admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2022-11-15 11:52:16 -08:00
committed by GitHub
parent 1e3ddbc24e 8fcbeaee73
commit 8afe47598d
10 changed files with 63 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Attempted Credential Dump From Registry via Reg exe
id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
version: 6
date: '2021-09-16'
version: 7
date: '2022-11-15'
author: Patrick Bareiss, Splunk
type: TTP
datamodel:
@@ -9,7 +9,7 @@ datamodel:
description: Monitor for execution of reg.exe with parameters specifying an export
of keys that contain hashed credentials that attackers may try to crack offline.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd`
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg* OR Processes.process_name=cmd*
Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM*
OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security*
OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.dest
@@ -41,6 +41,7 @@ tags:
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log
impact: 90
kill_chain_phases:
- Actions on Objectives
detections/endpoint/bits_job_persistence.yml
+1
View File
@@ -43,6 +43,7 @@ tags:
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log
impact: 70
kill_chain_phases:
- Exploitation
detections/endpoint/bitsadmin_download_file.yml
+1
View File
@@ -48,6 +48,7 @@ tags:
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log
impact: 70
kill_chain_phases:
- Exploitation
detections/endpoint/creation_of_shadow_copy.yml
+1
View File
@@ -36,6 +36,7 @@ tags:
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log
impact: 90
kill_chain_phases:
- Actions on Objectives
detections/endpoint/dump_lsass_via_procdump.yml
+1
View File
@@ -48,6 +48,7 @@ tags:
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log
impact: 80
kill_chain_phases:
- Actions on Objectives
tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe.test.yml
+11 -1
View File
@@ -1,6 +1,6 @@
name: Attempted Credential Dump From Registry via Reg exe Unit Test
tests:
- name: Attempted Credential Dump From Registry via Reg exe
- name: Attempted Credential Dump From Registry via Reg exe Sysmon
file: endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
@@ -10,3 +10,13 @@ tests:
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
- name: Attempted Credential Dump From Registry via Reg exe Crowdstrike
file: endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: crowdstrike_falcon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log
source: crowdstrike
sourcetype: crowdstrike:events:sensor
tests/endpoint/bits_job_persistence.test.yml
+11 -1
View File
@@ -1,6 +1,6 @@
name: BITS Job Persistence Unit Test
tests:
- name: BITS Job Persistence
- name: BITS Job Persistence Sysmon
file: endpoint/bits_job_persistence.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
@@ -10,3 +10,13 @@ tests:
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
- name: BITS Job Persistence Crowdstrike
file: endpoint/bits_job_persistence.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: crowdstrike.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log
source: crowdstrike
sourcetype: crowdstrike:events:sensor
tests/endpoint/bitsadmin_download_file.test.yml
+11 -1
View File
@@ -1,6 +1,6 @@
name: BITSAdmin Download File Unit Test
tests:
- name: BITSAdmin Download File
- name: BITSAdmin Download File Sysmon
file: endpoint/bitsadmin_download_file.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
@@ -10,3 +10,13 @@ tests:
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
- name: BITSAdmin Download File Crowdstrike
file: endpoint/bitsadmin_download_file.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: crowdstrike_falcon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log
source: crowdstrike
sourcetype: crowdstrike:events:sensor
tests/endpoint/creation_of_shadow_copy.test.yml
+11 -1
View File
@@ -1,6 +1,6 @@
name: Creation of Shadow Copy Unit Test
tests:
- name: Creation of Shadow Copy
- name: Creation of Shadow Copy Sysmon
file: endpoint/creation_of_shadow_copy.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
@@ -10,3 +10,13 @@ tests:
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
- name: Creation of Shadow Copy Crowdstrike
file: endpoint/creation_of_shadow_copy.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: crowdstrike.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log
source: crowdstrike
sourcetype: crowdstrike:events:sensor
tests/endpoint/dump_lsass_via_procdump.test.yml
+11 -1
View File
@@ -1,6 +1,6 @@
name: Dump LSASS via procdump Unit Test
tests:
- name: Dump LSASS via procdump
- name: Dump LSASS via procdump Sysmon
file: endpoint/dump_lsass_via_procdump.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
@@ -10,3 +10,13 @@ tests:
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
- name: Dump LSASS via procdump Crowdstrike
file: endpoint/dump_lsass_via_procdump.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: crowdstrike_falcon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log
source: crowdstrike
sourcetype: crowdstrike:events:sensor