From cad5215f3ec169565876aac9bf7b62fedb888304 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 20 Jul 2022 12:36:41 +0200 Subject: [PATCH 1/8] add crowdstrike data to detection --- ...ted_credential_dump_from_registry_via_reg_exe.yml | 3 ++- ...redential_dump_from_registry_via_reg_exe.test.yml | 12 +++++++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 9547305518..57e0ae2317 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -9,7 +9,7 @@ datamodel: description: Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` + as lastTime from datamodel=Endpoint.Processes where Processes.process=reg* OR Processes.process=cmd* Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.dest @@ -41,6 +41,7 @@ tags: - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log impact: 90 kill_chain_phases: - Actions on Objectives diff --git a/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe.test.yml b/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe.test.yml index 350f093598..e8b7c38317 100644 --- a/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe.test.yml +++ b/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe.test.yml @@ -1,6 +1,6 @@ name: Attempted Credential Dump From Registry via Reg exe Unit Test tests: -- name: Attempted Credential Dump From Registry via Reg exe +- name: Attempted Credential Dump From Registry via Reg exe Sysmon file: endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h @@ -10,3 +10,13 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +- name: Attempted Credential Dump From Registry via Reg exe Crowdstrike + file: endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: crowdstrike_falcon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor From dce7b86179eb72cf2e0b1fbc2871c20c16f53db8 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 20 Jul 2022 14:58:23 +0200 Subject: [PATCH 2/8] add crowdstrike data to detection --- .../attempted_credential_dump_from_registry_via_reg_exe.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 57e0ae2317..be33cde8f5 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -9,7 +9,7 @@ datamodel: description: Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process=reg* OR Processes.process=cmd* + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg* OR Processes.process_name=cmd* Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.dest From 1ad91bcf324b75230efa366f381841602c1295e8 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 26 Jul 2022 09:51:16 +0200 Subject: [PATCH 3/8] add crowdstrike data --- detections/endpoint/bits_job_persistence.yml | 1 + detections/endpoint/bitsadmin_download_file.yml | 1 + tests/endpoint/bits_job_persistence.test.yml | 12 +++++++++++- tests/endpoint/bitsadmin_download_file.test.yml | 12 +++++++++++- 4 files changed, 24 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 307e045316..415b98ce1b 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -43,6 +43,7 @@ tags: - Stage:Persistence dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log impact: 70 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index f1b6f78e05..92e9503a8a 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -48,6 +48,7 @@ tags: - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log impact: 70 kill_chain_phases: - Exploitation diff --git a/tests/endpoint/bits_job_persistence.test.yml b/tests/endpoint/bits_job_persistence.test.yml index 6ff423451e..ae2348942c 100644 --- a/tests/endpoint/bits_job_persistence.test.yml +++ b/tests/endpoint/bits_job_persistence.test.yml @@ -1,6 +1,6 @@ name: BITS Job Persistence Unit Test tests: -- name: BITS Job Persistence +- name: BITS Job Persistence Sysmon file: endpoint/bits_job_persistence.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h @@ -10,3 +10,13 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +- name: BITS Job Persistence Crowdstrike + file: endpoint/bits_job_persistence.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: crowdstrike.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor \ No newline at end of file diff --git a/tests/endpoint/bitsadmin_download_file.test.yml b/tests/endpoint/bitsadmin_download_file.test.yml index d7bf6cacfd..884cbadac7 100644 --- a/tests/endpoint/bitsadmin_download_file.test.yml +++ b/tests/endpoint/bitsadmin_download_file.test.yml @@ -1,6 +1,6 @@ name: BITSAdmin Download File Unit Test tests: -- name: BITSAdmin Download File +- name: BITSAdmin Download File Sysmon file: endpoint/bitsadmin_download_file.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h @@ -10,3 +10,13 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +- name: BITSAdmin Download File Crowdstrike + file: endpoint/bitsadmin_download_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: crowdstrike.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor \ No newline at end of file From 812819551e0338d889c2bad8f6050c999a4f6530 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 27 Jul 2022 11:08:52 +0200 Subject: [PATCH 4/8] add crowdstrike data --- detections/endpoint/creation_of_shadow_copy.yml | 1 + tests/endpoint/creation_of_shadow_copy.test.yml | 12 +++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 52d1629bfd..4cb95e1a86 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -36,6 +36,7 @@ tags: - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log impact: 90 kill_chain_phases: - Actions on Objectives diff --git a/tests/endpoint/creation_of_shadow_copy.test.yml b/tests/endpoint/creation_of_shadow_copy.test.yml index a12905bc92..752d7fdbd7 100644 --- a/tests/endpoint/creation_of_shadow_copy.test.yml +++ b/tests/endpoint/creation_of_shadow_copy.test.yml @@ -1,6 +1,6 @@ name: Creation of Shadow Copy Unit Test tests: -- name: Creation of Shadow Copy +- name: Creation of Shadow Copy Sysmon file: endpoint/creation_of_shadow_copy.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h @@ -10,3 +10,13 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +- name: Creation of Shadow Copy Crowdstrike + file: endpoint/creation_of_shadow_copy.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: crowdstrike.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor From a1369c71fc772c55bba91242fe9635d7814cf713 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 27 Jul 2022 12:59:12 +0200 Subject: [PATCH 5/8] add crowdstrike data --- detections/endpoint/dump_lsass_via_procdump.yml | 1 + tests/endpoint/dump_lsass_via_procdump.test.yml | 12 +++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 42f12b5b6e..da014c5180 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -46,6 +46,7 @@ tags: - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log impact: 80 kill_chain_phases: - Actions on Objectives diff --git a/tests/endpoint/dump_lsass_via_procdump.test.yml b/tests/endpoint/dump_lsass_via_procdump.test.yml index bdaad1cca5..ade2bb39da 100644 --- a/tests/endpoint/dump_lsass_via_procdump.test.yml +++ b/tests/endpoint/dump_lsass_via_procdump.test.yml @@ -1,6 +1,6 @@ name: Dump LSASS via procdump Unit Test tests: -- name: Dump LSASS via procdump +- name: Dump LSASS via procdump Sysmon file: endpoint/dump_lsass_via_procdump.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h @@ -10,3 +10,13 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +- name: Dump LSASS via procdump Crowdstrike + file: endpoint/dump_lsass_via_procdump.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: crowdstrike_falcon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor From 5f95c424ce949ce1475aa69347c8c3f5f91c52a8 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 13 Sep 2022 15:48:46 -0700 Subject: [PATCH 6/8] Path to wrong data files in creation_of_shadow_copy detection. This caused a CI failure because the proper events were not being replayed. --- detections/endpoint/creation_of_shadow_copy.yml | 2 +- tests/endpoint/creation_of_shadow_copy.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 4cb95e1a86..616812e121 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -36,7 +36,7 @@ tags: - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log impact: 90 kill_chain_phases: - Actions on Objectives diff --git a/tests/endpoint/creation_of_shadow_copy.test.yml b/tests/endpoint/creation_of_shadow_copy.test.yml index 752d7fdbd7..684858ba91 100644 --- a/tests/endpoint/creation_of_shadow_copy.test.yml +++ b/tests/endpoint/creation_of_shadow_copy.test.yml @@ -17,6 +17,6 @@ tests: latest_time: now attack_data: - file_name: crowdstrike.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log source: crowdstrike sourcetype: crowdstrike:events:sensor From e710cc45829db9a21989daf40e8a31772a6ea67d Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 13 Sep 2022 16:41:29 -0700 Subject: [PATCH 7/8] Wrong dataset file specified in the test file for bitsadmin_download_file.test.yml --- tests/endpoint/bitsadmin_download_file.test.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/endpoint/bitsadmin_download_file.test.yml b/tests/endpoint/bitsadmin_download_file.test.yml index 884cbadac7..ea4c9cc82f 100644 --- a/tests/endpoint/bitsadmin_download_file.test.yml +++ b/tests/endpoint/bitsadmin_download_file.test.yml @@ -16,7 +16,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: crowdstrike.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + - file_name: crowdstrike_falcon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log source: crowdstrike - sourcetype: crowdstrike:events:sensor \ No newline at end of file + sourcetype: crowdstrike:events:sensor From 801bc1fe460f55b9081176e406e30de601fd2f77 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 15 Nov 2022 11:13:35 -0700 Subject: [PATCH 8/8] revision number --- .../attempted_credential_dump_from_registry_via_reg_exe.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index be33cde8f5..f9a0dc72dc 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,7 +1,7 @@ name: Attempted Credential Dump From Registry via Reg exe id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 -version: 6 -date: '2021-09-16' +version: 7 +date: '2022-11-15' author: Patrick Bareiss, Splunk type: TTP datamodel: