admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'AD_Discovery_TR-789_5' of https://github.com/splunk/security_content into AD_Discovery_TR-789_5

Browse Source
This commit is contained in:
Detection Testing Service
2021-09-14 18:02:07 +00:00
parent c514bf1361 5cf90f60b2
commit 84f5346fdf
2 changed files with 54 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/get_wmiobject_group_discovery.yml
+26 -17
View File
@@ -6,24 +6,32 @@ author: Michael Haag, Splunk
type: Hunting
datamodel:
- Endpoint
description: 'The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` being used with PowerShell to identify local groups on the endpoint. \
Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \
During triage, review parallel processes and identify any further suspicious behavior.'
description: The following hunting analytic identifies the use of `Get-WMIObject Win32_Group`
being used with PowerShell to identify local groups on the endpoint. \ Typically,
by itself, is not malicious but may raise suspicion based on time of day, endpoint
and username. \ During triage, review parallel processes and identify any further
suspicious behavior.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe OR processes.process_name=cmd.exe)
(Processes.process="*Get-WMIObject*" AND Processes.process="*Win32_Group*") by Processes.dest
Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `get_wmiobject_group_discovery_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe
OR processes.process_name=cmd.exe) (Processes.process="*Get-WMIObject*" AND Processes.process="*Win32_Group*")
by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |
`get_wmiobject_group_discovery_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives may be present. Tune as needed.
references:
- https://attack.mitre.org/techniques/T1069/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
- https://attack.mitre.org/techniques/T1069/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
tags:
analytic_story:
- Active Directory Discovery
dataset: []
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
@@ -36,11 +44,11 @@ tags:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
@@ -62,4 +70,5 @@ tags:
- name: user
type: User
role:
- Victim
- Victim
automated_detection_testing: passed
detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
+28 -15
View File
@@ -5,27 +5,39 @@ date: '2021-09-14'
author: Michael Haag, Splunk
type: Hunting
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable on critical endpoints or all.
\
This analytic identifies the usage of `Get-WMIObject Win32_Group`, which is typically used as a way to identify groups on the endpoint. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \
This analytic identifies the usage of `Get-WMIObject Win32_Group`, which is typically
used as a way to identify groups on the endpoint. Typically, by itself, is not
malicious but may raise suspicion based on time of day, endpoint and username. \
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message = "*Get-WMIObject*" AND Message = "*Win32_Group*" | stats count min(_time)
as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `get_wmiobject_group_discovery_with_script_block_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message = "*Get-WMIObject*" AND Message = "*Win32_Group*"
| stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode
ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `get_wmiobject_group_discovery_with_script_block_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: False positives may be present. Tune as needed.
references:
- https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Active Directory Discovery
dataset: []
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell.log
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
@@ -57,4 +69,5 @@ tags:
- name: user
type: User
role:
- Victim
- Victim
automated_detection_testing: passed