From 89df8759c671fd1a2110c83a2683861d23f387d2 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 1 Mar 2022 13:54:27 -0700 Subject: [PATCH] second pass --- .../endpoint/delete_shadowcopy_with_powershell.yml | 3 ++- ...t_copy_of_shadowcopy_with_script_block_logging.yml | 3 ++- ..._mimikatz_with_powershell_script_block_logging.yml | 2 +- ...s_pre_authentication_discovery_with_get_aduser.yml | 3 ++- ...os_pre_authentication_discovery_with_powerview.yml | 4 ++-- .../domain_group_discovery_with_adsisearcher.yml | 2 +- .../delete_shadowcopy_with_powershell.test.yml | 8 ++++---- ...y_of_shadowcopy_with_script_block_logging.test.yml | 8 ++++---- ...katz_with_powershell_script_block_logging.test.yml | 8 ++++---- ..._authentication_discovery_with_get_aduser.test.yml | 11 ++++------- ...e_authentication_discovery_with_powerview.test.yml | 8 ++++---- 11 files changed, 30 insertions(+), 30 deletions(-) diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 89540ab1d9..87dad167d2 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -23,6 +23,7 @@ references: - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html - https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell tags: analytic_story: - DarkSide Ransomware @@ -35,7 +36,7 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/shadow-powershell.log impact: 90 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml index a8c02660da..0b6d5f7453 100644 --- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml +++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml @@ -33,6 +33,7 @@ references: - https://github.com/GossiTheDog/HiveNightmare - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-6---dump-volume-shadow-copy-hives-with-systemiofile tags: analytic_story: - Credential Dumping @@ -45,7 +46,7 @@ tags: cve: - CVE-2021-36934 dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/serioussam/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/copy-powershell.log impact: 80 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 22ca6a6e9c..2c63b9cd7d 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -42,7 +42,7 @@ tags: - Source:Endpoint - Stage:Credential Access dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log impact: 90 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml index dbfb581eb8..2b02fcabc1 100644 --- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml @@ -21,6 +21,7 @@ known_false_positives: Administrators or power users may use search for accounts references: - https://attack.mitre.org/techniques/T1558/004/ - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: @@ -28,7 +29,7 @@ tags: - Active Directory Kerberos Attacks - Malicious PowerShell dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell.log kill_chain_phases: - Privilege Escalation mitre_attack_id: diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml index 2d9774a223..7c92851e52 100644 --- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -11,7 +11,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired` allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline. -search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*") +search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`' how_to_implement: To successfully implement this analytic, you will need to enable @@ -28,7 +28,7 @@ tags: - Active Directory Kerberos Attacks - Malicious PowerShell dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/getdomainuser-powershell.log kill_chain_phases: - Privilege Escalation mitre_attack_id: diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml index 6e1744ee19..232c72f4a2 100644 --- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -32,7 +32,7 @@ tags: - Stage:Discovery - Stage:Recon dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/adsisearcher-powershell.log impact: 30 kill_chain_phases: - Reconnaissance diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml index 3f36a62eff..263d48d2fd 100644 --- a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml +++ b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog \ No newline at end of file + - file_name: shadow-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/shadow-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml b/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml index b5d5b7a310..23da15cb73 100644 --- a/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml +++ b/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/serioussam/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog \ No newline at end of file + - file_name: copy-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/copy-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: Xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml index f03fd4d85e..d566e9bd42 100644 --- a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml +++ b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog \ No newline at end of file + - file_name: credaccess-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml index 034af504ea..3696e78e80 100644 --- a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml +++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml @@ -6,10 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog - - - + - file_name: get-aduser-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml index 95445f94db..08f0b6f334 100644 --- a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml +++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog \ No newline at end of file + - file_name: getdomainuser-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/getdomainuser-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog \ No newline at end of file