewall feature that may cause
this rule to be triggered.
name: Allow File And Printing Sharing In Firewall
references:
- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process=
"*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*"
@@ -16,16 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `allow_file_and_printing_sharing_in_firewall_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: network admin may modify this firewall feature that may cause
this rule to be triggered.
references:
- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
tags:
analytic_story:
- Ransomware
@@ -42,18 +40,18 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
+32 -22
View File
@@ -1,15 +1,22 @@
name: Allow Inbound Traffic By Firewall Rule Registry
id: 0a46537c-be02-11eb-92ca-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
- Endpoint.Registry
date: '2022-01-26'
description: This analytic detects a potential suspicious modification of firewall
rule registry allowing inbound traffic in specific port with public profile. This
technique was identified when an adversary wants to grant remote access to a machine
by allowing the traffic in a firewall rule.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
id: 0a46537c-be02-11eb-92ca-acde48001122
known_false_positives: network admin may add/remove/modify public inbound firewall
rule that may cause this rule to be triggered.
name: Allow Inbound Traffic By Firewall Rule Registry
references:
- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data =
@@ -26,14 +33,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
| `allow_inbound_traffic_by_firewall_rule_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: network admin may add/remove/modify public inbound firewall
rule that may cause this rule to be triggered.
references:
- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
tags:
analytic_story:
- Prohibited Traffic Allowed or Protocol Mismatch
@@ -54,25 +53,36 @@ tags:
- T1021
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_guid
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Registry.dest
- Endpoint.Registry.process_guid
- Endpoint.Registry.registry_key_name
- Endpoint.Registry.registry_path
- Endpoint.Registry.registry_value_data
- Endpoint.Registry.registry_value_name
- Endpoint.Registry.user
- _time
- Registry.registry_path
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.dest
- Registry.user
risk_score: 3
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
+16 -17
View File
@@ -1,26 +1,23 @@
name: Allow Inbound Traffic In Firewall Rule
id: a5d85486-b89c-11eb-8267-acde48001122
version: 1
date: '2021-05-19'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
datamodel: []
date: '2021-05-19'
description: The following analytic identifies suspicious PowerShell command to allow
inbound traffic inbound to a specific local port within the public profile. This
technique was seen in some attacker want to have a remote access to a machine by
allowing the traffic in firewall rule.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
registry to monitor this event.
id: a5d85486-b89c-11eb-8267-acde48001122
known_false_positives: administrator may allow inbound traffic in certain network
or machine.
name: Allow Inbound Traffic In Firewall Rule
references:
- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Inbound*"
Message = "*Allow*" Message = "*-LocalPort*" | stats count min(_time) as firstTime
max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
registry to monitor this event.
known_false_positives: administrator may allow inbound traffic in certain network
or machine.
references:
- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
tags:
analytic_story:
- Prohibited Traffic Allowed or Protocol Mismatch
@@ -41,13 +38,13 @@ tags:
- T1021
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: ComputerName
type: Hostname
role:
- Victim
type: Hostname
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -60,3 +57,5 @@ tags:
- User
risk_score: 3
security_domain: endpoint
type: TTP
version: 1
detections/endpoint/allow_network_discovery_in_firewall.yml
+25 -27
View File
@@ -1,15 +1,23 @@
name: Allow Network Discovery In Firewall
id: ccd6a38c-d40b-11eb-85a5-acde48001122
version: 2
date: '2021-06-23'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-06-23'
description: This search is to detect a suspicious modification to the firewall to
allow network discovery on a machine. This technique was seen in couple of ransomware
(revil, reddot) to discover other machine connected to the compromised host to encrypt
more files.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: ccd6a38c-d40b-11eb-85a5-acde48001122
known_false_positives: network admin may modify this firewall feature that may cause
this rule to be triggered.
name: Allow Network Discovery In Firewall
references:
- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process=
"*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable*"
@@ -17,16 +25,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.original_file_name Processes.process_name Processes.process Processes.process_id
Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: network admin may modify this firewall feature that may cause
this rule to be triggered.
references:
- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
tags:
analytic_story:
- Ransomware
@@ -44,18 +42,18 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/allow_operation_with_consent_admin.yml
+34 -23
View File
@@ -1,16 +1,25 @@
name: Allow Operation with Consent Admin
id: 7de17d7a-c9d8-11eb-a812-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
- Endpoint.Registry
date: '2022-01-26'
description: This analytic identifies a potential privilege escalation attempt to
perform malicious task. This registry modification is designed to allow the `Consent
Admin` to perform an operation that requires elevation without consent or credentials.
We also found this in some attacker to gain privilege escalation to the compromise
machine.
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
id: 7de17d7a-c9d8-11eb-a812-acde48001122
known_false_positives: unknown
name: Allow Operation with Consent Admin
references:
- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4
- https://www.trendmicro.com/vinfo/no/threat-encyclopedia/malware/Ransom.Win32.MRDEC.MRA/
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*"
Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data
@@ -26,16 +35,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
| `allow_operation_with_consent_admin_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
known_false_positives: unknown
references:
- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4
- https://www.trendmicro.com/vinfo/no/threat-encyclopedia/malware/Ransom.Win32.MRDEC.MRA/
tags:
analytic_story:
- Ransomware
@@ -55,24 +54,36 @@ tags:
- T1548
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_guid
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Registry.dest
- Endpoint.Registry.process_guid
- Endpoint.Registry.registry_key_name
- Endpoint.Registry.registry_path
- Endpoint.Registry.registry_value_data
- Endpoint.Registry.registry_value_name
- Endpoint.Registry.user
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.dest
risk_score: 25
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/anomalous_usage_of_7zip.yml
+28 -29
View File
@@ -1,11 +1,7 @@
name: Anomalous usage of 7zip
id: 9364ee8e-a39a-11eb-8f1d-acde48001122
version: 1
date: '2021-04-22'
author: Michael Haag, Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-04-22'
description: The following detection identifies a 7z.exe spawned from `Rundll32.exe`
or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`.
It has been observed where an adversary will rename `7z.exe`. Additional coverage
@@ -13,21 +9,23 @@ description: The following detection identifies a 7z.exe spawned from `Rundll32.
triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture
any files written to disk and analyze as needed. Review parallel processes for additional
behaviors. Typically, archiving files will result in exfiltration.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
id: 9364ee8e-a39a-11eb-8f1d-acde48001122
known_false_positives: False positives should be limited as this behavior is not normal
for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
name: Anomalous usage of 7zip
references:
- https://attack.mitre.org/techniques/T1560/001/
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("rundll32.exe", "dllhost.exe") Processes.process_name=*7z* by Processes.dest
Processes.user Processes.parent_process Processes.process_name Processes.process
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `anomalous_usage_of_7zip_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: False positives should be limited as this behavior is not normal
for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
references:
- https://attack.mitre.org/techniques/T1560/001/
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/
tags:
analytic_story:
- Cobalt Strike
@@ -50,37 +48,38 @@ tags:
- T1560
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.parent_process
- Processes.process_id
- Processes.parent_process_id
risk_score: 64
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: Anomaly
version: 1
detections/endpoint/any_powershell_downloadfile.yml
+31 -34
View File
@@ -1,34 +1,32 @@
name: Any Powershell DownloadFile
id: 1a93b7ea-7af7-11eb-adb5-acde48001122
version: 2
date: '2021-03-01'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-03-01'
description: The following analytic identifies the use of PowerShell downloading a
file using `DownloadFile` method. This particular method is utilized in many different
PowerShell frameworks to download files and output to disk. Identify the source
(IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
transaction logs are available, review for further details of the implant.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 1a93b7ea-7af7-11eb-adb5-acde48001122
known_false_positives: False positives may be present and filtering will need to occur
by parent process or command line argument. It may be required to modify this query
to an EDR product for more granular coverage.
name: Any Powershell DownloadFile
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*DownloadFile*
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`any_powershell_downloadfile_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives may be present and filtering will need to occur
by parent process or command line argument. It may be required to modify this query
to an EDR product for more granular coverage.
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
tags:
analytic_story:
- Malicious PowerShell
@@ -54,39 +52,38 @@ tags:
- T1059.001
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 56
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/any_powershell_downloadstring.yml
+24 -27
View File
@@ -1,33 +1,31 @@
name: Any Powershell DownloadString
id: 4d015ef2-7adf-11eb-95da-acde48001122
version: 2
date: '2021-03-01'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-03-01'
description: The following analytic identifies the use of PowerShell downloading a
file using `DownloadString` method. This particular method is utilized in many different
PowerShell frameworks to download files and output to disk. Identify the source
(IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
transaction logs are available, review for further details of the implant.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*.DownloadString* by
Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 4d015ef2-7adf-11eb-95da-acde48001122
known_false_positives: False positives may be present and filtering will need to occur
by parent process or command line argument. It may be required to modify this query
to an EDR product for more granular coverage.
name: Any Powershell DownloadString
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*.DownloadString* by
Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`'
tags:
analytic_story:
- Malicious PowerShell
@@ -48,39 +46,38 @@ tags:
- T1059.001
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 56
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/attacker_tools_on_endpoint.yml
+25 -24
View File
@@ -1,13 +1,20 @@
name: Attacker Tools On Endpoint
id: a51bfe1a-94f0-48cc-b4e4-16a110145893
version: 2
date: '2021-11-04'
author: Bhavin Patel, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-11-04'
description: This search looks for execution of commonly used attacker tools on an
endpoint.
how_to_implement: To successfully implement this search, you must be ingesting data
that records process activity from your hosts to populate the endpoint data model
in the processes node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is usually generated via logs that report process tracking
in your Windows audit settings.
id: a51bfe1a-94f0-48cc-b4e4-16a110145893
known_false_positives: Some administrator activity can be potentially triggered, please
add those users to the filter macro.
name: Attacker Tools On Endpoint
references: []
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime values(Processes.process) as process values(Processes.parent_process)
as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown
@@ -15,15 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS
process_name OUTPUT description | search description !=false| `attacker_tools_on_endpoint_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records process activity from your hosts to populate the endpoint data model
in the processes node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is usually generated via logs that report process tracking
in your Windows audit settings.
known_false_positives: Some administrator activity can be potentially triggered, please
add those users to the filter macro.
references: []
tags:
analytic_story:
- Monitor for Unauthorized Software
@@ -59,32 +57,35 @@ tags:
- PR.DS
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
- Attacker
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Processes.dest
- Processes.user
- Processes.process_name
- Processes.parent_process
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.process
- Endpoint.Processes.process_name
- Endpoint.Processes.user
risk_score: 64
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
+28 -29
View File
@@ -1,28 +1,26 @@
name: Attempt To Add Certificate To Untrusted Store
id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
version: 7
date: '2021-09-16'
author: Patrick Bareiss, Rico Valdez, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-09-16'
description: Attempt To Add Certificate To Untrusted Store
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
known_false_positives: There may be legitimate reasons for administrators to add a
certificate to the untrusted certificate store. In such cases, this will typically
be done on a large number of systems.
name: Attempt To Add Certificate To Untrusted Store
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
as process max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil`
(Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
| `attempt_to_add_certificate_to_untrusted_store_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: There may be legitimate reasons for administrators to add a
certificate to the untrusted certificate store. In such cases, this will typically
be done on a large number of systems.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md
tags:
analytic_story:
- Disabling Security Tools
@@ -53,36 +51,37 @@ tags:
- PR.IP
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.parent_process
- Processes.process_id
- Processes.parent_process_id
risk_score: 35
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 7
detections/endpoint/attempt_to_stop_security_service.yml
+29 -32
View File
@@ -1,13 +1,21 @@
name: Attempt To Stop Security Service
id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
version: 4
date: '2020-07-21'
author: Rico Valdez, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2020-07-21'
description: This search looks for attempts to stop security-related services on the
endpoint.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
known_false_positives: None identified. Attempts to disable security-related services
should be identified and understood.
name: Attempt To Stop Security Service
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where `process_net` OR Processes.process_name = sc.exe Processes.process="* stop
@@ -16,16 +24,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|lookup security_services_lookup service as process OUTPUTNEW category, description
| search category=security | `attempt_to_stop_security_service_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: None identified. Attempts to disable security-related services
should be identified and understood.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
tags:
analytic_story:
- Disabling Security Tools
@@ -58,39 +56,38 @@ tags:
- PR.IP
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 20
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 4
detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+27 -30
View File
@@ -1,13 +1,19 @@
name: Attempted Credential Dump From Registry via Reg exe
id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
version: 6
date: '2021-09-16'
author: Patrick Bareiss, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-09-16'
description: Monitor for execution of reg.exe with parameters specifying an export
of keys that contain hashed credentials that attackers may try to crack offline.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
known_false_positives: None identified.
name: Attempted Credential Dump From Registry via Reg exe
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd`
Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM*
@@ -16,14 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: None identified.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
tags:
analytic_story:
- Credential Dumping
@@ -52,39 +50,38 @@ tags:
- DE.CM
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 90
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 6
detections/endpoint/auto_admin_logon_registry_entry.yml
+29 -18
View File
@@ -1,17 +1,23 @@
name: Auto Admin Logon Registry Entry
id: 1379d2b8-0f18-11ec-8ca3-acde48001122
version: 2
date: '2020-01-28'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
- Endpoint.Registry
date: '2020-01-28'
description: this search is to detect a suspicious registry modification to implement
auto admin logon to a host. This technique was seen in BlackMatter ransomware to
automatically logon to the compromise host after triggering a safemode boot to
continue encrypting the whole network. This behavior is not a common practice and
really a suspicious TTP or alert need to be consider if found within then network
premise.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
id: 1379d2b8-0f18-11ec-8ca3-acde48001122
known_false_positives: unknown
name: Auto Admin Logon Registry Entry
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows
NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND
@@ -27,13 +33,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
| `auto_admin_logon_registry_entry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
tags:
analytic_story:
- BlackMatter Ransomware
@@ -54,20 +53,32 @@ tags:
- T1552
observable:
- name: dest
type: Endpoint
role:
- Victim
type: Endpoint
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_guid
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Registry.dest
- Endpoint.Registry.process_guid
- Endpoint.Registry.registry_key_name
- Endpoint.Registry.registry_path
- Endpoint.Registry.registry_value_data
- Endpoint.Registry.registry_value_name
- Endpoint.Registry.user
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.dest
risk_score: 63
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/batch_file_write_to_system32.yml
+32 -31
View File
@@ -1,13 +1,25 @@
name: Batch File Write to System32
id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
version: 2
date: '2021-09-16'
author: Michael Haag, Rico Valdez, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Filesystem
- Endpoint.Processes
date: '2021-09-16'
description: The search looks for a batch file (.bat) written to the Windows system
directory tree.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
known_false_positives: It is possible for this search to generate a notable event
for a batch file write to a path that includes the string "system32", but is not
the actual Windows system directory. As such, you should confirm the path of the
batch file identified by the search. In addition, a false positive may be generated
by an administrator copying a legitimate batch file in this directory tree. You
should confirm that the activity is legitimate and modify the search to add exclusions,
as necessary.
name: Batch File Write to System32
references: []
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=* by _time span=1h Processes.process_id Processes.process_name
Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
@@ -18,19 +30,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
| fields _time dest file_create_time file_name file_path process_name process_path
process] | dedup file_create_time | table dest file_create_time, file_name, file_path,
process_name | `batch_file_write_to_system32_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: It is possible for this search to generate a notable event
for a batch file write to a path that includes the string "system32", but is not
the actual Windows system directory. As such, you should confirm the path of the
batch file identified by the search. In addition, a false positive may be generated
by an administrator copying a legitimate batch file in this directory tree. You
should confirm that the activity is legitimate and modify the search to add exclusions,
as necessary.
references: []
tags:
analytic_story:
- SamSam Ransomware
@@ -57,31 +56,33 @@ tags:
- DE.CM
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
role:
- Victim
type: Hostname
role:
- Victim
- name: file_name
type: File Name
role:
- Victim
type: File Name
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Filesystem.dest
- Endpoint.Filesystem.file_create_time
- Endpoint.Filesystem.file_name
- Endpoint.Filesystem.file_path
- Endpoint.Processes.dest
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- _time
- Filesystem.dest
- Filesystem.file_name
- Filesystem.user
- Filesystem.file_path
- Processes.process_id
- Processes.process_name
- Processes.dest
risk_score: 63
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+21 -22
View File
@@ -1,30 +1,28 @@
name: Bcdedit Command Back To Normal Mode Boot
id: dc7a8004-0f18-11ec-8c54-acde48001122
version: 1
date: '2021-09-06'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-09-06'
description: This search is to detect a suspicious bcdedit commandline to configure
the host from safe mode back to normal boot configuration. This technique was seen
in blackMatter ransomware where it force the compromised host to boot in safe mode
to continue its encryption and bring back to normal boot using bcdedit deletevalue
command. This TTP can be a good alert for host that booted from safe mode forcefully
since it need to modify the boot configuration to bring it back to normal.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
id: dc7a8004-0f18-11ec-8c54-acde48001122
known_false_positives: unknown
name: Bcdedit Command Back To Normal Mode Boot
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*"
by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
tags:
analytic_story:
- BlackMatter Ransomware
@@ -44,26 +42,27 @@ tags:
- T1490
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.process_name
- Processes.process
- Processes.parent_process_name
- Processes.parent_process
- Processes.dest
- Processes.user
risk_score: 35
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 1
detections/endpoint/bcdedit_failure_recovery_modification.yml
+22 -22
View File
@@ -1,26 +1,24 @@
name: BCDEdit Failure Recovery Modification
id: 809b31d2-5462-11eb-ae93-0242ac130002
version: 1
date: '2020-12-21'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2020-12-21'
description: This search looks for flags passed to bcdedit.exe modifications to the
built-in Windows error recovery boot configurations. This is typically used by ransomware
to prevent recovery.
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. Tune based on parent process names.
id: 809b31d2-5462-11eb-ae93-0242ac130002
known_false_positives: Administrators may modify the boot configuration.
name: BCDEdit Failure Recovery Modification
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name
Processes.process Processes.parent_process_name Processes.dest Processes.user |
`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `bcdedit_failure_recovery_modification_filter`'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. Tune based on parent process names.
known_false_positives: Administrators may modify the boot configuration.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
tags:
analytic_story:
- Ryuk Ransomware
@@ -47,33 +45,35 @@ tags:
- PR.IP
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.process_name
- Processes.process
- Processes.parent_process_name
- Processes.dest
- Processes.user
risk_score: 80
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 1
detections/endpoint/bits_job_persistence.yml
+32 -35
View File
@@ -1,11 +1,7 @@
name: BITS Job Persistence
id: e97a5ffe-90bf-11eb-928a-acde48001122
version: 2
date: '2021-09-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-09-16'
description: The following query identifies Microsoft Background Intelligent Transfer
Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
The query identifies the parameters used to create, resume or add a file to a BITS
@@ -13,6 +9,21 @@ description: The following query identifies Microsoft Background Intelligent Tra
the BITS job created and capture any files written to disk. It is possible for BITS
to be used to upload files and this may require further network data analysis to
identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: e97a5ffe-90bf-11eb-928a-acde48001122
known_false_positives: Limited false positives will be present. Typically, applications
will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
(legitimate applications) or parent process.
name: BITS Job Persistence
references:
- https://attack.mitre.org/techniques/T1197/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process
IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*,
@@ -20,19 +31,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.parent_process Processes.process_name Processes.process Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `bits_job_persistence_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives will be present. Typically, applications
will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
(legitimate applications) or parent process.
references:
- https://attack.mitre.org/techniques/T1197/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
tags:
analytic_story:
- BITS Jobs
@@ -52,39 +50,38 @@ tags:
- T1197
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 56
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/bitsadmin_download_file.yml
+31 -34
View File
@@ -1,11 +1,7 @@
name: BITSAdmin Download File
id: 80630ff4-8e4c-11eb-aab5-acde48001122
version: 2
date: '2021-09-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-09-16'
description: The following query identifies Microsoft Background Intelligent Transfer
Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
object. In addition, look for `download` or `upload` on the command-line, the switches
@@ -18,24 +14,26 @@ description: The following query identifies Microsoft Background Intelligent Tra
and child processes to capture any behaviors and artifacts. In some suspicious and
malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
to list out the jobs during investigation.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 80630ff4-8e4c-11eb-aab5-acde48001122
known_false_positives: Limited false positives, however it may be required to filter
based on parent process name or network connection.
name: BITSAdmin Download File
references:
- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process=*transfer*
by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `bitsadmin_download_file_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives, however it may be required to filter
based on parent process name or network connection.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
tags:
analytic_story:
- Ingress Tool Transfer
@@ -58,39 +56,38 @@ tags:
- T1105
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 49
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+30 -33
View File
@@ -1,11 +1,7 @@
name: CertUtil Download With URLCache and Split Arguments
id: 415b4306-8bfb-11eb-85c4-acde48001122
version: 3
date: '2022-02-03'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2022-02-03'
description: Certutil.exe may download a file from a remote destination using `-urlcache`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
@@ -13,23 +9,25 @@ description: Certutil.exe may download a file from a remote destination using `-
However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
During triage, capture any files on disk and review. Review the reputation of the
remote IP or domain in question.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 415b4306-8bfb-11eb-85c4-acde48001122
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
name: CertUtil Download With URLCache and Split Arguments
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache*
Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user
Processes.parent_process Processes.process_name Processes.process Processes.process_id
Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
tags:
analytic_story:
- Ingress Tool Transfer
@@ -50,39 +48,38 @@ tags:
- T1105
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 90
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 3
detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+31 -34
View File
@@ -1,11 +1,7 @@
name: CertUtil Download With VerifyCtl and Split Arguments
id: 801ad9e4-8bfb-11eb-8b31-acde48001122
version: 3
date: '2022-02-03'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2022-02-03'
description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
@@ -13,24 +9,26 @@ description: 'Certutil.exe may download a file from a remote destination using `
\ During triage, capture any files on disk and review. Review the reputation of
the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 801ad9e4-8bfb-11eb-8b31-acde48001122
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
name: CertUtil Download With VerifyCtl and Split Arguments
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl*
Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user
Processes.original_file_name Processes.parent_process Processes.process_name Processes.process
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
tags:
analytic_story:
- Ingress Tool Transfer
@@ -51,39 +49,38 @@ tags:
- T1105
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 90
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 3
detections/endpoint/certutil_exe_certificate_extraction.yml
+25 -29
View File
@@ -1,26 +1,24 @@
name: Certutil exe certificate extraction
id: 337a46be-600f-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
author: Rod Soto, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-01-26'
description: This search looks for arguments to certutil.exe indicating the manipulation
or extraction of Certificate. This certificate can then be used to sign new authentication
tokens specially inside Federated environments such as Windows ADFS.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
id: 337a46be-600f-11eb-ae93-0242ac130002
known_false_positives: Unless there are specific use cases, manipulating or exporting
certificates using certutil is uncommon. Extraction of certificate has been observed
during attacks such as Golden SAML and other campaigns targeting Federated services.
name: Certutil exe certificate extraction
references: []
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `certutil_exe_certificate_extraction_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Unless there are specific use cases, manipulating or exporting
certificates using certutil is uncommon. Extraction of certificate has been observed
during attacks such as Golden SAML and other campaigns targeting Federated services.
references: []
tags:
analytic_story:
- Windows Persistence Techniques
@@ -40,39 +38,37 @@ tags:
on endpoint $dest$ by user $user$ attempting export a certificate.
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 63
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 1
detections/endpoint/certutil_with_decode_argument.yml
+23 -27
View File
@@ -1,11 +1,7 @@
name: CertUtil With Decode Argument
id: bfe94226-8c10-11eb-a4b3-acde48001122
version: 2
date: '2021-03-23'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-03-23'
description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
@@ -14,24 +10,26 @@ description: CertUtil.exe may be used to `encode` and `decode` a file, including
and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
further execution. During triage, identify the source of the file being decoded.
Review its contents or execution behavior for further analysis.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*decode*
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_with_decode_argument_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: bfe94226-8c10-11eb-a4b3-acde48001122
known_false_positives: Typically seen used to `encode` files, but it is possible to
see legitimate use of `decode`. Filter based on parent-child relationship, file
paths, endpoint or user.
name: CertUtil With Decode Argument
references:
- https://attack.mitre.org/techniques/T1140/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*decode*
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_with_decode_argument_filter`'
tags:
analytic_story:
- Deobfuscate-Decode Files or Information
@@ -51,39 +49,37 @@ tags:
- T1140
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 40
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/change_default_file_association.yml
+20 -20
View File
@@ -1,31 +1,29 @@
name: Change Default File Association
id: 462d17d8-1f71-11ec-ad07-acde48001122
version: 1
date: '2021-09-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Registry
date: '2021-09-27'
description: This analytic is developed to detect suspicious registry modification
to change the default file association of windows to malicious payload. This techninique
was seen in some APT where it modify the default process to run file association,
like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other
payload that will load malicious command to the compromised host.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user
Registry.registry_path Registry.registry_key_name Registry.registry_value_name |
`security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
| `change_default_file_association_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
id: 462d17d8-1f71-11ec-ad07-acde48001122
known_false_positives: unknown
name: Change Default File Association
references:
- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user
Registry.registry_path Registry.registry_key_name Registry.registry_value_name |
`security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
| `change_default_file_association_filter`'
tags:
analytic_story:
- Windows Persistence Techniques
@@ -46,25 +44,27 @@ tags:
- T1546
observable:
- name: dest
role:
- Victim
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
type: user
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Registry.dest
- Endpoint.Registry.registry_key_name
- Endpoint.Registry.registry_path
- Endpoint.Registry.registry_value_name
- Endpoint.Registry.user
- _time
- Registry.dest
- Registry.user
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
risk_score: 80
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 1
detections/endpoint/change_to_safe_mode_with_network_config.yml
+21 -22
View File
@@ -1,30 +1,28 @@
name: Change To Safe Mode With Network Config
id: 81f1dce0-0f18-11ec-a5d7-acde48001122
version: 1
date: '2021-09-06'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-09-06'
description: This search is to detect a suspicious bcdedit commandline to configure
the host to boot in safe mode with network config. This technique was seen in blackMatter
ransomware where it force the compromised host to boot in safe mode to continue
its encryption and bring back to normal boot using bcdedit deletevalue command.
This TTP can be a good alert for host that booted from safe mode forcefully since
it need to modify the boot configuration to bring it back to normal.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
id: 81f1dce0-0f18-11ec-a5d7-acde48001122
known_false_positives: unknown
name: Change To Safe Mode With Network Config
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*"
Processes.process="*network*" by Processes.process_name Processes.process Processes.parent_process_name
Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
tags:
analytic_story:
- BlackMatter Ransomware
@@ -43,26 +41,27 @@ tags:
- T1490
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.process_name
- Processes.process
- Processes.parent_process_name
- Processes.parent_process
- Processes.dest
- Processes.user
risk_score: 25
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 1
detections/endpoint/chcp_command_execution.yml
+32 -24
View File
@@ -1,29 +1,27 @@
name: CHCP Command Execution
id: 21d236ec-eec1-11eb-b23e-acde48001122
version: 1
date: '2021-07-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-07-27'
description: This search is to detect execution of chcp.exe application. this utility
is used to change the active code page of the console. This technique was seen in
icedid malware to know the locale region/language/country of the compromise host.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed chcp.com may be used.
id: 21d236ec-eec1-11eb-b23e-acde48001122
known_false_positives: other tools or script may used this to change code page to
UTF-* or others
name: CHCP Command Execution
references:
- https://ss64.com/nt/chcp.html
- https://twitter.com/tccontre18/status/1419941156633329665?s=20
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com
Processes.parent_process_name = cmd.exe Processes.parent_process=*/c* by Processes.process_name
Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id
Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed chcp.com may be used.
known_false_positives: other tools or script may used this to change code page to
UTF-* or others
references:
- https://ss64.com/nt/chcp.html
- https://twitter.com/tccontre18/status/1419941156633329665?s=20
tags:
analytic_story:
- IcedID
@@ -43,26 +41,36 @@ tags:
- T1059
observable:
- name: dest
role:
- Victim
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
type: user
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- process_name
- process
- parent_process_name
- parent_process
- process_id
- parent_process_id
- dest
- parent_process
- parent_process_id
- parent_process_name
- process
- process_id
- process_name
- user
risk_score: 9
security_domain: endpoint
type: TTP
version: 1
detections/endpoint/check_elevated_cmd_using_whoami.yml
+22 -22
View File
@@ -1,11 +1,7 @@
name: Check Elevated CMD using whoami
id: a9079b18-1633-11ec-859c-acde48001122
version: 1
date: '2021-09-15'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-09-15'
description: This search is to detect a suspicious whoami execution to check if the
cmd or shell instance process is with elevated privileges. This technique was seen
in FIN7 js implant where it execute this as part of its data collection to the infected
@@ -13,18 +9,20 @@ description: This search is to detect a suspicious whoami execution to check if
really a good alert for known attacker that recon on the targetted host. This command
is not so commonly executed by a normal user or even an admin to check if a process
is elevated.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
id: a9079b18-1633-11ec-859c-acde48001122
known_false_positives: unknown
name: Check Elevated CMD using whoami
references: []
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process = "*whoami*"
Processes.process = "*/group*" Processes.process = "* find *" Processes.process
= "*12288*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `check_elevated_cmd_using_whoami_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: unknown
references: []
tags:
analytic_story:
- FIN7
@@ -43,27 +41,29 @@ tags:
- T1033
observable:
- name: dest
role:
- Victim
type: Endpoint
role:
- Victim
- name: user
type: User
role:
- Victim
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_name
- Processes.process_id
- Processes.process
- Processes.dest
- Processes.user
risk_score: 56
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 1
detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
+26 -29
View File
@@ -1,27 +1,25 @@
name: Clear Unallocated Sector Using Cipher App
id: cd80a6ac-c9d9-11eb-8839-acde48001122
version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-06-10'
description: this search is to detect execution of `cipher.exe` to clear the unallocated
sectors of a specific disk. This technique was seen in some ransomware to make it
impossible to forensically recover deleted files.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
id: cd80a6ac-c9d9-11eb-8839-acde48001122
known_false_positives: administrator may execute this app to manage disk
name: Clear Unallocated Sector Using Cipher App
references:
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cipher.exe"
Processes.process = "*/w:*" by Processes.parent_process_name Processes.parent_process
Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `clear_unallocated_sector_using_cipher_app_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: administrator may execute this app to manage disk
references:
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
tags:
analytic_story:
- Ransomware
@@ -43,39 +41,38 @@ tags:
- T1070
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_guid
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 90
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 1
detections/endpoint/clop_common_exec_parameter.yml
+26 -29
View File
@@ -1,11 +1,7 @@
name: Clop Common Exec Parameter
id: 5a8a2a72-8322-11eb-9ee9-acde48001122
version: 1
date: '2021-03-17'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-03-17'
description: The following analytics are designed to identifies some CLOP ransomware
variant that using arguments to execute its main code or feature of its code. In
this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files
@@ -13,6 +9,15 @@ description: The following analytics are designed to identifies some CLOP ransom
pipe or file start encrypting files within the infected local machines. This technique
can be also identified as an anti-sandbox technique to make its code non-responsive
since it is waiting for some parameter to execute properly.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
id: 5a8a2a72-8322-11eb-9ee9-acde48001122
known_false_positives: Operators can execute third party tools using these parameters.
name: Clop Common Exec Parameter
references:
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
values(Processes.parent_process_name) as parent_process values(Processes.process_name)
count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
@@ -20,13 +25,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
= "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Operators can execute third party tools using these parameters.
references:
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
tags:
analytic_story:
- Clop Ransomware
@@ -47,39 +45,38 @@ tags:
- T1204
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 100
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 1
detections/endpoint/clop_ransomware_known_service_name.yml
+18 -24
View File
@@ -1,26 +1,23 @@
name: Clop Ransomware Known Service Name
id: 07e08a12-870c-11eb-b5f9-acde48001122
version: 1
date: '2021-03-17'
author: Teoderick Contreras
type: TTP
datamodel:
- Endpoint
datamodel: []
date: '2021-03-17'
description: This detection is to identify the common service name created by the
CLOP ransomware as part of its persistence and high privilege code execution in
the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API
in creating this service entry.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the Service name, Service File Name Service Start type, and Service Type
from your endpoints.
id: 07e08a12-870c-11eb-b5f9-acde48001122
known_false_positives: unknown
name: Clop Ransomware Known Service Name
references:
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
search: '`wineventlog_system` EventCode=7045 Service_Name IN ("SecurityCenterIBM",
"WinCheckDRVs") | stats count min(_time) as firstTime max(_time) as lastTime by
EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `clop_ransomware_known_service_name_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the Service name, Service File Name Service Start type, and Service Type
from your endpoints.
known_false_positives: unknown
references:
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
tags:
analytic_story:
- Clop Ransomware
@@ -40,32 +37,29 @@ tags:
- T1543
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- EventCode
- cmdline
- _time
- parent_process_name
- process_name
- OriginalFileName
- process_path
risk_score: 100
security_domain: endpoint
type: TTP
version: 1
detections/endpoint/cmd_carry_out_string_command_parameter.yml
+27 -28
View File
@@ -1,33 +1,31 @@
name: CMD Carry Out String Command Parameter
id: 54a6ed00-3256-11ec-b031-acde48001122
version: 3
date: '2022-01-18'
author: Teoderick Contreras, Bhavin Patel, Splunk
type: Hunting
datamodel:
- Endpoint
- Endpoint.Processes
date: '2022-01-18'
description: The following analytic identifies command-line arguments where `cmd.exe
/c` is used to execute a program. `cmd /c` is used to run commands in MS-DOS and
terminate after command or process completion. This technique is commonly seen in
adversaries and malware to execute batch command using different shell like PowerShell
or different process other than `cmd.exe`. This is a good hunting query for suspicious
command-line made by a script or relative process execute it.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 54a6ed00-3256-11ec-b031-acde48001122
known_false_positives: False positives may be high based on legitimate scripted code
in any environment. Filter as needed.
name: CMD Carry Out String Command Parameter
references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process="*
/c *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `cmd_carry_out_string_command_parameter_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives may be high based on legitimate scripted code
in any environment. Filter as needed.
references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
tags:
analytic_story:
- IcedID
@@ -53,27 +51,28 @@ tags:
- T1059
observable:
- name: dest
role:
- Victim
type: Endpoint
role:
- Victim
- name: user
type: User
role:
- Victim
type: User
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_name
- Processes.process_id
- Processes.process
- Processes.dest
- Processes.user
- Processes.process_id
- Processes.parent_process_id
risk_score: 30
security_domain: endpoint
type: Hunting
version: 3
detections/endpoint/cmd_echo_pipe___escalation.yml
+29 -32
View File
@@ -1,31 +1,29 @@
name: CMD Echo Pipe - Escalation
id: eb277ba0-b96b-11eb-b00e-acde48001122
version: 2
date: '2021-05-20'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-05-20'
description: This analytic identifies a common behavior by Cobalt Strike and other
frameworks where the adversary will escalate privileges, either via `jump` (Cobalt
Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will
look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: eb277ba0-b96b-11eb-b00e-acde48001122
known_false_positives: Unknown. It is possible filtering may be required to ensure
fidelity.
name: CMD Echo Pipe - Escalation
references:
- https://redcanary.com/threat-detection-report/threats/cobalt-strike/
- https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_cmd` OR Processes.process=*%comspec%*
(Processes.process=*echo* AND Processes.process=*pipe*) by Processes.dest Processes.user
Processes.parent_process Processes.process_name Processes.original_file_name Processes.process
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_echo_pipe___escalation_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Unknown. It is possible filtering may be required to ensure
fidelity.
references:
- https://redcanary.com/threat-detection-report/threats/cobalt-strike/
- https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c
tags:
analytic_story:
- Cobalt Strike
@@ -50,39 +48,38 @@ tags:
- T1543
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 64
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 2
detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
+30 -33
View File
@@ -1,11 +1,7 @@
name: Cmdline Tool Not Executed In CMD Shell
id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
version: 1
date: '2021-09-14'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-09-14'
description: The following analytic identifies a non-standard parent process (not
matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`.
This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also
@@ -14,6 +10,19 @@ description: The following analytic identifies a non-standard parent process (no
executed with a shell application or Explorer parent, and not by another application.
This TTP is a good indicator for an adversary gathering host information, but one
possible false positive might be an automated tool used by a system administator.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
known_false_positives: A network operator or systems administrator may utilize an
automated host discovery application that may generate false positives. Filter as
needed.
name: Cmdline Tool Not Executed In CMD Shell
references:
- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
- https://attack.mitre.org/groups/G0046/
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe"
OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name
@@ -22,17 +31,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id
Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: A network operator or systems administrator may utilize an
automated host discovery application that may generate false positives. Filter as
needed.
references:
- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
- https://attack.mitre.org/groups/G0046/
tags:
analytic_story:
- FIN7
@@ -53,39 +51,38 @@ tags:
- T1059.007
observable:
- name: dest
role:
- Victim
type: Endpoint
role:
- Victim
- name: user
type: User
role:
- Victim
type: User
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 56
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 1
detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
+17 -18
View File
@@ -1,26 +1,23 @@
name: CMLUA Or CMSTPLUA UAC Bypass
id: f87b5062-b405-11eb-a889-acde48001122
version: 1
date: '2021-05-13'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
datamodel: []
date: '2021-05-13'
description: This analytic detects a potential process using COM Object like CMLUA
or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries
to gain administrative privileges to its running process.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name and imageloaded executions from your endpoints. If you
are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
id: f87b5062-b405-11eb-a889-acde48001122
known_false_positives: Legitimate windows application that are not on the list loading
this dll. Filter as needed.
name: CMLUA Or CMSTPLUA UAC Bypass
references:
- https://attack.mitre.org/techniques/T1218/003/
search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll",
"*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*",
"*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime
by Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name and imageloaded executions from your endpoints. If you
are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: Legitimate windows application that are not on the list loading
this dll. Filter as needed.
references:
- https://attack.mitre.org/techniques/T1218/003/
tags:
analytic_story:
- DarkSide Ransomware
@@ -42,17 +39,17 @@ tags:
- T1218.003
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: Computer
type: Hostname
role:
- Victim
type: Hostname
- name: ImageLoaded
type: Other
role:
- Other
type: Other
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -68,3 +65,5 @@ tags:
- ProcessId
risk_score: 80
security_domain: endpoint
type: TTP
version: 1
detections/endpoint/common_ransomware_extensions.yml
+20 -20
View File
@@ -1,18 +1,9 @@
name: Common Ransomware Extensions
id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
version: 4
date: '2020-11-09'
author: David Dorsey, Splunk
type: Hunting
datamodel:
- Endpoint
- Endpoint.Filesystem
date: '2020-11-09'
description: The search looks for file modifications with extensions commonly used
by Ransomware
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex
field=file_name "(?<file_extension>\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`'
how_to_implement: 'You must be ingesting data that records the filesystem activity
from your hosts to populate the Endpoint file-system data model node. If you are
using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
@@ -31,10 +22,17 @@ how_to_implement: 'You must be ingesting data that records the filesystem activi
Detailed documentation on how to create a new field within Incident Review may be
found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
known_false_positives: It is possible for a legitimate file with these extensions
to be created. If this is a true ransomware attack, there will be a large number
of files created with these extensions.
name: Common Ransomware Extensions
references: []
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex
field=file_name "(?<file_extension>\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`'
tags:
Consequence: Data Destruction
analytic_story:
@@ -65,26 +63,28 @@ tags:
- DE.CM
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
role:
- Victim
type: Hostname
role:
- Victim
- name: file_name
type: File Name
role:
- Victim
type: File Name
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Filesystem.dest
- Endpoint.Filesystem.file_name
- Endpoint.Filesystem.file_path
- Endpoint.Filesystem.user
- _time
- Filesystem.user
- Filesystem.dest
- Filesystem.file_path
- Filesystem.file_name
risk_score: 90
security_domain: endpoint
type: Hunting
version: 4
detections/endpoint/common_ransomware_notes.yml
+20 -20
View File
@@ -1,26 +1,24 @@
name: Common Ransomware Notes
id: ada0f478-84a8-4641-a3f1-d82362d6bd71
version: 4
date: '2020-11-09'
author: David Dorsey, Splunk
type: Hunting
datamodel:
- Endpoint
- Endpoint.Filesystem
date: '2020-11-09'
description: The search looks for files created with names matching those typically
used in ransomware notes that tell the victim how to get their data back.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes`
| `common_ransomware_notes_filter`'
how_to_implement: You must be ingesting data that records file-system activity from
your hosts to populate the Endpoint Filesystem data-model node. This is typically
populated via endpoint detection-and-response product, such as Carbon Black, or
via other endpoint data sources, such as Sysmon. The data used for this search is
typically generated via logs that report file-system reads and writes.
id: ada0f478-84a8-4641-a3f1-d82362d6bd71
known_false_positives: It's possible that a legitimate file could be created with
the same name used by ransomware note files.
name: Common Ransomware Notes
references: []
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes`
| `common_ransomware_notes_filter`'
tags:
Consequence: Data Destruction
analytic_story:
@@ -50,26 +48,28 @@ tags:
- DE.CM
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
role:
- Victim
type: Hostname
role:
- Victim
- name: file_name
type: File Name
role:
- Victim
type: File Name
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Filesystem.dest
- Endpoint.Filesystem.file_name
- Endpoint.Filesystem.file_path
- Endpoint.Filesystem.user
- _time
- Filesystem.user
- Filesystem.dest
- Filesystem.file_path
- Filesystem.file_name
risk_score: 90
security_domain: endpoint
type: Hunting
version: 4
detections/endpoint/conti_common_exec_parameter.yml
+27 -30
View File
@@ -1,14 +1,20 @@
name: Conti Common Exec parameter
id: 624919bc-c382-11eb-adcc-acde48001122
version: 1
date: '2021-06-02'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-06-02'
description: This search detects the suspicious commandline argument of revil ransomware
to encrypt specific or all local drive and network shares of the compromised machine
or host.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
id: 624919bc-c382-11eb-adcc-acde48001122
known_false_positives: 3rd party tool may have commandline parameter that can trigger
this detection.
name: Conti Common Exec parameter
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-m local*"
OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process
@@ -16,14 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `conti_common_exec_parameter_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: 3rd party tool may have commandline parameter that can trigger
this detection.
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti
tags:
analytic_story:
- Ransomware
@@ -44,39 +42,38 @@ tags:
- T1204
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_guid
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 64
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 1
detections/endpoint/control_loading_from_world_writable_directory.yml
+33 -36
View File
@@ -1,15 +1,27 @@
name: Control Loading from World Writable Directory
id: 10423ac4-10c9-11ec-8dc4-acde48001122
version: 1
date: '2021-09-08'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-09-08'
description: The following detection identifies control.exe loading either a .cpl
or .inf from a writable directory. This is related to CVE-2021-40444. During triage,
review parallel processes, parent and child, for further suspicious behaviors. In
addition, capture file modifications and analyze.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 10423ac4-10c9-11ec-8dc4-acde48001122
known_false_positives: Limited false positives will be present as control.exe does
not natively load from writable paths as defined. One may add .cpl or .inf to the
command-line if there is any false positives. Tune as needed.
name: Control Loading from World Writable Directory
references:
- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
- https://attack.mitre.org/techniques/T1218/011/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=control.exe
OR Processes.original_file_name=CONTROL.EXE) AND Processes.process IN ("*\\appdata\\*",
@@ -17,20 +29,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `control_loading_from_world_writable_directory_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives will be present as control.exe does
not natively load from writable paths as defined. One may add .cpl or .inf to the
command-line if there is any false positives. Tune as needed.
references:
- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
- https://attack.mitre.org/techniques/T1218/011/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
tags:
analytic_story:
- Microsoft MSHTML Remote Code Execution CVE-2021-40444
@@ -53,38 +51,37 @@ tags:
- T1218.002
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
- Endpoint.Processes.dest
- Endpoint.Processes.original_file_name
- Endpoint.Processes.parent_process_id
- Endpoint.Processes.parent_process_name
- Endpoint.Processes.process
- Endpoint.Processes.process_id
- Endpoint.Processes.process_name
- Endpoint.Processes.user
risk_score: 80
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 1
detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+23 -29
View File
@@ -1,13 +1,18 @@
name: Create local admin accounts using net exe
id: b89919ed-fe5f-492c-b139-151bb162040e
version: 6
date: '2021-09-08'
author: Bhavin Patel, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint.Processes
date: '2021-09-08'
description: This search looks for the creation of local administrator accounts using
net.exe .
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
id: b89919ed-fe5f-492c-b139-151bb162040e
known_false_positives: Administrators often leverage net.exe to create admin accounts.
name: Create local admin accounts using net exe
references: []
search: '| tstats `security_content_summariesonly` count values(Processes.user) as
user values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
@@ -16,13 +21,6 @@ search: '| tstats `security_content_summariesonly` count values(Processes.user)
Processes.process=*administrador* OR Processes.process=*amministratori* OR Processes.process=*administratorer*)
by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: Administrators often leverage net.exe to create admin accounts.
references: []
tags:
analytic_story:
- DHS Report TA18-074A
@@ -52,39 +50,35 @@ tags:
- DE.CM
observable:
- name: user
role:
- Victim
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
type: Hostname
- name: parent_process_name
type: Parent Process
role:
- Parent Process
type: Parent Process
- name: process_name
type: Process
role:
- Child Process
type: Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Endpoint.Processes.dest
- Endpoint.Processes.parent_process
- Endpoint.Processes.process
- Endpoint.Processes.process_name
- Endpoint.Processes.user
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 30
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
type: TTP
version: 6

Some files were not shown because too many files have changed in this diff Show More