From a79a2455f9b27c5c166c439322b6a0ebf363da91 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 31 May 2023 13:38:50 -0600 Subject: [PATCH 1/2] The Order of The Haag --- ...ercut_ng_suspicious_behavior_debug_log.yml | 0 .../windows_remote_create_service.yml | 1 - ...__windows_lateral_tool_transfer_remcom.yml | 76 ++++++++++ ..._windows_powershell_export_certificate.yml | 64 +++++++++ ...ndows_powershell_export_pfxcertificate.yml | 64 +++++++++ .../ssa___windows_remote_create_service.yml | 69 +++++++++ ...sa___windows_service_create_with_tscon.yml | 70 +++++++++ ...__windows_lateral_tool_transfer_remcom.yml | 118 +++++++++++++++ ..._windows_powershell_export_certificate.yml | 99 +++++++++++++ ...ndows_powershell_export_pfxcertificate.yml | 99 +++++++++++++ .../ssa___windows_remote_create_service.yml | 120 ++++++++++++++++ ...sa___windows_service_create_with_tscon.yml | 134 ++++++++++++++++++ ...__windows_lateral_tool_transfer_remcom.yml | 110 ++++++++++++++ ..._windows_powershell_export_certificate.yml | 83 +++++++++++ ...ndows_powershell_export_pfxcertificate.yml | 83 +++++++++++ .../ssa___windows_remote_create_service.yml | 112 +++++++++++++++ ...sa___windows_service_create_with_tscon.yml | 126 ++++++++++++++++ 17 files changed, 1427 insertions(+), 1 deletion(-) rename detections/{experimental/application => endpoint}/papercut_ng_suspicious_behavior_debug_log.yml (100%) create mode 100644 dev_ssa/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml create mode 100644 dev_ssa/endpoint/ssa___windows_powershell_export_certificate.yml create mode 100644 dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml create mode 100644 dev_ssa/endpoint/ssa___windows_remote_create_service.yml create mode 100644 dev_ssa/endpoint/ssa___windows_service_create_with_tscon.yml create mode 100644 dist/ssa/srs/ssa___windows_lateral_tool_transfer_remcom.yml create mode 100644 dist/ssa/srs/ssa___windows_powershell_export_certificate.yml create mode 100644 dist/ssa/srs/ssa___windows_powershell_export_pfxcertificate.yml create mode 100644 dist/ssa/srs/ssa___windows_remote_create_service.yml create mode 100644 dist/ssa/srs/ssa___windows_service_create_with_tscon.yml create mode 100644 ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml create mode 100644 ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml create mode 100644 ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml create mode 100644 ssa_detections/endpoint/ssa___windows_remote_create_service.yml create mode 100644 ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml diff --git a/detections/experimental/application/papercut_ng_suspicious_behavior_debug_log.yml b/detections/endpoint/papercut_ng_suspicious_behavior_debug_log.yml similarity index 100% rename from detections/experimental/application/papercut_ng_suspicious_behavior_debug_log.yml rename to detections/endpoint/papercut_ng_suspicious_behavior_debug_log.yml diff --git a/detections/endpoint/windows_remote_create_service.yml b/detections/endpoint/windows_remote_create_service.yml index d87957fa51..895dc5888d 100644 --- a/detections/endpoint/windows_remote_create_service.yml +++ b/detections/endpoint/windows_remote_create_service.yml @@ -5,7 +5,6 @@ date: '2023-03-20' author: Michael Haag, Splunk status: production type: Anomaly -status: production data_source: - Sysmon Event ID 1 description: This analytic identifies an endpoint that remotely connects to another endpoint to create a new service using sc.exe. On the remote endpoint, the new service will be created and this action will trigger the creation of EventCode 7045 along with all the resulting service information. diff --git a/dev_ssa/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml b/dev_ssa/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml new file mode 100644 index 0000000000..61a49152b5 --- /dev/null +++ b/dev_ssa/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml @@ -0,0 +1,76 @@ +name: Windows Lateral Tool Transfer RemCom +id: 25c6b8ba-2a61-41ad-b80c-8e97cf501920 +version: 1 +date: '2022-02-23' +author: Michael Haag, Splunk +status: production +type: TTP +description: This analytic identifies the use of RemCom.exe - The open source psexec. This utility provides the ability to move laterally and run scripts or commands remotely. +data_source: +- Windows Security 4688 +search: + selection1: + process.cmd_line|contains: + - '/user:' + - '/pwd:' + - '\\' + process.file.name: remcom.exe + condition: (selection1) +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible legitimate applications may perform this behavior + and will need to be filtered. +references: + - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ + - https://github.com/kavika13/RemCom +tags: + analytic_story: + - Active Directory Lateral Movement + - Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to move laterally. + mitre_attack_id: + - T1570 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + kill_chain_phases: + - Exploitation + risk_score: 40 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/4688_remcom_windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true \ No newline at end of file diff --git a/dev_ssa/endpoint/ssa___windows_powershell_export_certificate.yml b/dev_ssa/endpoint/ssa___windows_powershell_export_certificate.yml new file mode 100644 index 0000000000..30405c8851 --- /dev/null +++ b/dev_ssa/endpoint/ssa___windows_powershell_export_certificate.yml @@ -0,0 +1,64 @@ +name: Windows PowerShell Export Certificate +id: 0bf87e10-4d7d-4c63-9721-c7b3f6e6e944 +version: 1 +date: '2023-05-01' +author: Michael Haag, Splunk +status: production +type: Anomaly +description: The following analytic identifies the PowerShell Cmdlet export-certificate + utilizing Script Block Logging. This particular behavior is related to an adversary + attempting to steal certificates local to the Windows endpoint within the Certificate + Store. +data_source: +- Powershell 4104 +search: + selection1: + process.cmd_line|re: 'export-certificate' + condition: (selection1) +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: It is possible administrators or scripts may run these commands, + filtering may be required. +references: +- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj +- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps +tags: + analytic_story: + - Windows Certificate Services + asset_type: Endpoint + confidence: 60 + impact: 60 + message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$, + attempting to export a certificate. + mitre_attack_id: + - T1552.004 + - T1552 + - T1649 + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - process + kill_chain_phases: + - Exploitation + risk_score: 36 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml b/dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml new file mode 100644 index 0000000000..8accf6391a --- /dev/null +++ b/dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml @@ -0,0 +1,64 @@ +name: Windows PowerShell Export PFXCertificate +id: 0c93bb7a-df21-477e-a623-b0c37c1c6661 +version: 1 +date: '2023-05-18' +author: Michael Haag, Splunk +status: production +type: anomaly +description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate + utilizing Script Block Logging. This particular behavior is related to an adversary + attempting to steal certificates local to the Windows endpoint within the Certificate + Store. +data_source: +- Powershell 4104 +search: + selection1: + process.cmd_line|re: 'export-pfxcertificate' + condition: (selection1) +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: It is possible administrators or scripts may run these commands, + filtering may be required. +references: +- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj +- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps +tags: + analytic_story: + - Windows Certificate Services + asset_type: Endpoint + confidence: 60 + impact: 60 + message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$, + attempting to export a pfxcertificate. + mitre_attack_id: + - T1552.004 + - T1552 + - T1649 + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - process + kill_chain_phases: + - Exploitation + risk_score: 36 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfx-windows-powershell.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_remote_create_service.yml b/dev_ssa/endpoint/ssa___windows_remote_create_service.yml new file mode 100644 index 0000000000..37f5a0673f --- /dev/null +++ b/dev_ssa/endpoint/ssa___windows_remote_create_service.yml @@ -0,0 +1,69 @@ +name: Windows Remote Create Service +id: 0259ff91-a6f3-4af1-af83-6360eff7fd80 +version: 1 +date: '2023-05-18' +author: Michael Haag, Splunk +status: production +type: TTP +description: 'This analytic identifies an endpoint that remotely connects to another endpoint to create a new service using sc.exe. On the remote endpoint, the new service will be created and this action will trigger the creation of EventCode 7045 along with all the resulting service information.' +data_source: +- Windows Security 4688 +search: + selection1: + process.cmd_line|re: + - 'create' + - '\\\\' + process.file.name: sc.exe + condition: (selection1) +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: Note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities. +references: + - https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - Active Directory Lateral Movement + asset_type: Endpoint + confidence: 50 + impact: 50 + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a remote service. + mitre_attack_id: + - T1543 + - T1543.003 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + kill_chain_phases: + - Exploitation + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/4688-remote-service-create-windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_service_create_with_tscon.yml b/dev_ssa/endpoint/ssa___windows_service_create_with_tscon.yml new file mode 100644 index 0000000000..0fb5a8093e --- /dev/null +++ b/dev_ssa/endpoint/ssa___windows_service_create_with_tscon.yml @@ -0,0 +1,70 @@ +name: Windows Service Create with TSCon +id: 6d16f079-0195-4fdc-a97d-7cfacb6b9b4d +version: 1 +date: '2022-02-23' +author: Michael Haag, Splunk +status: production +type: TTP +description: 'The following analytic detects potential RDP Hijacking attempts by monitoring a series of actions taken by an attacker to gain unauthorized access to a remote system. The attacker first runs the quser command to query the remote host for disconnected user sessions. Upon identifying a disconnected session, they use the sc.exe command to create a new Windows service with a binary path that launches tscon.exe. By specifying the disconnected session ID and a destination ID, the attacker can transfer the disconnected session to a new RDP session, effectively hijacking the user''s session. This analytic allows security teams to detect and respond to RDP Hijacking attempts, mitigating potential risks and impacts on targeted systems.' +data_source: +- Windows Security 4688 +search: + selection1: + process.cmd_line|re: + - '/dest:rdp-tcp' + process.file.name: sc.exe + condition: (selection1) +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may arise in the RDP Hijacking analytic when legitimate administrators access remote sessions for maintenance or troubleshooting purposes. These activities might resemble an attacker''s attempt to hijack a disconnected session, leading to false alarms. To mitigate the risk of false positives and improve the overall security posture, organizations can implement Group Policy to automatically disconnect RDP sessions when they are complete. By enforcing this policy, administrators ensure that disconnected sessions are promptly terminated, reducing the window of opportunity for an attacker to hijack a session. Additionally, organizations can also implement access control mechanisms and monitor the behavior of privileged accounts to further enhance security and reduce the chances of false positives in RDP Hijacking detection. +references: + - https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md +tags: + analytic_story: + - Active Directory Lateral Movement + asset_type: Endpoint + confidence: 50 + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to hijack a RDP session. + mitre_attack_id: + - T1563.002 + - T1563 + - T1543.003 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + kill_chain_phases: + - Exploitation + risk_score: 40 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/4688_tscon_windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/dist/ssa/srs/ssa___windows_lateral_tool_transfer_remcom.yml b/dist/ssa/srs/ssa___windows_lateral_tool_transfer_remcom.yml new file mode 100644 index 0000000000..c81d311e35 --- /dev/null +++ b/dist/ssa/srs/ssa___windows_lateral_tool_transfer_remcom.yml @@ -0,0 +1,118 @@ +name: Windows Lateral Tool Transfer RemCom +id: 25c6b8ba-2a61-41ad-b80c-8e97cf501920 +version: 1 +description: This analytic identifies the use of RemCom.exe - The open source psexec. + This utility provides the ability to move laterally and run scripts or commands + remotely. +search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", + null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", + null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval + process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), + "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", + null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) + | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%/user:%") OR like(process_cmd_line, "%/pwd:%") + OR like(process_cmd_line, "%\\%")) AND process_file_name="remcom.exe" + | eval body=create_map( + "devices", [ + create_map( + "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) + ) + ], + "time", timestamp, + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Lateral Tool Transfer RemCom has been triggered on ", device_hostname, " by ", actor_user_name, "."), + "users", [ + create_map( + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) + ) + ], + "activity_id", 1, + "category_uid", 2, + "class_uid", 102001, + "risk_level_id", 2, + "risk_score", 40, + "severity_id", 0, + "rule", create_map("name", "Windows Lateral Tool Transfer RemCom", "uid", "25c6b8ba-2a61-41ad-b80c-8e97cf501920", "type", "Streaming"), + "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + "type_uid", 10200101, + "start_time", timestamp, + "end_time", timestamp + ) + | into write_ba_finding_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible legitimate applications may perform this behavior + and will need to be filtered. +references: +- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ +- https://github.com/kavika13/RemCom +tags: + required_fields: + - process.pid + - process.file.path + - process.file.name + - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname + risk_score: 40 + security_domain: endpoint + risk_severity: low + research_site_url: https://research.splunk.com/endpoint/25c6b8ba-2a61-41ad-b80c-8e97cf501920/ + event_schema: ocsf + mappings: + - ocsf: process.pid + cim: process_id + - ocsf: process.file.path + cim: process_path + - ocsf: process.file.name + cim: process_name + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.name + cim: user + - ocsf: actor.process.pid + cim: parent_process_id + - ocsf: actor.process.file.path + cim: parent_process_path + - ocsf: actor.process.file.name + cim: parent_process_name + - ocsf: device.hostname + cim: dest + annotations: + analytic_story: + - Active Directory Lateral Movement + - Living Off The Land + cis20: + - CIS 10 + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1570 + nist: + - DE.CM +test: + name: Windows Lateral Tool Transfer RemCom Unit Test + tests: + - name: Windows Lateral Tool Transfer RemCom + attack_data: + - file_name: 4688_remcom_windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/4688_remcom_windows-security.log + source: XmlWinEventLog +runtime: SPL-DSP diff --git a/dist/ssa/srs/ssa___windows_powershell_export_certificate.yml b/dist/ssa/srs/ssa___windows_powershell_export_certificate.yml new file mode 100644 index 0000000000..acc1eb6eb0 --- /dev/null +++ b/dist/ssa/srs/ssa___windows_powershell_export_certificate.yml @@ -0,0 +1,99 @@ +name: Windows PowerShell Export Certificate +id: 0bf87e10-4d7d-4c63-9721-c7b3f6e6e944 +version: 1 +description: The following analytic identifies the PowerShell Cmdlet export-certificate + utilizing Script Block Logging. This particular behavior is related to an adversary + attempting to steal certificates local to the Windows endpoint within the Certificate + Store. +search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", + null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", + null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval + device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), + "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", + null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) + | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), + "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", + null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | + eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, + /(?i)export-certificate/)=true + | eval body=create_map( + "devices", [ + create_map( + "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) + ) + ], + "time", timestamp, + "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), + "message", concat("Windows PowerShell Export Certificate has been triggered on ", device_hostname, " by ", "Unknown", "."), + "users", [ + create_map( + "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) + ) + ], + "activity_id", 1, + "category_uid", 2, + "class_uid", 102001, + "risk_level_id", 1, + "risk_score", 36, + "severity_id", 0, + "rule", create_map("name", "Windows PowerShell Export Certificate", "uid", "0bf87e10-4d7d-4c63-9721-c7b3f6e6e944", "type", "Streaming"), + "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + "type_uid", 10200101, + "start_time", timestamp, + "end_time", timestamp + ) + | into write_ba_finding_events();' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: It is possible administrators or scripts may run these commands, + filtering may be required. +references: +- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj +- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps +tags: + required_fields: + - device.hostname + - process.file.path + - process.uid + - process.cmd_line + - actor.user.uid + risk_score: 36 + security_domain: endpoint + risk_severity: low + research_site_url: https://research.splunk.com/endpoint/0bf87e10-4d7d-4c63-9721-c7b3f6e6e944/ + event_schema: ocsf + mappings: + - ocsf: device.hostname + cim: dest + - ocsf: process.file.path + cim: process_path + - ocsf: process.uid + cim: process_id + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.uid + cim: user_id + annotations: + analytic_story: + - Windows Certificate Services + cis20: + - CIS 10 + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1552.004 + - T1552 + - T1649 + nist: + - DE.AE +test: + name: Windows PowerShell Export Certificate Unit Test + tests: + - name: Windows PowerShell Export Certificate + attack_data: + - file_name: 4104_export_certificate.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log + source: XmlWinEventLog +runtime: SPL-DSP diff --git a/dist/ssa/srs/ssa___windows_powershell_export_pfxcertificate.yml b/dist/ssa/srs/ssa___windows_powershell_export_pfxcertificate.yml new file mode 100644 index 0000000000..e30eec6058 --- /dev/null +++ b/dist/ssa/srs/ssa___windows_powershell_export_pfxcertificate.yml @@ -0,0 +1,99 @@ +name: Windows PowerShell Export PFXCertificate +id: 0c93bb7a-df21-477e-a623-b0c37c1c6661 +version: 1 +description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate + utilizing Script Block Logging. This particular behavior is related to an adversary + attempting to steal certificates local to the Windows endpoint within the Certificate + Store. +search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", + null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", + null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval + device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), + "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", + null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) + | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), + "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", + null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | + eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, + /(?i)export-pfxcertificate/)=true + | eval body=create_map( + "devices", [ + create_map( + "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) + ) + ], + "time", timestamp, + "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), + "message", concat("Windows PowerShell Export PFXCertificate has been triggered on ", device_hostname, " by ", "Unknown", "."), + "users", [ + create_map( + "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) + ) + ], + "activity_id", 1, + "category_uid", 2, + "class_uid", 102001, + "risk_level_id", 1, + "risk_score", 36, + "severity_id", 0, + "rule", create_map("name", "Windows PowerShell Export PFXCertificate", "uid", "0c93bb7a-df21-477e-a623-b0c37c1c6661", "type", "Streaming"), + "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + "type_uid", 10200101, + "start_time", timestamp, + "end_time", timestamp + ) + | into write_ba_finding_events();' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: It is possible administrators or scripts may run these commands, + filtering may be required. +references: +- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj +- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps +tags: + required_fields: + - device.hostname + - process.file.path + - process.uid + - process.cmd_line + - actor.user.uid + risk_score: 36 + security_domain: endpoint + risk_severity: low + research_site_url: https://research.splunk.com/endpoint/0c93bb7a-df21-477e-a623-b0c37c1c6661/ + event_schema: ocsf + mappings: + - ocsf: device.hostname + cim: dest + - ocsf: process.file.path + cim: process_path + - ocsf: process.uid + cim: process_id + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.uid + cim: user_id + annotations: + analytic_story: + - Windows Certificate Services + cis20: + - CIS 10 + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1552.004 + - T1552 + - T1649 + nist: + - DE.AE +test: + name: Windows PowerShell Export PFXCertificate Unit Test + tests: + - name: Windows PowerShell Export PFXCertificate + attack_data: + - file_name: 4104_export_pfx-windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfx-windows-powershell.log + source: XmlWinEventLog +runtime: SPL-DSP diff --git a/dist/ssa/srs/ssa___windows_remote_create_service.yml b/dist/ssa/srs/ssa___windows_remote_create_service.yml new file mode 100644 index 0000000000..f2570735fc --- /dev/null +++ b/dist/ssa/srs/ssa___windows_remote_create_service.yml @@ -0,0 +1,120 @@ +name: Windows Remote Create Service +id: 0259ff91-a6f3-4af1-af83-6360eff7fd80 +version: 1 +description: This analytic identifies an endpoint that remotely connects to another + endpoint to create a new service using sc.exe. On the remote endpoint, the new service + will be created and this action will trigger the creation of EventCode 7045 along + with all the resulting service information. +search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", + null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", + null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval + process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), + "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", + null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) + | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (match_regex(process_cmd_line, /(?i)create/)=true OR match_regex(process_cmd_line, + /(?i)\\\\/)=true) AND process_file_name="sc.exe" + | eval body=create_map( + "devices", [ + create_map( + "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) + ) + ], + "time", timestamp, + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Remote Create Service has been triggered on ", device_hostname, " by ", actor_user_name, "."), + "users", [ + create_map( + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) + ) + ], + "activity_id", 1, + "category_uid", 2, + "class_uid", 102001, + "risk_level_id", 1, + "risk_score", 25, + "severity_id", 0, + "rule", create_map("name", "Windows Remote Create Service", "uid", "0259ff91-a6f3-4af1-af83-6360eff7fd80", "type", "Streaming"), + "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + "type_uid", 10200101, + "start_time", timestamp, + "end_time", timestamp + ) + | into write_ba_finding_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Note that false positives may occur, and filtering may be necessary, + especially when it comes to remote service creation by administrators or software + management utilities. +references: +- https://attack.mitre.org/techniques/T1543/003/ +tags: + required_fields: + - process.pid + - process.file.path + - process.file.name + - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname + risk_score: 25 + security_domain: endpoint + risk_severity: low + research_site_url: https://research.splunk.com/endpoint/0259ff91-a6f3-4af1-af83-6360eff7fd80/ + event_schema: ocsf + mappings: + - ocsf: process.pid + cim: process_id + - ocsf: process.file.path + cim: process_path + - ocsf: process.file.name + cim: process_name + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.name + cim: user + - ocsf: actor.process.pid + cim: parent_process_id + - ocsf: actor.process.file.path + cim: parent_process_path + - ocsf: actor.process.file.name + cim: parent_process_name + - ocsf: device.hostname + cim: dest + annotations: + analytic_story: + - Active Directory Lateral Movement + cis20: + - CIS 10 + kill_chain_phases: + - Installation + - Exploitation + mitre_attack_id: + - T1543 + - T1543.003 + nist: + - DE.CM +test: + name: Windows Remote Create Service Unit Test + tests: + - name: Windows Remote Create Service + attack_data: + - file_name: 4688-remote-service-create-windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/4688-remote-service-create-windows-security.log + source: XmlWinEventLog +runtime: SPL-DSP diff --git a/dist/ssa/srs/ssa___windows_service_create_with_tscon.yml b/dist/ssa/srs/ssa___windows_service_create_with_tscon.yml new file mode 100644 index 0000000000..40b6c49f84 --- /dev/null +++ b/dist/ssa/srs/ssa___windows_service_create_with_tscon.yml @@ -0,0 +1,134 @@ +name: Windows Service Create with TSCon +id: 6d16f079-0195-4fdc-a97d-7cfacb6b9b4d +version: 1 +description: The following analytic detects potential RDP Hijacking attempts by monitoring + a series of actions taken by an attacker to gain unauthorized access to a remote + system. The attacker first runs the quser command to query the remote host for disconnected + user sessions. Upon identifying a disconnected session, they use the sc.exe command + to create a new Windows service with a binary path that launches tscon.exe. By specifying + the disconnected session ID and a destination ID, the attacker can transfer the + disconnected session to a new RDP session, effectively hijacking the user's session. + This analytic allows security teams to detect and respond to RDP Hijacking attempts, + mitigating potential risks and impacts on targeted systems. +search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", + null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", + null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval + process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), + "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", + null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) + | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%/dest:rdp-tcp%") + | eval body=create_map( + "devices", [ + create_map( + "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) + ) + ], + "time", timestamp, + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Service Create with TSCon has been triggered on ", device_hostname, " by ", actor_user_name, "."), + "users", [ + create_map( + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) + ) + ], + "activity_id", 1, + "category_uid", 2, + "class_uid", 102001, + "risk_level_id", 2, + "risk_score", 40, + "severity_id", 0, + "rule", create_map("name", "Windows Service Create with TSCon", "uid", "6d16f079-0195-4fdc-a97d-7cfacb6b9b4d", "type", "Streaming"), + "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + "type_uid", 10200101, + "start_time", timestamp, + "end_time", timestamp + ) + | into write_ba_finding_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may arise in the RDP Hijacking analytic when + legitimate administrators access remote sessions for maintenance or troubleshooting + purposes. These activities might resemble an attacker''s attempt to hijack a disconnected + session, leading to false alarms. To mitigate the risk of false positives and improve + the overall security posture, organizations can implement Group Policy to automatically + disconnect RDP sessions when they are complete. By enforcing this policy, administrators + ensure that disconnected sessions are promptly terminated, reducing the window of + opportunity for an attacker to hijack a session. Additionally, organizations can + also implement access control mechanisms and monitor the behavior of privileged + accounts to further enhance security and reduce the chances of false positives in + RDP Hijacking detection. +references: +- https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md +tags: + required_fields: + - process.pid + - process.file.path + - process.file.name + - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname + risk_score: 40 + security_domain: endpoint + risk_severity: low + research_site_url: https://research.splunk.com/endpoint/6d16f079-0195-4fdc-a97d-7cfacb6b9b4d/ + event_schema: ocsf + mappings: + - ocsf: process.pid + cim: process_id + - ocsf: process.file.path + cim: process_path + - ocsf: process.file.name + cim: process_name + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.name + cim: user + - ocsf: actor.process.pid + cim: parent_process_id + - ocsf: actor.process.file.path + cim: parent_process_path + - ocsf: actor.process.file.name + cim: parent_process_name + - ocsf: device.hostname + cim: dest + annotations: + analytic_story: + - Active Directory Lateral Movement + cis20: + - CIS 10 + kill_chain_phases: + - Exploitation + - Installation + mitre_attack_id: + - T1563.002 + - T1563 + - T1543.003 + nist: + - DE.CM +test: + name: Windows Service Create with TSCon Unit Test + tests: + - name: Windows Service Create with TSCon + attack_data: + - file_name: 4688_tscon_windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/4688_tscon_windows-security.log + source: XmlWinEventLog +runtime: SPL-DSP diff --git a/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml b/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml new file mode 100644 index 0000000000..6580da4cdf --- /dev/null +++ b/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml @@ -0,0 +1,110 @@ +name: Windows Lateral Tool Transfer RemCom +id: 25c6b8ba-2a61-41ad-b80c-8e97cf501920 +version: 1 +date: '2022-02-23' +author: Michael Haag, Splunk +type: TTP +status: production +description: This analytic identifies the use of RemCom.exe - The open source psexec. + This utility provides the ability to move laterally and run scripts or commands + remotely. +data_source: +- Windows Security 4688 +search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", + null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", + null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval + process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), + "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", + null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) + | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%/user:%") OR like(process_cmd_line, "%/pwd:%") + OR like(process_cmd_line, "%\\%")) AND process_file_name="remcom.exe" --finding_report--' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible legitimate applications may perform this behavior + and will need to be filtered. +references: +- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ +- https://github.com/kavika13/RemCom +tags: + analytic_story: + - Active Directory Lateral Movement + - Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to move laterally. + mitre_attack_id: + - T1570 + observable: + - name: process.pid + type: Other + - name: process.file.path + type: File + - name: process.file.name + type: File + - name: process.cmd_line + type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname + product: + - Splunk Behavioral Analytics + required_fields: + - process.pid + - process.file.path + - process.file.name + - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname + risk_score: 40 + security_domain: endpoint + mappings: + - ocsf: process.pid + cim: process_id + - ocsf: process.file.path + cim: process_path + - ocsf: process.file.name + cim: process_name + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.name + cim: user + - ocsf: actor.process.pid + cim: parent_process_id + - ocsf: actor.process.file.path + cim: parent_process_path + - ocsf: actor.process.file.name + cim: parent_process_name + - ocsf: device.hostname + cim: dest +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/4688_remcom_windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml new file mode 100644 index 0000000000..750862deb9 --- /dev/null +++ b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml @@ -0,0 +1,83 @@ +name: Windows PowerShell Export Certificate +id: 0bf87e10-4d7d-4c63-9721-c7b3f6e6e944 +version: 1 +date: '2023-05-01' +author: Michael Haag, Splunk +type: Anomaly +status: production +description: The following analytic identifies the PowerShell Cmdlet export-certificate + utilizing Script Block Logging. This particular behavior is related to an adversary + attempting to steal certificates local to the Windows endpoint within the Certificate + Store. +data_source: +- Powershell 4104 +search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", + null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", + null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval + device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), + "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", + null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) + | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), + "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", + null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | + eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, + /(?i)export-certificate/)=true --finding_report--' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: It is possible administrators or scripts may run these commands, + filtering may be required. +references: +- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj +- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps +tags: + analytic_story: + - Windows Certificate Services + asset_type: Endpoint + confidence: 60 + impact: 60 + message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$, + attempting to export a certificate. + mitre_attack_id: + - T1552.004 + - T1552 + - T1649 + observable: + - name: device.hostname + type: Hostname + - name: process.file.path + type: File + - name: process.uid + type: Other + - name: process.cmd_line + type: Other + - name: actor.user.uid + type: Other + product: + - Splunk Behavioral Analytics + required_fields: + - device.hostname + - process.file.path + - process.uid + - process.cmd_line + - actor.user.uid + risk_score: 36 + security_domain: endpoint + mappings: + - ocsf: device.hostname + cim: dest + - ocsf: process.file.path + cim: process_path + - ocsf: process.uid + cim: process_id + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.uid + cim: user_id +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml new file mode 100644 index 0000000000..880ac74c8e --- /dev/null +++ b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml @@ -0,0 +1,83 @@ +name: Windows PowerShell Export PFXCertificate +id: 0c93bb7a-df21-477e-a623-b0c37c1c6661 +version: 1 +date: '2023-05-18' +author: Michael Haag, Splunk +type: anomaly +status: production +description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate + utilizing Script Block Logging. This particular behavior is related to an adversary + attempting to steal certificates local to the Windows endpoint within the Certificate + Store. +data_source: +- Powershell 4104 +search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", + null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", + null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval + device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), + "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", + null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) + | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), + "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", + null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | + eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, + /(?i)export-pfxcertificate/)=true --finding_report--' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: It is possible administrators or scripts may run these commands, + filtering may be required. +references: +- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj +- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps +tags: + analytic_story: + - Windows Certificate Services + asset_type: Endpoint + confidence: 60 + impact: 60 + message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$, + attempting to export a pfxcertificate. + mitre_attack_id: + - T1552.004 + - T1552 + - T1649 + observable: + - name: device.hostname + type: Hostname + - name: process.file.path + type: File + - name: process.uid + type: Other + - name: process.cmd_line + type: Other + - name: actor.user.uid + type: Other + product: + - Splunk Behavioral Analytics + required_fields: + - device.hostname + - process.file.path + - process.uid + - process.cmd_line + - actor.user.uid + risk_score: 36 + security_domain: endpoint + mappings: + - ocsf: device.hostname + cim: dest + - ocsf: process.file.path + cim: process_path + - ocsf: process.uid + cim: process_id + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.uid + cim: user_id +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfx-windows-powershell.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml new file mode 100644 index 0000000000..272d35fe32 --- /dev/null +++ b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml @@ -0,0 +1,112 @@ +name: Windows Remote Create Service +id: 0259ff91-a6f3-4af1-af83-6360eff7fd80 +version: 1 +date: '2023-05-18' +author: Michael Haag, Splunk +type: TTP +status: production +description: This analytic identifies an endpoint that remotely connects to another + endpoint to create a new service using sc.exe. On the remote endpoint, the new service + will be created and this action will trigger the creation of EventCode 7045 along + with all the resulting service information. +data_source: +- Windows Security 4688 +search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", + null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", + null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval + process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), + "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", + null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) + | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (match_regex(process_cmd_line, /(?i)create/)=true OR match_regex(process_cmd_line, + /(?i)\\\\/)=true) AND process_file_name="sc.exe" --finding_report--' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Note that false positives may occur, and filtering may be necessary, + especially when it comes to remote service creation by administrators or software + management utilities. +references: +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - Active Directory Lateral Movement + asset_type: Endpoint + confidence: 50 + impact: 50 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a remote + service. + mitre_attack_id: + - T1543 + - T1543.003 + observable: + - name: process.pid + type: Other + - name: process.file.path + type: File + - name: process.file.name + type: File + - name: process.cmd_line + type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname + product: + - Splunk Behavioral Analytics + required_fields: + - process.pid + - process.file.path + - process.file.name + - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname + risk_score: 25 + security_domain: endpoint + mappings: + - ocsf: process.pid + cim: process_id + - ocsf: process.file.path + cim: process_path + - ocsf: process.file.name + cim: process_name + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.name + cim: user + - ocsf: actor.process.pid + cim: parent_process_id + - ocsf: actor.process.file.path + cim: parent_process_path + - ocsf: actor.process.file.name + cim: parent_process_name + - ocsf: device.hostname + cim: dest +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/4688-remote-service-create-windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml new file mode 100644 index 0000000000..ab06897971 --- /dev/null +++ b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml @@ -0,0 +1,126 @@ +name: Windows Service Create with TSCon +id: 6d16f079-0195-4fdc-a97d-7cfacb6b9b4d +version: 1 +date: '2022-02-23' +author: Michael Haag, Splunk +type: TTP +status: production +description: The following analytic detects potential RDP Hijacking attempts by monitoring + a series of actions taken by an attacker to gain unauthorized access to a remote + system. The attacker first runs the quser command to query the remote host for disconnected + user sessions. Upon identifying a disconnected session, they use the sc.exe command + to create a new Windows service with a binary path that launches tscon.exe. By specifying + the disconnected session ID and a destination ID, the attacker can transfer the + disconnected session to a new RDP session, effectively hijacking the user's session. + This analytic allows security teams to detect and respond to RDP Hijacking attempts, + mitigating potential risks and impacts on targeted systems. +data_source: +- Windows Security 4688 +search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", + null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", + null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval + process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), + "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", + null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) + | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%/dest:rdp-tcp%") --finding_report--' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may arise in the RDP Hijacking analytic when + legitimate administrators access remote sessions for maintenance or troubleshooting + purposes. These activities might resemble an attacker''s attempt to hijack a disconnected + session, leading to false alarms. To mitigate the risk of false positives and improve + the overall security posture, organizations can implement Group Policy to automatically + disconnect RDP sessions when they are complete. By enforcing this policy, administrators + ensure that disconnected sessions are promptly terminated, reducing the window of + opportunity for an attacker to hijack a session. Additionally, organizations can + also implement access control mechanisms and monitor the behavior of privileged + accounts to further enhance security and reduce the chances of false positives in + RDP Hijacking detection. +references: +- https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md +tags: + analytic_story: + - Active Directory Lateral Movement + asset_type: Endpoint + confidence: 50 + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to hijack a RDP + session. + mitre_attack_id: + - T1563.002 + - T1563 + - T1543.003 + observable: + - name: process.pid + type: Other + - name: process.file.path + type: File + - name: process.file.name + type: File + - name: process.cmd_line + type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname + product: + - Splunk Behavioral Analytics + required_fields: + - process.pid + - process.file.path + - process.file.name + - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname + risk_score: 40 + security_domain: endpoint + mappings: + - ocsf: process.pid + cim: process_id + - ocsf: process.file.path + cim: process_path + - ocsf: process.file.name + cim: process_name + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.name + cim: user + - ocsf: actor.process.pid + cim: parent_process_id + - ocsf: actor.process.file.path + cim: parent_process_path + - ocsf: actor.process.file.name + cim: parent_process_name + - ocsf: device.hostname + cim: dest +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/4688_tscon_windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog From e8b6dab89a59b896f06b724006539dc3f2aad458 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 6 Jun 2023 11:22:15 +0200 Subject: [PATCH 2/2] Mark detections as experimental --- ...__windows_lateral_tool_transfer_remcom.yml | 2 +- ..._windows_powershell_export_certificate.yml | 2 +- ...ndows_powershell_export_pfxcertificate.yml | 2 +- .../ssa___windows_remote_create_service.yml | 2 +- ...sa___windows_service_create_with_tscon.yml | 2 +- ...__windows_lateral_tool_transfer_remcom.yml | 118 --------------- ..._windows_powershell_export_certificate.yml | 99 ------------- ...ndows_powershell_export_pfxcertificate.yml | 99 ------------- .../ssa___windows_remote_create_service.yml | 120 ---------------- ...sa___windows_service_create_with_tscon.yml | 134 ------------------ ...__windows_lateral_tool_transfer_remcom.yml | 2 +- ..._windows_powershell_export_certificate.yml | 2 +- ...ndows_powershell_export_pfxcertificate.yml | 2 +- .../ssa___windows_remote_create_service.yml | 2 +- ...sa___windows_service_create_with_tscon.yml | 2 +- 15 files changed, 10 insertions(+), 580 deletions(-) delete mode 100644 dist/ssa/srs/ssa___windows_lateral_tool_transfer_remcom.yml delete mode 100644 dist/ssa/srs/ssa___windows_powershell_export_certificate.yml delete mode 100644 dist/ssa/srs/ssa___windows_powershell_export_pfxcertificate.yml delete mode 100644 dist/ssa/srs/ssa___windows_remote_create_service.yml delete mode 100644 dist/ssa/srs/ssa___windows_service_create_with_tscon.yml diff --git a/dev_ssa/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml b/dev_ssa/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml index 61a49152b5..2b3b0003db 100644 --- a/dev_ssa/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml +++ b/dev_ssa/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml @@ -3,7 +3,7 @@ id: 25c6b8ba-2a61-41ad-b80c-8e97cf501920 version: 1 date: '2022-02-23' author: Michael Haag, Splunk -status: production +status: experimental type: TTP description: This analytic identifies the use of RemCom.exe - The open source psexec. This utility provides the ability to move laterally and run scripts or commands remotely. data_source: diff --git a/dev_ssa/endpoint/ssa___windows_powershell_export_certificate.yml b/dev_ssa/endpoint/ssa___windows_powershell_export_certificate.yml index 30405c8851..04824f7440 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_export_certificate.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_export_certificate.yml @@ -3,7 +3,7 @@ id: 0bf87e10-4d7d-4c63-9721-c7b3f6e6e944 version: 1 date: '2023-05-01' author: Michael Haag, Splunk -status: production +status: experimental type: Anomaly description: The following analytic identifies the PowerShell Cmdlet export-certificate utilizing Script Block Logging. This particular behavior is related to an adversary diff --git a/dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml b/dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml index 8accf6391a..33065dadf8 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml @@ -3,7 +3,7 @@ id: 0c93bb7a-df21-477e-a623-b0c37c1c6661 version: 1 date: '2023-05-18' author: Michael Haag, Splunk -status: production +status: experimental type: anomaly description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate utilizing Script Block Logging. This particular behavior is related to an adversary diff --git a/dev_ssa/endpoint/ssa___windows_remote_create_service.yml b/dev_ssa/endpoint/ssa___windows_remote_create_service.yml index 37f5a0673f..7ea50314ba 100644 --- a/dev_ssa/endpoint/ssa___windows_remote_create_service.yml +++ b/dev_ssa/endpoint/ssa___windows_remote_create_service.yml @@ -3,7 +3,7 @@ id: 0259ff91-a6f3-4af1-af83-6360eff7fd80 version: 1 date: '2023-05-18' author: Michael Haag, Splunk -status: production +status: experimental type: TTP description: 'This analytic identifies an endpoint that remotely connects to another endpoint to create a new service using sc.exe. On the remote endpoint, the new service will be created and this action will trigger the creation of EventCode 7045 along with all the resulting service information.' data_source: diff --git a/dev_ssa/endpoint/ssa___windows_service_create_with_tscon.yml b/dev_ssa/endpoint/ssa___windows_service_create_with_tscon.yml index 0fb5a8093e..8b296dbef8 100644 --- a/dev_ssa/endpoint/ssa___windows_service_create_with_tscon.yml +++ b/dev_ssa/endpoint/ssa___windows_service_create_with_tscon.yml @@ -3,7 +3,7 @@ id: 6d16f079-0195-4fdc-a97d-7cfacb6b9b4d version: 1 date: '2022-02-23' author: Michael Haag, Splunk -status: production +status: experimental type: TTP description: 'The following analytic detects potential RDP Hijacking attempts by monitoring a series of actions taken by an attacker to gain unauthorized access to a remote system. The attacker first runs the quser command to query the remote host for disconnected user sessions. Upon identifying a disconnected session, they use the sc.exe command to create a new Windows service with a binary path that launches tscon.exe. By specifying the disconnected session ID and a destination ID, the attacker can transfer the disconnected session to a new RDP session, effectively hijacking the user''s session. This analytic allows security teams to detect and respond to RDP Hijacking attempts, mitigating potential risks and impacts on targeted systems.' data_source: diff --git a/dist/ssa/srs/ssa___windows_lateral_tool_transfer_remcom.yml b/dist/ssa/srs/ssa___windows_lateral_tool_transfer_remcom.yml deleted file mode 100644 index c81d311e35..0000000000 --- a/dist/ssa/srs/ssa___windows_lateral_tool_transfer_remcom.yml +++ /dev/null @@ -1,118 +0,0 @@ -name: Windows Lateral Tool Transfer RemCom -id: 25c6b8ba-2a61-41ad-b80c-8e97cf501920 -version: 1 -description: This analytic identifies the use of RemCom.exe - The open source psexec. - This utility provides the ability to move laterally and run scripts or commands - remotely. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%/user:%") OR like(process_cmd_line, "%/pwd:%") - OR like(process_cmd_line, "%\\%")) AND process_file_name="remcom.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Lateral Tool Transfer RemCom has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 40, - "severity_id", 0, - "rule", create_map("name", "Windows Lateral Tool Transfer RemCom", "uid", "25c6b8ba-2a61-41ad-b80c-8e97cf501920", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp - ) - | into write_ba_finding_events();' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible legitimate applications may perform this behavior - and will need to be filtered. -references: -- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ -- https://github.com/kavika13/RemCom -tags: - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 40 - security_domain: endpoint - risk_severity: low - research_site_url: https://research.splunk.com/endpoint/25c6b8ba-2a61-41ad-b80c-8e97cf501920/ - event_schema: ocsf - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest - annotations: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - cis20: - - CIS 10 - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1570 - nist: - - DE.CM -test: - name: Windows Lateral Tool Transfer RemCom Unit Test - tests: - - name: Windows Lateral Tool Transfer RemCom - attack_data: - - file_name: 4688_remcom_windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/4688_remcom_windows-security.log - source: XmlWinEventLog -runtime: SPL-DSP diff --git a/dist/ssa/srs/ssa___windows_powershell_export_certificate.yml b/dist/ssa/srs/ssa___windows_powershell_export_certificate.yml deleted file mode 100644 index acc1eb6eb0..0000000000 --- a/dist/ssa/srs/ssa___windows_powershell_export_certificate.yml +++ /dev/null @@ -1,99 +0,0 @@ -name: Windows PowerShell Export Certificate -id: 0bf87e10-4d7d-4c63-9721-c7b3f6e6e944 -version: 1 -description: The following analytic identifies the PowerShell Cmdlet export-certificate - utilizing Script Block Logging. This particular behavior is related to an adversary - attempting to steal certificates local to the Windows endpoint within the Certificate - Store. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)export-certificate/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), - "message", concat("Windows PowerShell Export Certificate has been triggered on ", device_hostname, " by ", "Unknown", "."), - "users", [ - create_map( - "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 36, - "severity_id", 0, - "rule", create_map("name", "Windows PowerShell Export Certificate", "uid", "0bf87e10-4d7d-4c63-9721-c7b3f6e6e944", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp - ) - | into write_ba_finding_events();' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: It is possible administrators or scripts may run these commands, - filtering may be required. -references: -- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj -- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps -tags: - required_fields: - - device.hostname - - process.file.path - - process.uid - - process.cmd_line - - actor.user.uid - risk_score: 36 - security_domain: endpoint - risk_severity: low - research_site_url: https://research.splunk.com/endpoint/0bf87e10-4d7d-4c63-9721-c7b3f6e6e944/ - event_schema: ocsf - mappings: - - ocsf: device.hostname - cim: dest - - ocsf: process.file.path - cim: process_path - - ocsf: process.uid - cim: process_id - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.uid - cim: user_id - annotations: - analytic_story: - - Windows Certificate Services - cis20: - - CIS 10 - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1552.004 - - T1552 - - T1649 - nist: - - DE.AE -test: - name: Windows PowerShell Export Certificate Unit Test - tests: - - name: Windows PowerShell Export Certificate - attack_data: - - file_name: 4104_export_certificate.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log - source: XmlWinEventLog -runtime: SPL-DSP diff --git a/dist/ssa/srs/ssa___windows_powershell_export_pfxcertificate.yml b/dist/ssa/srs/ssa___windows_powershell_export_pfxcertificate.yml deleted file mode 100644 index e30eec6058..0000000000 --- a/dist/ssa/srs/ssa___windows_powershell_export_pfxcertificate.yml +++ /dev/null @@ -1,99 +0,0 @@ -name: Windows PowerShell Export PFXCertificate -id: 0c93bb7a-df21-477e-a623-b0c37c1c6661 -version: 1 -description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate - utilizing Script Block Logging. This particular behavior is related to an adversary - attempting to steal certificates local to the Windows endpoint within the Certificate - Store. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)export-pfxcertificate/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), - "message", concat("Windows PowerShell Export PFXCertificate has been triggered on ", device_hostname, " by ", "Unknown", "."), - "users", [ - create_map( - "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 36, - "severity_id", 0, - "rule", create_map("name", "Windows PowerShell Export PFXCertificate", "uid", "0c93bb7a-df21-477e-a623-b0c37c1c6661", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp - ) - | into write_ba_finding_events();' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: It is possible administrators or scripts may run these commands, - filtering may be required. -references: -- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj -- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps -tags: - required_fields: - - device.hostname - - process.file.path - - process.uid - - process.cmd_line - - actor.user.uid - risk_score: 36 - security_domain: endpoint - risk_severity: low - research_site_url: https://research.splunk.com/endpoint/0c93bb7a-df21-477e-a623-b0c37c1c6661/ - event_schema: ocsf - mappings: - - ocsf: device.hostname - cim: dest - - ocsf: process.file.path - cim: process_path - - ocsf: process.uid - cim: process_id - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.uid - cim: user_id - annotations: - analytic_story: - - Windows Certificate Services - cis20: - - CIS 10 - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1552.004 - - T1552 - - T1649 - nist: - - DE.AE -test: - name: Windows PowerShell Export PFXCertificate Unit Test - tests: - - name: Windows PowerShell Export PFXCertificate - attack_data: - - file_name: 4104_export_pfx-windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfx-windows-powershell.log - source: XmlWinEventLog -runtime: SPL-DSP diff --git a/dist/ssa/srs/ssa___windows_remote_create_service.yml b/dist/ssa/srs/ssa___windows_remote_create_service.yml deleted file mode 100644 index f2570735fc..0000000000 --- a/dist/ssa/srs/ssa___windows_remote_create_service.yml +++ /dev/null @@ -1,120 +0,0 @@ -name: Windows Remote Create Service -id: 0259ff91-a6f3-4af1-af83-6360eff7fd80 -version: 1 -description: This analytic identifies an endpoint that remotely connects to another - endpoint to create a new service using sc.exe. On the remote endpoint, the new service - will be created and this action will trigger the creation of EventCode 7045 along - with all the resulting service information. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)create/)=true OR match_regex(process_cmd_line, - /(?i)\\\\/)=true) AND process_file_name="sc.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Remote Create Service has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 25, - "severity_id", 0, - "rule", create_map("name", "Windows Remote Create Service", "uid", "0259ff91-a6f3-4af1-af83-6360eff7fd80", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp - ) - | into write_ba_finding_events();' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Note that false positives may occur, and filtering may be necessary, - especially when it comes to remote service creation by administrators or software - management utilities. -references: -- https://attack.mitre.org/techniques/T1543/003/ -tags: - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 25 - security_domain: endpoint - risk_severity: low - research_site_url: https://research.splunk.com/endpoint/0259ff91-a6f3-4af1-af83-6360eff7fd80/ - event_schema: ocsf - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest - annotations: - analytic_story: - - Active Directory Lateral Movement - cis20: - - CIS 10 - kill_chain_phases: - - Installation - - Exploitation - mitre_attack_id: - - T1543 - - T1543.003 - nist: - - DE.CM -test: - name: Windows Remote Create Service Unit Test - tests: - - name: Windows Remote Create Service - attack_data: - - file_name: 4688-remote-service-create-windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/4688-remote-service-create-windows-security.log - source: XmlWinEventLog -runtime: SPL-DSP diff --git a/dist/ssa/srs/ssa___windows_service_create_with_tscon.yml b/dist/ssa/srs/ssa___windows_service_create_with_tscon.yml deleted file mode 100644 index 40b6c49f84..0000000000 --- a/dist/ssa/srs/ssa___windows_service_create_with_tscon.yml +++ /dev/null @@ -1,134 +0,0 @@ -name: Windows Service Create with TSCon -id: 6d16f079-0195-4fdc-a97d-7cfacb6b9b4d -version: 1 -description: The following analytic detects potential RDP Hijacking attempts by monitoring - a series of actions taken by an attacker to gain unauthorized access to a remote - system. The attacker first runs the quser command to query the remote host for disconnected - user sessions. Upon identifying a disconnected session, they use the sc.exe command - to create a new Windows service with a binary path that launches tscon.exe. By specifying - the disconnected session ID and a destination ID, the attacker can transfer the - disconnected session to a new RDP session, effectively hijacking the user's session. - This analytic allows security teams to detect and respond to RDP Hijacking attempts, - mitigating potential risks and impacts on targeted systems. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%/dest:rdp-tcp%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Service Create with TSCon has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 40, - "severity_id", 0, - "rule", create_map("name", "Windows Service Create with TSCon", "uid", "6d16f079-0195-4fdc-a97d-7cfacb6b9b4d", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp - ) - | into write_ba_finding_events();' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may arise in the RDP Hijacking analytic when - legitimate administrators access remote sessions for maintenance or troubleshooting - purposes. These activities might resemble an attacker''s attempt to hijack a disconnected - session, leading to false alarms. To mitigate the risk of false positives and improve - the overall security posture, organizations can implement Group Policy to automatically - disconnect RDP sessions when they are complete. By enforcing this policy, administrators - ensure that disconnected sessions are promptly terminated, reducing the window of - opportunity for an attacker to hijack a session. Additionally, organizations can - also implement access control mechanisms and monitor the behavior of privileged - accounts to further enhance security and reduce the chances of false positives in - RDP Hijacking detection. -references: -- https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md -tags: - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 40 - security_domain: endpoint - risk_severity: low - research_site_url: https://research.splunk.com/endpoint/6d16f079-0195-4fdc-a97d-7cfacb6b9b4d/ - event_schema: ocsf - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest - annotations: - analytic_story: - - Active Directory Lateral Movement - cis20: - - CIS 10 - kill_chain_phases: - - Exploitation - - Installation - mitre_attack_id: - - T1563.002 - - T1563 - - T1543.003 - nist: - - DE.CM -test: - name: Windows Service Create with TSCon Unit Test - tests: - - name: Windows Service Create with TSCon - attack_data: - - file_name: 4688_tscon_windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/4688_tscon_windows-security.log - source: XmlWinEventLog -runtime: SPL-DSP diff --git a/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml b/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml index 6580da4cdf..7250c821d4 100644 --- a/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml +++ b/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml @@ -4,7 +4,7 @@ version: 1 date: '2022-02-23' author: Michael Haag, Splunk type: TTP -status: production +status: experimental description: This analytic identifies the use of RemCom.exe - The open source psexec. This utility provides the ability to move laterally and run scripts or commands remotely. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml index 750862deb9..3e2c96fb12 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml @@ -4,7 +4,7 @@ version: 1 date: '2023-05-01' author: Michael Haag, Splunk type: Anomaly -status: production +status: experimental description: The following analytic identifies the PowerShell Cmdlet export-certificate utilizing Script Block Logging. This particular behavior is related to an adversary attempting to steal certificates local to the Windows endpoint within the Certificate diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml index 880ac74c8e..c375c6604d 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml @@ -4,7 +4,7 @@ version: 1 date: '2023-05-18' author: Michael Haag, Splunk type: anomaly -status: production +status: experimental description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate utilizing Script Block Logging. This particular behavior is related to an adversary attempting to steal certificates local to the Windows endpoint within the Certificate diff --git a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml index 272d35fe32..e60d1050f1 100644 --- a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml +++ b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml @@ -4,7 +4,7 @@ version: 1 date: '2023-05-18' author: Michael Haag, Splunk type: TTP -status: production +status: experimental description: This analytic identifies an endpoint that remotely connects to another endpoint to create a new service using sc.exe. On the remote endpoint, the new service will be created and this action will trigger the creation of EventCode 7045 along diff --git a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml index ab06897971..6f347bc2a4 100644 --- a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml +++ b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml @@ -4,7 +4,7 @@ version: 1 date: '2022-02-23' author: Michael Haag, Splunk type: TTP -status: production +status: experimental description: The following analytic detects potential RDP Hijacking attempts by monitoring a series of actions taken by an attacker to gain unauthorized access to a remote system. The attacker first runs the quser command to query the remote host for disconnected