diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 9547305518..f9a0dc72dc 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,7 +1,7 @@ name: Attempted Credential Dump From Registry via Reg exe id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 -version: 6 -date: '2021-09-16' +version: 7 +date: '2022-11-15' author: Patrick Bareiss, Splunk type: TTP datamodel: @@ -9,7 +9,7 @@ datamodel: description: Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg* OR Processes.process_name=cmd* Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.dest @@ -41,6 +41,7 @@ tags: - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log impact: 90 kill_chain_phases: - Actions on Objectives diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 307e045316..415b98ce1b 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -43,6 +43,7 @@ tags: - Stage:Persistence dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log impact: 70 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index f1b6f78e05..92e9503a8a 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -48,6 +48,7 @@ tags: - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log impact: 70 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 52d1629bfd..616812e121 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -36,6 +36,7 @@ tags: - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log impact: 90 kill_chain_phases: - Actions on Objectives diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 65fbe9114e..bef8732929 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -48,6 +48,7 @@ tags: - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log impact: 80 kill_chain_phases: - Actions on Objectives diff --git a/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe.test.yml b/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe.test.yml index 350f093598..e8b7c38317 100644 --- a/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe.test.yml +++ b/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe.test.yml @@ -1,6 +1,6 @@ name: Attempted Credential Dump From Registry via Reg exe Unit Test tests: -- name: Attempted Credential Dump From Registry via Reg exe +- name: Attempted Credential Dump From Registry via Reg exe Sysmon file: endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h @@ -10,3 +10,13 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +- name: Attempted Credential Dump From Registry via Reg exe Crowdstrike + file: endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: crowdstrike_falcon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/tests/endpoint/bits_job_persistence.test.yml b/tests/endpoint/bits_job_persistence.test.yml index 6ff423451e..ae2348942c 100644 --- a/tests/endpoint/bits_job_persistence.test.yml +++ b/tests/endpoint/bits_job_persistence.test.yml @@ -1,6 +1,6 @@ name: BITS Job Persistence Unit Test tests: -- name: BITS Job Persistence +- name: BITS Job Persistence Sysmon file: endpoint/bits_job_persistence.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h @@ -10,3 +10,13 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +- name: BITS Job Persistence Crowdstrike + file: endpoint/bits_job_persistence.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: crowdstrike.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor \ No newline at end of file diff --git a/tests/endpoint/bitsadmin_download_file.test.yml b/tests/endpoint/bitsadmin_download_file.test.yml index d7bf6cacfd..ea4c9cc82f 100644 --- a/tests/endpoint/bitsadmin_download_file.test.yml +++ b/tests/endpoint/bitsadmin_download_file.test.yml @@ -1,6 +1,6 @@ name: BITSAdmin Download File Unit Test tests: -- name: BITSAdmin Download File +- name: BITSAdmin Download File Sysmon file: endpoint/bitsadmin_download_file.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h @@ -10,3 +10,13 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +- name: BITSAdmin Download File Crowdstrike + file: endpoint/bitsadmin_download_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: crowdstrike_falcon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/tests/endpoint/creation_of_shadow_copy.test.yml b/tests/endpoint/creation_of_shadow_copy.test.yml index a12905bc92..684858ba91 100644 --- a/tests/endpoint/creation_of_shadow_copy.test.yml +++ b/tests/endpoint/creation_of_shadow_copy.test.yml @@ -1,6 +1,6 @@ name: Creation of Shadow Copy Unit Test tests: -- name: Creation of Shadow Copy +- name: Creation of Shadow Copy Sysmon file: endpoint/creation_of_shadow_copy.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h @@ -10,3 +10,13 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +- name: Creation of Shadow Copy Crowdstrike + file: endpoint/creation_of_shadow_copy.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: crowdstrike.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/tests/endpoint/dump_lsass_via_procdump.test.yml b/tests/endpoint/dump_lsass_via_procdump.test.yml index bdaad1cca5..ade2bb39da 100644 --- a/tests/endpoint/dump_lsass_via_procdump.test.yml +++ b/tests/endpoint/dump_lsass_via_procdump.test.yml @@ -1,6 +1,6 @@ name: Dump LSASS via procdump Unit Test tests: -- name: Dump LSASS via procdump +- name: Dump LSASS via procdump Sysmon file: endpoint/dump_lsass_via_procdump.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h @@ -10,3 +10,13 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +- name: Dump LSASS via procdump Crowdstrike + file: endpoint/dump_lsass_via_procdump.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: crowdstrike_falcon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor