admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-11-16 14:33:29 -08:00
committed by GitHub
parent 915d9986c8 429a7ba0c8
commit 8dca31b929
197 changed files with 3936 additions and 1529 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-and-validate.yml
-509
View File
@@ -1,509 +0,0 @@
#This file makes use of a number of useful, external Github Actions.
#Check the links below for additional documentation on each of these:
#https://github.com/actions/setup-python
#https://github.com/actions/setup-node
#https://github.com/actions/checkout
#https://github.com/actions/upload-artifact
#The mechanism for persisting data between jobs in a workflow is the same as for persisting it
#permanently:
#https://docs.github.com/en/actions/guides/storing-workflow-data-as-artifacts
#In CircleCI, this was different (store_artifacts vs persist_to_workspace)
name: build-and-validate
on:
push:
pull_request:
types: [opened, reopened]
jobs:
validate-tag-if-present:
runs-on: ubuntu-latest
steps:
- name: TAGGED, Validate that the tag is in the correct format
run: |
echo "The GITHUB_REF: $GITHUB_REF"
#First check to see if the release is a tag
if [[ $GITHUB_REF =~ refs/tags/* ]]; then
#Yes, this is a tag, so we need to test to make sure that the tag
#is in the correct format (like v1.10.20)
if [[ $GITHUB_REF =~ refs/tags/v[0-9]+.[0-9]+.[0-9]+ ]]; then
echo "PASS: Tagged release with good format"
exit 0
else
echo "FAIL: Tagged release with bad format"
exit 1
fi
else
echo "PASS: Not a tagged release"
exit 0
fi
validate-and-build:
#Note that the CircleCI job used a Container. The way to do this with Github Actions
#is to first start up a Virtual Machine, then we can by following:
# https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer
runs-on: ubuntu-latest
needs: [validate-tag-if-present]
steps:
- name: Configure Enrichment and Tag
id: vars
run: |
if [ $(echo ${GITHUB_REF} | grep "^refs/tags/*") ]; then
#failed to find the refs/tags/ beginning, grab and set the tag
echo "Release is TAGGED!"
echo "::set-output name=tag::${GITHUB_REF#refs/tags/}"
echo "::set-output name=skip_enrichment_var::"
else
#Not a tagged relese
echo "Release is NOT TAGGED!"
echo "::set-output name=tag::"
echo "::set-output name=skip_enrichment_var::--skip_enrichment"
fi
#Previous config chose which branch/tag to operate on.
#I think Github is smart enough to choose based on whether it's a pull request or push + other info?
- name: Check out the repository code
uses: actions/checkout@v3
#with:
# repository: splunk/security-content #check out https://github.com/mitre/cti.git, defaults to HEAD
# path: "security-content"
- uses: actions/setup-python@v4
with:
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
- name: Install System Packages
run: |
sudo apt update -qq
sudo apt install jq -qq
- name: Install Python Dependencies
run: |
#Get the virtualenv set up
rm -rf venv
python -m venv --clear .venv
source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install wheel
python -m pip install -q -r requirements.txt
- name: content_ctl validate
run: |
source .venv/bin/activate
python contentctl.py -p . ${{ steps.vars.outputs.skip_enrichment_var }} validate -pr ESCU
python contentctl.py -p . ${{ steps.vars.outputs.skip_enrichment_var }} validate -pr SSA
- name: contentctl generate
run: |
source .venv/bin/activate
rm -rf dist/escu/default/data/ui/panels/*.xml
python contentctl.py --path . ${{ steps.vars.outputs.skip_enrichment_var }} generate --product ESCU --output dist/escu
python contentctl.py --path . ${{ steps.vars.outputs.skip_enrichment_var }} generate --product SSA --output dist/ssa
python contentctl.py --path . ${{ steps.vars.outputs.skip_enrichment_var }} generate --product API --output dist/api
- name: Copy lookups .mlmodel files
run: |
cd lookups
count=`ls -1 *.mlmodel 2>/dev/null | wc -l`
if [ $count != 0 ]
then
cp -rv *.mlmodel ../dist/escu/lookups
else
echo "No mlmodel files to copy"
fi
- name: Update Version and Build number
run : |
# check if tag is set, get build number from the tag if set
if [ -z "${{ steps.vars.outputs.tag }}" ]; then
CONTENT_VERSION=$(grep -oP "(\d+.\d+.\d+$)" dist/escu/default/content-version.conf)
echo "detected content version: $CONTENT_VERSION"
else
CONTENT_VERSION=$(echo ${{ steps.vars.outputs.tag }} | grep -oP "\d+.\d+.\d+")
echo "content version: $CONTENT_VERSION, set by tag: ${{ steps.vars.outputs.tag }}"
fi
# update build number and version for ESCU
sed -i "s/build = .*$/build = ${{ github.run_number }}/g" dist/escu/default/app.conf
sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/app.conf
sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/escu/app.manifest
sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/content-version.conf
mkdir build
tar -czf build/content-pack-build-escu.tar.gz dist/escu/*
# update build number and version for ssa
tar -czf build/content-pack-build-ssa.tar.gz dist/ssa/*
tar -czf build/content-pack-build-api.tar.gz dist/api/*
- name: Build ESCU
run: |
source .venv/bin/activate
cd build
tar -zxf content-pack-build-escu.tar.gz
tar -zxf content-pack-build-ssa.tar.gz
tar -zxf content-pack-build-api.tar.gz
mv dist/escu DA-ESS-ContentUpdate
mv dist/ssa SSA_Content
mv dist/api API_Content
#Build ESCU Content
#Do not use slim for speed, simplicity, and compatability
tar -zcf DA-ESS-ContentUpdate-latest.tar.gz DA-ESS-ContentUpdate
sha256sum DA-ESS-ContentUpdate-latest.tar.gz > checksum.txt
#Build the SSA Content
#Do not use slim for speed, simplicity, and compatability
tar -zcf SSA_Content-latest.tar.gz SSA_Content
sha256sum SSA_Content-latest.tar.gz >> checksum.txt
#Package the API Content
tar -zcf API_Content-latest.tar.gz API_Content
sha256sum API_Content-latest.tar.gz >> checksum.txt
- name: store_artifacts
uses: actions/upload-artifact@v3
with:
name: content-latest
path: |
build/DA-ESS-ContentUpdate-latest.tar.gz
build/SSA_Content-latest.tar.gz
build/API_Content-latest.tar.gz
build/checksum.txt
#Everything below this line should ONLY run on a tag and nothing else
#We still want all of the above checks to run and pass before running these
run-appinspect:
runs-on: ubuntu-latest
needs: [validate-and-build]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
- name: Checkout Repo
uses: actions/checkout@v3
with:
ref: 'develop'
#Download the artifacts we want to check
- uses: actions/download-artifact@v3
with:
name: content-latest
path: build/
- name: Install System Packages
run: |
sudo apt update -qq
sudo apt install jq -qq
- name: Submit ESCU to AppInspect API
env:
APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }}
APPINSPECT_PASSWORD: ${{ secrets.AppInspectPassword }}
run: |
cd bin
#Enclose in quotes in case there are any special characters in the username/password
#Better not to pass these arguments on the command line, if possible
./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
- name: Create report artifact
if: always()
run: |
#Always create this, regardless of whether success or failure above
tar -cvzf report.tar.gz report/
- name: store_artifacts
uses: actions/upload-artifact@v3
with:
name: appinspect_reports
path: |
report.tar.gz
#Still store the report, even if we have failed (otherwise we don't know why/how we failed)
- name: store_artifacts_on_failure
uses: actions/upload-artifact@v3
if: failure()
with:
name: appinspect_reports_failure
path: |
report.tar.gz
create-report:
runs-on: ubuntu-latest
needs: [validate-and-build, run-appinspect]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
- name: Checkout Repo
uses: actions/checkout@v3
with:
ref: 'develop'
- name: Install System Packages
run: |
sudo apt update -qq
sudo apt install jq -qq
- uses: actions/setup-python@v4
with:
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
- name: Install Python Dependencies
run: |
#Get the virtualenv set up
rm -rf venv
python -m venv --clear venv
source venv/bin/activate
python -m pip install --upgrade pip
python -m pip install wheel
python -m pip install -q -r requirements.txt
- name: run reporting
run: |
source venv/bin/activate
python contentctl.py -p . reporting
#Official, Verified Amazon-AWS Github Account Provided Action
- uses: aws-actions/configure-aws-credentials@v2
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
# aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
- name: Upload Reporting
run: |
aws s3 cp bin/reporting s3://security-content/reporting --recursive --exclude "*" --include "*.svg"
update-sources-github:
runs-on: ubuntu-latest
permissions:
# Need the write permission because this job commits changes to some folders like dist
contents: write
needs: [validate-and-build, run-appinspect, create-report]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
- name: Checkout Repo
uses: actions/checkout@v3
with:
token: ${{ secrets.SECURITY_CONTENT_ADMIN_TASKS }}
ref: 'develop'
- uses: actions/setup-python@v4
with:
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
- uses: actions/download-artifact@v3
with:
name: content-latest
- name: Stage artifacts in proper directories
run: |
mkdir latest-escu
tar -zxf DA-ESS-ContentUpdate-latest.tar.gz -C latest-escu --strip-components=1
mkdir latest-ssa
tar -zxf SSA_Content-latest.tar.gz -C latest-ssa --strip-components=1
mkdir latest-api
tar -zxf API_Content-latest.tar.gz -C latest-api --strip-components=1
- name: Install Python Dependencies
run: |
#Get the virtualenv set up
rm -rf venv
python -m venv --clear venv
source venv/bin/activate
python -m pip install --upgrade pip
python -m pip install wheel
python -m pip install -q -r requirements.txt
- name: Get branch and PR required for detection testing main.py
id: vars
run: |
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
- name: Run reporting
run: |
source venv/bin/activate
python contentctl.py -p . reporting
- name: Update github with new docs and package bits
run: |
rm -rf dist
mkdir dist
mv latest-escu dist/escu
mv latest-ssa dist/ssa
mv latest-api dist/api
# configure git to prep for commit
git config user.email "research@splunk.com"
git config user.name "research bot"
git config --global push.default simple
git add dist/*
git add docs/*
git add detections/*
git commit --allow-empty -m "Update dist/escu, dist/ssa, and dist/api folders with the latest content associated with this tag "
# Push quietly to prevent showing the token in log
#No need to provide any credentials
git push
publish-github-release:
#Github-maintained release action is in archived state: https://github.com/actions/create-release
#They recommend several and we use the following with the most stars: https://github.com/softprops/action-gh-release
runs-on: ubuntu-latest
needs: [validate-and-build, run-appinspect, create-report]
#Only run when tagged
# adding perms needed
permissions:
contents: write
if: startsWith(github.ref, 'refs/tags/')
steps:
#Get the artifacts that we need
- uses: actions/download-artifact@v3
with:
name: content-latest
- uses: actions/download-artifact@v3
with:
name: appinspect_reports
#Rename those artifacts appropriately
- name: Set tag
id: vars
run: echo "::set-output name=tag::${GITHUB_REF#refs/*/}"
- name: Rename the content-update appropriately
run: |
cp DA-ESS-ContentUpdate-latest.tar.gz DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz
cp SSA_Content-latest.tar.gz SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz
cp API_Content-latest.tar.gz API_Content-${{ steps.vars.outputs.tag }}.tar.gz
#No checksum on the reports
cp report.tar.gz report-${{ steps.vars.outputs.tag }}.tar.gz
cp checksum.txt checksum-${{ steps.vars.outputs.tag }}.txt
#Upload all of the artifacts that we have created using the third party
#action recommended bu Github
- name: Upload Release Artifacts
uses: softprops/action-gh-release@v1
with:
files: |
DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz
SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz
API_Content-${{ steps.vars.outputs.tag }}.tar.gz
report-${{ steps.vars.outputs.tag }}.tar.gz
checksum-${{ steps.vars.outputs.tag }}.txt
attack-range-update:
runs-on: ubuntu-latest
needs: [validate-and-build, run-appinspect, create-report]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
#Get the artifacts that we need
- uses: actions/download-artifact@v3
with:
name: content-latest
#Official, Verified Amazon-AWS Github Account Provided Action
- uses: aws-actions/configure-aws-credentials@v2
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
# aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
- name: Sync latest ESCU to the Attack Range S3 bucket for apps
run: |
aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/
# make the file public since it is not by default
aws s3api put-object-acl --bucket attack-range-appbinaries --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read
master-api-update:
runs-on: ubuntu-latest
needs: [validate-and-build, run-appinspect, create-report]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
- name: Checkout Repo
uses: actions/checkout@v3
with:
ref: 'develop'
- uses: actions/setup-python@v4
with:
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
- name: Install Python Dependencies
run: |
#Get the virtualenv set up
rm -rf venv
python -m venv --clear venv
source venv/bin/activate
python -m pip install --upgrade pip
python -m pip install wheel
python -m pip install -q -r requirements.txt
- name: Create YML to JSON Folder
run: |
source venv/bin/activate
python contentctl.py --path . generate --product API --output dist/api
- name: Generate content version and timestamp JSON
run : |
VERSION_VAL=$GITHUB_REF_NAME
VERSION_TS=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
echo "{\"version\":{\"name\":\"$VERSION_VAL\",\"published_at\":\"$VERSION_TS\"}}" > dist/api/version.json
echo "contents of version.json:"
cat dist/api/version.json
#Official, Verified Amazon-AWS Github Account Provided Action
- uses: aws-actions/configure-aws-credentials@v2
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
# aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
- name: Update API sources
run: |
aws s3 rm s3://security-content --recursive --exclude "*" --include "*.yml"
aws s3 cp stories s3://security-content/stories --recursive --exclude "*" --include "*.yml"
aws s3 cp baselines s3://security-content/baselines --recursive --exclude "*" --include "*.yml"
aws s3 cp detections s3://security-content/detections --recursive --exclude "*" --include "*.yml"
aws s3 cp playbooks s3://security-content/playbooks --recursive --exclude "*" --include "*.yml"
aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.yml"
aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.csv"
aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.mlmodel"
aws s3 cp macros s3://security-content/macros --recursive --exclude "*" --include "*.yml"
aws s3 cp deployments s3://security-content/deployments --recursive --exclude "*" --include "*.yml"
aws s3 cp dist/api s3://security-content/json --recursive --exclude "*" --include "*.json"
- name: Security Content API Smoke Test
run: |
API_URL='https://content.splunkresearch.com/detections'
API_STATUS=$(curl -s -o /dev/null -w "%{http_code}" $API_URL)
echo "Security Content API Status: $API_STATUS"
if [ "$API_STATUS" != "200" ]; then
echo "Error [Security Content API status: $API_STATUS]"
exit 1
fi
.github/workflows/detection-smoketesting.yml
-48
View File
@@ -1,48 +0,0 @@
name: detection-smoketesting
on:
schedule:
- cron: "44 4 * * *"
jobs:
docker-detection-smoketest:
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@v2
#with:
# ref: develop
- uses: actions/setup-python@v2
with:
python-version: "3.9" #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
architecture: "x64" # optional x64 or x86. Defaults to x64 if not specified
cache: "pip"
- name: Install Python Dependencies
run: |
python -m venv .venv
source .venv/bin/activate
python -m pip install wheel
python -m pip install -r requirements.txt
- name: Run the Smoketesting
run: |
source .venv/bin/activate
cd bin/docker_detection_tester
python detection_testing_execution.py run --branch develop --mode smoketest --config_file test_config_github_actions.json --num_containers 1
# Summarize all results in a different step so they are easy to read/jump to
- name: Run the Smoketesting
run: |
source .venv/bin/activate
cd bin/docker_detection_tester
python summarize_json.py -o test_results/summary_smoketest.json -f test_results/summary.json --smoketest
# Upload Results even on failure. Results are even more important in the event of a failure
- name: Upload Test Results Files
uses: actions/upload-artifact@v2
if: always()
with:
name: smoketest_results
path: |
bin/docker_detection_tester/test_results/summary.json
bin/docker_detection_tester/test_results/summary_smoketest.json
.github/workflows/detection-testing.yml
+294 -294
View File
@@ -1,345 +1,345 @@
name: detection-testing
on:
push:
pull_request:
types: [opened, reopened]
schedule:
- cron: "44 4 * * *"
jobs:
# name: detection-testing
# on:
# push:
# pull_request:
# types: [opened, reopened]
# schedule:
# - cron: "44 4 * * *"
# jobs:
validate-tag-if-present:
runs-on: ubuntu-latest
# validate-tag-if-present:
# runs-on: ubuntu-latest
steps:
- name: TAGGED, Validate that the tag is in the correct format
# steps:
# - name: TAGGED, Validate that the tag is in the correct format
run: |
echo "The GITHUB_REF: $GITHUB_REF"
#First check to see if the release is a tag
if [[ $GITHUB_REF =~ refs/tags/* ]]; then
#Yes, this is a tag, so we need to test to make sure that the tag
#is in the correct format (like v1.10.20)
if [[ $GITHUB_REF =~ refs/tags/v[0-9]+.[0-9]+.[0-9]+ ]]; then
echo "PASS: Tagged release with good format"
exit 0
else
echo "FAIL: Tagged release with bad format"
exit 1
fi
else
echo "PASS: Not a tagged release"
exit 0
fi
# run: |
# echo "The GITHUB_REF: $GITHUB_REF"
# #First check to see if the release is a tag
# if [[ $GITHUB_REF =~ refs/tags/* ]]; then
# #Yes, this is a tag, so we need to test to make sure that the tag
# #is in the correct format (like v1.10.20)
# if [[ $GITHUB_REF =~ refs/tags/v[0-9]+.[0-9]+.[0-9]+ ]]; then
# echo "PASS: Tagged release with good format"
# exit 0
# else
# echo "FAIL: Tagged release with bad format"
# exit 1
# fi
# else
# echo "PASS: Not a tagged release"
# exit 0
# fi
quit-for-dependabot:
runs-on: ubuntu-latest
if: github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]'
steps:
- name: "Placeholder"
run: |
echo "yes it ran"
# quit-for-dependabot:
# runs-on: ubuntu-latest
# if: github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]'
# steps:
# - name: "Placeholder"
# run: |
# echo "yes it ran"
docker-detection-testing-setup:
runs-on: ubuntu-latest
if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job
needs: [validate-tag-if-present, quit-for-dependabot]
steps:
- name: Get branch and PR required for detection testing main.py
id: vars
run: |
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
# docker-detection-testing-setup:
# runs-on: ubuntu-latest
# if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job
# needs: [validate-tag-if-present, quit-for-dependabot]
# steps:
# - name: Get branch and PR required for detection testing main.py
# id: vars
# run: |
# echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
- name: Checkout Repo
uses: actions/checkout@v2
#with:
# ref: develop
# - name: Checkout Repo
# uses: actions/checkout@v2
# #with:
# # ref: develop
- uses: actions/setup-python@v2
with:
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
cache: 'pip'
# - uses: actions/setup-python@v2
# with:
# python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
# architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
# cache: 'pip'
- name: Install Python Dependencies
run: |
python -m venv .venv
source .venv/bin/activate
python -m pip install wheel
python -m pip install -r requirements.txt
# - name: Install Python Dependencies
# run: |
# python -m venv .venv
# source .venv/bin/activate
# python -m pip install wheel
# python -m pip install -r requirements.txt
- name: Run the CI
run: |
source .venv/bin/activate
cd bin/docker_detection_tester
echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]"
echo "github.event.pull_request.number : [${{ github.event.pull_request.number }}]"
echo "steps.vars.outputs.branch : [${{ steps.vars.outputs.branch }}]"
echo "github.event.pull_request.head.ref : [${{ github.event.pull_request.head.ref }}]"
echo "github.event_name : [${{ github.event_name }}]"
# - name: Run the CI
# run: |
# source .venv/bin/activate
# cd bin/docker_detection_tester
# echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]"
# echo "github.event.pull_request.number : [${{ github.event.pull_request.number }}]"
# echo "steps.vars.outputs.branch : [${{ steps.vars.outputs.branch }}]"
# echo "github.event.pull_request.head.ref : [${{ github.event.pull_request.head.ref }}]"
# echo "github.event_name : [${{ github.event_name }}]"
if [[ ${{ github.event_name }} == schedule ]]; then
# Note that scheduled actions ONLY run on the default branch, so it won't run on all other branches!
echo "Running a nightly test on all detections OR a commit was made directly to develop"
python detection_testing_execution.py run --branch develop --mode all --mock --config_file test_config_github_actions.json
elif [[ ! -z "${{ github.event.pull_request.head.ref }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then
echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
python detection_testing_execution.py run --branch ${{ github.event.pull_request.head.ref }} --pr_number ${{ github.event.pull_request.number }} --mode changes --mock --config_file test_config_github_actions.json
else
echo "Push from branch [${{ steps.vars.outputs.branch }}]"
python detection_testing_execution.py run --branch ${{ steps.vars.outputs.branch }} --mode changes --mock --config_file test_config_github_actions.json
fi
# if [[ ${{ github.event_name }} == schedule ]]; then
# # Note that scheduled actions ONLY run on the default branch, so it won't run on all other branches!
# echo "Running a nightly test on all detections OR a commit was made directly to develop"
# python detection_testing_execution.py run --branch develop --mode all --mock --config_file test_config_github_actions.json
# elif [[ ! -z "${{ github.event.pull_request.head.ref }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then
# echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
# python detection_testing_execution.py run --branch ${{ github.event.pull_request.head.ref }} --pr_number ${{ github.event.pull_request.number }} --mode changes --mock --config_file test_config_github_actions.json
# else
# echo "Push from branch [${{ steps.vars.outputs.branch }}]"
# python detection_testing_execution.py run --branch ${{ steps.vars.outputs.branch }} --mode changes --mock --config_file test_config_github_actions.json
# fi
mv *-test-run.json replicate_test.json
- name: Upload Test Results Files
uses: actions/upload-artifact@v2
with:
name: testing-results-config
path: |
bin/docker_detection_tester/prior_config/apps/DA-ESS-ContentUpdate-latest.tar.gz
bin/docker_detection_tester/prior_config/config_tests_0.json
bin/docker_detection_tester/prior_config/config_tests_1.json
bin/docker_detection_tester/prior_config/config_tests_2.json
bin/docker_detection_tester/prior_config/config_tests_3.json
bin/docker_detection_tester/prior_config/config_tests_4.json
bin/docker_detection_tester/prior_config/config_tests_5.json
bin/docker_detection_tester/prior_config/config_tests_6.json
bin/docker_detection_tester/prior_config/config_tests_7.json
bin/docker_detection_tester/prior_config/config_tests_8.json
bin/docker_detection_tester/prior_config/config_tests_9.json
# mv *-test-run.json replicate_test.json
# - name: Upload Test Results Files
# uses: actions/upload-artifact@v2
# with:
# name: testing-results-config
# path: |
# bin/docker_detection_tester/prior_config/apps/DA-ESS-ContentUpdate-latest.tar.gz
# bin/docker_detection_tester/prior_config/config_tests_0.json
# bin/docker_detection_tester/prior_config/config_tests_1.json
# bin/docker_detection_tester/prior_config/config_tests_2.json
# bin/docker_detection_tester/prior_config/config_tests_3.json
# bin/docker_detection_tester/prior_config/config_tests_4.json
# bin/docker_detection_tester/prior_config/config_tests_5.json
# bin/docker_detection_tester/prior_config/config_tests_6.json
# bin/docker_detection_tester/prior_config/config_tests_7.json
# bin/docker_detection_tester/prior_config/config_tests_8.json
# bin/docker_detection_tester/prior_config/config_tests_9.json
- name: Upload File to Enable Replication of the Test at a Different Time or Place
uses: actions/upload-artifact@v2
with:
name: replicate_test
path: |
bin/docker_detection_tester/replicate_test.json
# - name: Upload File to Enable Replication of the Test at a Different Time or Place
# uses: actions/upload-artifact@v2
# with:
# name: replicate_test
# path: |
# bin/docker_detection_tester/replicate_test.json
docker-detection-testing-execution:
runs-on: ubuntu-latest
if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job
needs: [docker-detection-testing-setup]
strategy:
matrix:
manifest_filename: ["config_tests_0.json",
"config_tests_1.json",
"config_tests_2.json",
"config_tests_3.json",
"config_tests_4.json",
"config_tests_5.json",
"config_tests_6.json",
"config_tests_7.json",
"config_tests_8.json",
"config_tests_9.json"]
steps:
- name: Get branch and PR required for detection testing main.py
id: vars
run: |
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
# docker-detection-testing-execution:
# runs-on: ubuntu-latest
# if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job
# needs: [docker-detection-testing-setup]
# strategy:
# matrix:
# manifest_filename: ["config_tests_0.json",
# "config_tests_1.json",
# "config_tests_2.json",
# "config_tests_3.json",
# "config_tests_4.json",
# "config_tests_5.json",
# "config_tests_6.json",
# "config_tests_7.json",
# "config_tests_8.json",
# "config_tests_9.json"]
# steps:
# - name: Get branch and PR required for detection testing main.py
# id: vars
# run: |
# echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
- name: Checkout Repo
uses: actions/checkout@v2
#with:
# ref: develop
# - name: Checkout Repo
# uses: actions/checkout@v2
# #with:
# # ref: develop
- name: Download artifacts
uses: actions/download-artifact@v2
with:
name: testing-results-config
path: bin/docker_detection_tester/prior_config
# - name: Download artifacts
# uses: actions/download-artifact@v2
# with:
# name: testing-results-config
# path: bin/docker_detection_tester/prior_config
- uses: actions/setup-python@v2
with:
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
cache: 'pip'
# - uses: actions/setup-python@v2
# with:
# python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
# architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
# cache: 'pip'
- name: Install Python Dependencies
run: |
python -m venv .venv
source .venv/bin/activate
python -m pip install wheel
python -m pip install -r requirements.txt
# - name: Install Python Dependencies
# run: |
# python -m venv .venv
# source .venv/bin/activate
# python -m pip install wheel
# python -m pip install -r requirements.txt
- name: Run the CI
run: |
source .venv/bin/activate
cd bin/docker_detection_tester
# - name: Run the CI
# run: |
# source .venv/bin/activate
# cd bin/docker_detection_tester
python detection_testing_execution.py run -c prior_config/${{ matrix.manifest_filename}}
# python detection_testing_execution.py run -c prior_config/${{ matrix.manifest_filename}}
- name: Upload Test Results Files
uses: actions/upload-artifact@v2
with:
name: ${{ matrix.manifest_filename}}.results
path: |
bin/docker_detection_tester/test_results/success.csv
bin/docker_detection_tester/test_results/error.csv
bin/docker_detection_tester/test_results/failure.csv
bin/docker_detection_tester/test_results/combined.csv
bin/docker_detection_tester/test_results/success.json
bin/docker_detection_tester/test_results/error.json
bin/docker_detection_tester/test_results/failure.json
bin/docker_detection_tester/test_results/combined.json
# - name: Upload Test Results Files
# uses: actions/upload-artifact@v2
# with:
# name: ${{ matrix.manifest_filename}}.results
# path: |
# bin/docker_detection_tester/test_results/success.csv
# bin/docker_detection_tester/test_results/error.csv
# bin/docker_detection_tester/test_results/failure.csv
# bin/docker_detection_tester/test_results/combined.csv
# bin/docker_detection_tester/test_results/success.json
# bin/docker_detection_tester/test_results/error.json
# bin/docker_detection_tester/test_results/failure.json
# bin/docker_detection_tester/test_results/combined.json
bin/docker_detection_tester/test_results/summary.json
# bin/docker_detection_tester/test_results/summary.json
docker-detection-testing-execution-merge-results:
runs-on: ubuntu-latest
if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job
needs: [docker-detection-testing-setup, docker-detection-testing-execution]
# docker-detection-testing-execution-merge-results:
# runs-on: ubuntu-latest
# if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job
# needs: [docker-detection-testing-setup, docker-detection-testing-execution]
steps:
- name: Get branch and PR required for detection testing main.py
id: vars
run: |
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
# steps:
# - name: Get branch and PR required for detection testing main.py
# id: vars
# run: |
# echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
- name: Checkout Repo
uses: actions/checkout@v2
#with:
# ref: develop
# - name: Checkout Repo
# uses: actions/checkout@v2
# #with:
# # ref: develop
- name: Download artifacts
uses: actions/download-artifact@v2
with:
name: config_tests_0.json.results
path: bin/docker_detection_tester/results_0
- name: Download artifacts
uses: actions/download-artifact@v2
with:
name: config_tests_1.json.results
path: bin/docker_detection_tester/results_1
- name: Download artifacts
uses: actions/download-artifact@v2
with:
name: config_tests_2.json.results
path: bin/docker_detection_tester/results_2
- name: Download artifacts
uses: actions/download-artifact@v2
with:
name: config_tests_3.json.results
path: bin/docker_detection_tester/results_3
- name: Download artifacts
uses: actions/download-artifact@v2
with:
name: config_tests_4.json.results
path: bin/docker_detection_tester/results_4
- name: Download artifacts
uses: actions/download-artifact@v2
with:
name: config_tests_5.json.results
path: bin/docker_detection_tester/results_5
- name: Download artifacts
uses: actions/download-artifact@v2
with:
name: config_tests_6.json.results
path: bin/docker_detection_tester/results_6
- name: Download artifacts
uses: actions/download-artifact@v2
with:
name: config_tests_7.json.results
path: bin/docker_detection_tester/results_7
- name: Download artifacts
uses: actions/download-artifact@v2
with:
name: config_tests_8.json.results
path: bin/docker_detection_tester/results_8
- name: Download artifacts
uses: actions/download-artifact@v2
with:
name: config_tests_9.json.results
path: bin/docker_detection_tester/results_9
# - name: Download artifacts
# uses: actions/download-artifact@v2
# with:
# name: config_tests_0.json.results
# path: bin/docker_detection_tester/results_0
# - name: Download artifacts
# uses: actions/download-artifact@v2
# with:
# name: config_tests_1.json.results
# path: bin/docker_detection_tester/results_1
# - name: Download artifacts
# uses: actions/download-artifact@v2
# with:
# name: config_tests_2.json.results
# path: bin/docker_detection_tester/results_2
# - name: Download artifacts
# uses: actions/download-artifact@v2
# with:
# name: config_tests_3.json.results
# path: bin/docker_detection_tester/results_3
# - name: Download artifacts
# uses: actions/download-artifact@v2
# with:
# name: config_tests_4.json.results
# path: bin/docker_detection_tester/results_4
# - name: Download artifacts
# uses: actions/download-artifact@v2
# with:
# name: config_tests_5.json.results
# path: bin/docker_detection_tester/results_5
# - name: Download artifacts
# uses: actions/download-artifact@v2
# with:
# name: config_tests_6.json.results
# path: bin/docker_detection_tester/results_6
# - name: Download artifacts
# uses: actions/download-artifact@v2
# with:
# name: config_tests_7.json.results
# path: bin/docker_detection_tester/results_7
# - name: Download artifacts
# uses: actions/download-artifact@v2
# with:
# name: config_tests_8.json.results
# path: bin/docker_detection_tester/results_8
# - name: Download artifacts
# uses: actions/download-artifact@v2
# with:
# name: config_tests_9.json.results
# path: bin/docker_detection_tester/results_9
- uses: actions/setup-python@v2
with:
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
cache: 'pip'
# - uses: actions/setup-python@v2
# with:
# python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
# architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
# cache: 'pip'
- name: Install Python Dependencies
run: |
python -m venv .venv
source .venv/bin/activate
python -m pip install wheel
python -m pip install -r requirements.txt
# - name: Install Python Dependencies
# run: |
# python -m venv .venv
# source .venv/bin/activate
# python -m pip install wheel
# python -m pip install -r requirements.txt
- name: Merge Detections into single File
run: |
source .venv/bin/activate
cd bin/docker_detection_tester
python summarize_json.py --files results_*/summary.json --output_filename summary_test_results.json
# - name: Merge Detections into single File
# run: |
# source .venv/bin/activate
# cd bin/docker_detection_tester
# python summarize_json.py --files results_*/summary.json --output_filename summary_test_results.json
- name: Upload Summary Test Results JSON
uses: actions/upload-artifact@v2
if: always()
with:
name: SummaryTestResults
path: |
bin/docker_detection_tester/summary_test_results.json
# - name: Upload Summary Test Results JSON
# uses: actions/upload-artifact@v2
# if: always()
# with:
# name: SummaryTestResults
# path: |
# bin/docker_detection_tester/summary_test_results.json
- name: Upload Failures Manifest on Failure
uses: actions/upload-artifact@v2
if: failure()
with:
name: DetectionFailureManifest
path: |
bin/docker_detection_tester/detection_failure_manifest.json
# - name: Upload Failures Manifest on Failure
# uses: actions/upload-artifact@v2
# if: failure()
# with:
# name: DetectionFailureManifest
# path: |
# bin/docker_detection_tester/detection_failure_manifest.json
#Always clean these up, they make the output messy
- name: Clean up intermediate Files
uses: geekyeggo/delete-artifact@v1
if: always()
with:
name: |
config_tests_0.json.results
config_tests_1.json.results
config_tests_2.json.results
config_tests_3.json.results
config_tests_4.json.results
config_tests_5.json.results
config_tests_6.json.results
config_tests_7.json.results
config_tests_8.json.results
config_tests_9.json.results
# #Always clean these up, they make the output messy
# - name: Clean up intermediate Files
# uses: geekyeggo/delete-artifact@v1
# if: always()
# with:
# name: |
# config_tests_0.json.results
# config_tests_1.json.results
# config_tests_2.json.results
# config_tests_3.json.results
# config_tests_4.json.results
# config_tests_5.json.results
# config_tests_6.json.results
# config_tests_7.json.results
# config_tests_8.json.results
# config_tests_9.json.results
- name: Log in to S3 for Artifact Uploads
if: ${{ github.event_name == 'schedule' }}
uses: aws-actions/configure-aws-credentials@v1
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
# - name: Log in to S3 for Artifact Uploads
# if: ${{ github.event_name == 'schedule' }}
# uses: aws-actions/configure-aws-credentials@v1
# with:
# aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
# aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-west-2
# aws-region: us-west-2
- name: Upload S3 Badge and Summary Artifacts for Nightly Scheduled Run
if: ${{ github.event_name == 'schedule' }}
run: |
cd bin/docker_detection_tester
python generate_detection_coverage_badge.py --input_summary_file summary_test_results.json --output_badge_file detection_coverage.svg --badge_string "Pass Rate"
# - name: Upload S3 Badge and Summary Artifacts for Nightly Scheduled Run
# if: ${{ github.event_name == 'schedule' }}
# run: |
# cd bin/docker_detection_tester
# python generate_detection_coverage_badge.py --input_summary_file summary_test_results.json --output_badge_file detection_coverage.svg --badge_string "Pass Rate"
#Upload artifact (summary test results)
aws s3 cp summary_test_results.json s3://security-content/reporting/summary_test_results.json
# #Upload artifact (summary test results)
# aws s3 cp summary_test_results.json s3://security-content/reporting/summary_test_results.json
#Since these reside in a public bucket, no need to explicitly mark as public
# make the file public since it is not by default
#aws s3api put-object-acl --bucket security-content --key reporting/summary_test_results.json --acl public-read
# #Since these reside in a public bucket, no need to explicitly mark as public
# # make the file public since it is not by default
# #aws s3api put-object-acl --bucket security-content --key reporting/summary_test_results.json --acl public-read
#Upload artifact (test results coverage badge)
aws s3 cp detection_coverage.svg s3://security-content/reporting/detection_coverage.svg
# #Upload artifact (test results coverage badge)
# aws s3 cp detection_coverage.svg s3://security-content/reporting/detection_coverage.svg
#Since these reside in a public bucket, no need to explicitly mark as public
# make the file public since it is not by default
#aws s3api put-object-acl --bucket security-content --key reporting/detection_coverage.svg --acl public-read
# #Since these reside in a public bucket, no need to explicitly mark as public
# # make the file public since it is not by default
# #aws s3api put-object-acl --bucket security-content --key reporting/detection_coverage.svg --acl public-read
.github/workflows/validate-and-build.yml
+54
View File
@@ -0,0 +1,54 @@
name: validate-and-build
on:
push:
pull_request:
types: [opened, reopened]
jobs:
validate-and-build:
#Note that the CircleCI job used a Container. The way to do this with Github Actions
#is to first start up a Virtual Machine, then we can by following:
# https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer
runs-on: ubuntu-latest
steps:
- name: Check out the repository code
uses: actions/checkout@v3
- uses: actions/setup-python@v4
with:
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
- name: Install System Packages
run: |
sudo apt update -qq
sudo apt install jq -qq
- name: Install Python Dependencies and ContentCTL
run: |
pip3 install poetry
git submodule update --init contentctl
cd contentctl
git checkout main
poetry install
- name: content_ctl validate
run: |
cd contentctl
poetry run contentctl -p ../ validate
- name: contentctl generate
run: |
cd contentctl
poetry run contentctl -p ../ build
cd ..
mkdir artifacts
mv dist/DA-ESS-ContentUpdate-latest.tar.gz artifacts/
- name: store_artifacts
uses: actions/upload-artifact@v3
with:
name: content-latest
path: |
artifacts/DA-ESS-ContentUpdate-latest.tar.gz
.gitlab-ci.yml
+10 -1
View File
@@ -1,20 +1,29 @@
default:
image: docker-hub.repo.splunkdev.net/python:3.9
variables:
SKIP_DOWNSTREAM_TESTING:
value: "False"
description: "If true, downstream testing will be suppressed (useful for debugging or forcing a release in an emergency)."
stages:
- validate
- generate
- app_inspect
- test
- release
include:
- local: "pipeline/.validate.yml"
- local: "pipeline/.generate.yml"
- local: "pipeline/.test.yml"
- local: "pipeline/.app_inspect.yml"
- local: "pipeline/.release.yml"
- local: "pipeline/.post.yml"
workflow:
rules:
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
- if: $CI_COMMIT_TAG
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
- if: $CI_COMMIT_BRANCH =~ /^release_v[0-9]+\.[0-9]+\.[0-9]+$/
contentctl
+1 -1
Submodule contentctl updated: 48c1c275e3...5fd8164fa0
contentctl.py
+5
View File
@@ -1,3 +1,8 @@
#### DEPRECATED
### This code is deprecated : use the submodule contentctl and these functionalities are available with that application
###
import sys
import argparse
import os
contentctl.yml
+2 -2
View File
@@ -5,8 +5,8 @@ build:
name: DA-ESS-ContentUpdate
path_root: dist
prefix: ESCU
build: 004150
version: 4.15.0
build: 004160
version: 4.16.0
label: ES Content Updates
author_name: Splunk Threat Research Team
author_email: research@splunk.com
contentctl_test.yml
+184 -13
View File
@@ -1,9 +1,10 @@
version_control_config: {}
version_control_config:
target_branch: develop
infrastructure_config:
infrastructure_type: container
full_image_path: registry.hub.docker.com/splunk/splunk:latest
post_test_behavior: always_pause
mode: all
post_test_behavior: pause_on_failure
mode: changes
detections_list: null
splunkbase_username: null
splunkbase_password: null
@@ -18,23 +19,33 @@ apps:
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 742
- uid: 9999
appid: Splunk_TA_windows
title: Splunk Add-on for Microsoft Windows
description: null
release: 8.5.0
release: 8.5.0_patched
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850_PATCHED.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 742
appid: SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS
title: Splunk Add-on for Microsoft Windows
description: null
release: 8.8.0
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_880.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 5709
appid: Splunk_TA_microsoft_sysmon
title: Splunk Add-on for Sysmon
description: null
release: 3.0.0
release: 3.1.0
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_310.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
@@ -42,14 +53,174 @@ apps:
appid: Splunk_TA_nix
title: Splunk Add-on for Unix and Linux
description: null
release: 8.7.0
release: 9.0.0
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_860.tgz
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_900.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 5579
appid: Splunk_TA_CrowdStrike_FDR
title: Splunk Add-on for CrowdStrike FDR
description: null
release: 1.4.0
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_140.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 3185
appid: SPLUNK_TA_FOR_IIS
title: Splunk Add-on for Microsoft IIS
description: null
release: 1.2.0
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_120.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 4242
appid: SPLUNK_TA_FOR_SURICATA
title: TA for Suricata
description: null
release: 2.3.4
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-suricata_234.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 5466
appid: SPLUNK_TA_FOR_ZEEK
title: TA for Zeek
description: null
release: 1.0.5
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 3258
appid: SPLUNK_ADD_ON_FOR_NGINX
title: Splunk Add-on for NGINX
description: null
release: 3.2.1
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_321.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 5238
appid: SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS
title: Splunk Add-on for Stream Forwarders
description: null
release: 8.1.1
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_811.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 5234
appid: SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA
title: Splunk Add-on for Stream Wire Data
description: null
release: 8.1.1
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_811.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 2757
appid: PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK
title: Palo Alto Networks Add-on for Splunk
description: null
release: 8.1.0
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_810.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 3865
appid: TA-Zscaler_CIM
title: Zscaler Technical Add-On for Splunk
description: null
release: 4.0.3
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/zscaler-technical-add-on-for-splunk_403.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 3719
appid: SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE
title: Splunk Add-on for Amazon Kinesis Firehose
description: null
release: 1.3.2
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 1876
appid: Splunk_TA_aws
title: Splunk Add-on for AWS
description: null
release: 7.2.0
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-web-services-aws_720.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 3088
appid: SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM
title: Splunk Add-on for Google Cloud Platform
description: null
release: 4.3.0
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_430.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 5556
appid: SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE
title: Splunk Add-on for Google Workspace
description: null
release: 2.6.0
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_260.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 3110
appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES
title: Splunk Add-on for Microsoft Cloud Services
description: null
release: 5.2.1
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_521.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 4055
appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365
title: Splunk Add-on for Microsoft Office 365
description: null
release: 4.3.0
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_430.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 2890
appid: SPLUNK_MACHINE_LEARNING_TOOLKIT
title: Splunk Machine Learning Toolkit
description: null
release: 5.4.1
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_541.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
- uid: 2734
appid: utbox
appid: URL_TOOLBOX
title: URL Toolbox
description: null
release: 1.9.2
@@ -62,9 +233,9 @@ apps:
appid: Splunk_SA_CIM
title: Splunk Common Information Model (CIM)
description: null
release: 5.0.2
release: 5.2.0
local_path: null
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz
http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_520.tgz
splunkbase_path: null
environment_path: ENVIRONMENT_PATH_NOT_SET
force_local: false
force_local: false
detections/application/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml
+56
View File
@@ -0,0 +1,56 @@
name: Splunk App for Lookup File Editing RCE via User XSLT
id: a053e6a6-2146-483a-9798-2d43652f3299
version: 1
date: '2023-11-16'
author: Rod Soto, Splunk
status: experimental
type: Hunting
data_source: []
description: This search provides information to investigate possible remote code execution exploitation via
user-supplied Extensible Stylesheet Language Transformations (XSLT), affecting Splunk versions 9.1.x.
Exploitation of this vulnerability by attackers requires that the Splunk App for Lookup File Editing
is, or was, installed.
search: '| rest splunk_server=local /services/data/lookup-table-files/
| fields title author disabled eai:acl.app eai:acl.owner eai:acl.sharing eai:appName eai:data
| `splunk_app_for_lookup_file_editing_rce_via_user_xslt_filter`'
how_to_implement: Because there is no way to detect the payload, this search only provides the ability to monitor
the creation of lookups which are the base of this exploit. An operator must then investigate suspicious lookups.
This search requires ability to perform REST queries. Note that if the Splunk App for Lookup File Editing is not,
or was not, installed in the Splunk environment then it is not necessary to run the search as the enviornment
was not vulnerable.
known_false_positives: This search will provide information for investigation and hunting of lookup creation via
user-supplied XSLT which may be indications of possible exploitation. There will be false positives as it is
not possible to detect the payload executed via this exploit.
references:
- https://advisory.splunk.com/advisories
cve:
- CVE-2023-46214
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: endpoint
confidence: 2
impact: 50
message: Please review $eai:acl.app$ for possible malicious lookups
mitre_attack_id:
- T1210
observable:
- name: eai:acl.app
type: Other
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 1
required_fields:
- title
- author
- disabled
- ea:acl.app
- eai:acl.owner
- eai:acl.sharing
- eai:appName
- eai:data
security_domain: endpoint
detections/application/splunk_xss_in_highlighted_json_events.yml
+56
View File
@@ -0,0 +1,56 @@
name: Splunk XSS in Highlighted JSON Events
id: 1030bc63-0b37-4ac9-9ae0-9361c955a3cc
version: 1
date: '2023-11-16'
author: Rod Soto, Splunk
status: production
type: Hunting
data_source: []
description: This detection provides information about possible exploitation against affected versions of Splunk Enterprise 9.1.2.
The ability to view JSON logs in the web GUI may be abused by crafting a specific request, causing the execution of javascript
in script tags. This vulnerability can be used to execute javascript to access the API at the permission level of the
logged-in user. If user is admin it can be used to create an admin user, giving an attacker broad access to the Splunk Environment.
search: '`splunkd_ui` "/en-US/splunkd/__raw/servicesNS/nobody/search/authentication/users" status=201
| stats count min(_time) as firstTime max(_time) as lastTime by clientip, uri_path, method
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `splunk_xss_in_highlighted_json_events_filter`'
how_to_implement: This search only applies to web-GUI-enabled Splunk instances and operator must have access to internal indexes.
known_false_positives: This is a hunting search and will produce false positives as it is not possible to view contents of a request
payload. It shows the artifact resulting from a potential exploitation payload (the creation of a user with admin privileges).
references:
- https://advisory.splunk.com/advisories
cve:
- CVE-2023-46213
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: endpoint
confidence: 50
impact: 30
message: Possible XSS exploitation from $clientip$
mitre_attack_id:
- T1189
observable:
- name: clientip
type: IP Address
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 15
required_fields:
- clientip
- uri_path
- method
- status
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_in_highlighted_json_events_splunkd_ui_access.log
source: splunkd_ui_access.log
sourcetype: splunkd_ui_access
custom_index: _internal
detections/cloud/aws_ecr_container_scanning_findings_high.yml
+12 -17
View File
@@ -1,25 +1,16 @@
name: AWS ECR Container Scanning Findings High
id: 62721bd2-1d82-4623-b6e6-aac170014423
version: 1
date: '2022-06-21'
id: 30a0e9f8-f1dd-4f9d-8fc2-c622461d781c
version: 2
date: '2023-11-09'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: This search looks for AWS CloudTrail events from AWS Elastic Container
Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
with the results.
data_source: []
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
| spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
findings | spath input=findings| search severity=HIGH | rename name as finding_name,
description as finding_description, requestParameters.imageId.imageDigest as imageDigest,
requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description
| eval phase="release" | eval severity="high" | stats min(_time) as firstTime max(_time)
as lastTime by awsRegion, eventName, eventSource, imageDigest, image, userName,
src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `aws_ecr_container_scanning_findings_high_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
search: >-
`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings | search severity=HIGH | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository, userIdentity.principalId as user | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="high" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repository, user, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: unknown
references:
- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
@@ -29,7 +20,7 @@ tags:
asset_type: AWS Account
confidence: 100
impact: 70
message: Vulnerabilities with severity high found in image $image$
message: Vulnerabilities with severity high found in repository $repository$
mitre_attack_id:
- T1204.003
- T1204
@@ -38,6 +29,10 @@ tags:
type: User
role:
- Attacker
- name: repository
type: Other
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+11 -15
View File
@@ -1,23 +1,15 @@
name: AWS ECR Container Scanning Findings Low Informational Unknown
id: cbc95e44-7c22-443f-88fd-0424478f5589
version: 1
date: '2022-08-25'
version: 2
date: '2023-11-09'
author: Patrick Bareiss, Eric McGinnis Splunk
status: production
type: Hunting
type: Anomaly
description: This search looks for AWS CloudTrail events from AWS Elastic Container
Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
with the results.
data_source: []
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
| spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
findings | spath input=findings| search severity IN ("LOW", "INFORMATIONAL", "UNKNOWN")
| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest
as imageDigest, requestParameters.repositoryName as repositoryName | eval finding
= finding_name.", ".finding_description | eval phase="release" | eval severity="low"
| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName,
eventSource, imageDigest, repositoryName, userName, src_ip, finding, phase, severity
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_low_informational_unknown_filter`'
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity IN ("LOW", "INFORMATIONAL", "UNKNOWN") | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository, userIdentity.principalId as user | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="low" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repository, user, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_low_informational_unknown_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: unknown
@@ -27,9 +19,9 @@ tags:
analytic_story:
- Dev Sec Ops
asset_type: AWS Account
confidence: 70
confidence: 50
impact: 10
message: Vulnerabilities with severity high found in repository $repositoryName$
message: Vulnerabilities with severity $severity$ found in repository $repository$
mitre_attack_id:
- T1204.003
- T1204
@@ -38,6 +30,10 @@ tags:
type: User
role:
- Attacker
- name: repository
type: Other
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -52,7 +48,7 @@ tags:
- user
- userName
- src_ip
risk_score: 7
risk_score: 5
security_domain: network
tests:
- name: True Positive Test
detections/cloud/aws_ecr_container_scanning_findings_medium.yml
+9 -14
View File
@@ -1,7 +1,7 @@
name: AWS ECR Container Scanning Findings Medium
id: 0b80e2c8-c746-4ddb-89eb-9efd892220cf
version: 1
date: '2021-08-17'
version: 2
date: '2023-11-09'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
@@ -9,17 +9,8 @@ description: This search looks for AWS CloudTrail events from AWS Elastic Contai
Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
with the results.
data_source: []
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
| spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
findings | spath input=findings| search severity=MEDIUM | rename name as finding_name,
description as finding_description, requestParameters.imageId.imageDigest as imageDigest,
requestParameters.repositoryName as image | eval finding = finding_name.", ".finding_description
| eval phase="release" | eval severity="medium" | stats min(_time) as firstTime
max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image,
userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=MEDIUM | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository, userIdentity.principalId as user| eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="medium" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repository, user, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: unknown
references:
- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
@@ -29,7 +20,7 @@ tags:
asset_type: AWS Account
confidence: 70
impact: 30
message: Vulnerabilities with severity high found in image $image$
message: Vulnerabilities with severity $severity$ found in repository $repository$
mitre_attack_id:
- T1204.003
- T1204
@@ -38,6 +29,10 @@ tags:
type: User
role:
- Attacker
- name: repository
type: Other
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
+3 -8
View File
@@ -1,7 +1,7 @@
name: AWS ECR Container Upload Outside Business Hours
id: d4c4d4eb-3994-41ca-a25e-a82d64e125bb
version: 1
date: '2021-08-19'
version: 2
date: '2023-11-09'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
@@ -9,12 +9,7 @@ description: This search looks for AWS CloudTrail events from AWS Elastic Contai
Service (ECR). A upload of a new container is normally done during business hours.
When done outside business hours, we want to take a look into it.
data_source: []
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20
OR date_hour<8 OR date_wday=saturday OR date_wday=sunday | rename requestParameters.*
as * | rename repositoryName AS image | eval phase="release" | eval severity="medium"
| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName,
eventSource, user, userName, src_ip, imageTag, registryId, image, phase, severity
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_outside_business_hours_filter`'
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20 OR date_hour<8 OR date_wday=saturday OR date_wday=sunday | rename requestParameters.* as * | rename repositoryName AS repository | eval phase="release" | eval severity="medium" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId, repository, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_outside_business_hours_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with AWS CloudTrail logs.
known_false_positives: When your development is spreaded in different time zones,
detections/cloud/azure_ad_block_user_consent_for_risky_apps_disabled.yml
+62
View File
@@ -0,0 +1,62 @@
name: Azure AD Block User Consent For Risky Apps Disabled
id: 875de3d7-09bc-4916-8c0a-0929f4ced3d8
version: 1
date: '2023-10-26'
author: Mauricio Velazco, Splunk
status: production
type: TTP
data_source: []
description: This analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. This setting, when enabled, prevents regular users from granting consent to potentially malicious OAuth applications, requiring an administrative step-up for consent instead. Disabling this feature could expose the organization to OAuth phishing threats.The detection operates by monitoring Azure Active Directory logs for events where the "Update authorization policy" operation is performed. It specifically looks for changes to the "AllowUserConsentForRiskyApps" setting, identifying instances where this setting is switched to "true," effectively disabling the risk-based step-up consent. Monitoring for changes to critical security settings like the "risk-based step-up consent" is vital for maintaining the integrity of an organization's security posture. Disabling this feature can make the environment more susceptible to OAuth phishing attacks, where attackers trick users into granting permissions to malicious applications. Identifying when this setting is disabled can help blue teams to quickly respond, investigate, and potentially uncover targeted phishing campaigns against their users. If an attacker successfully disables the "risk-based step-up consent" and subsequently launches an OAuth phishing campaign, they could gain unauthorized access to user data and other sensitive information within the M365 environment. This could lead to data breaches, unauthorized access to emails, and potentially further compromise within the organization
search: >-
`azure_monitor_aad` operationName="Update authorization policy"
| rename properties.* as *
| eval index_number = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "AllowUserConsentForRiskyApps") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "AllowUserConsentForRiskyApps"), -1)
| search index_number >= 0
| eval AllowUserConsentForRiskyApps = mvindex('targetResources{}.modifiedProperties{}.newValue',index_number)
| search AllowUserConsentForRiskyApps = "[true]"
| stats count min(_time) as firstTime max(_time) as lastTime by user, src_ip, operationName, AllowUserConsentForRiskyApps
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `azure_ad_block_user_consent_for_risky_apps_disabled_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: Legitimate changes to the 'risk-based step-up consent' setting by administrators, perhaps as part of a policy update or security assessment, may trigger this alert, necessitating verification of the change's intent and authorization
references:
- https://attack.mitre.org/techniques/T1562/
- https://goodworkaround.com/2020/10/19/a-look-behind-the-azure-ad-permission-classifications-preview/
- https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-risk-based-step-up-consent
- https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
tags:
analytic_story:
- Azure Active Directory Account Takeover
asset_type: Azure AD
confidence: 50
impact: 60
message: User $user$ disabled the BlockUserConsentForRiskyApps Azure AD setting.
mitre_attack_id:
- T1562
observable:
- name: user
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 30
required_fields:
- _time
- operationName
- properties.targetResources{}.modifiedProperties{}.displayName
- properties.targetResources{}.modifiedProperties{}.newValue
- user
- src_ip
security_domain: identity
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562/azuread_disable_blockconsent_for_riskapps/azuread_disable_blockconsent_for_riskapps.log
source: Azure Ad
sourcetype: azure:monitor:aad
detections/cloud/azure_ad_device_code_authentication.yml
+74
View File
@@ -0,0 +1,74 @@
name: Azure AD Device Code Authentication
id: d68d8732-6f7e-4ee5-a6eb-737f2b990b91
version: 1
date: '2023-08-03'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
data_source: []
description: The following analytic identifies the execution of the Azure Device Code Phishing attack,
which can lead to Azure Account Take-Over (ATO). The detection leverages Azure AD logs specifically
focusing on authentication requests to identify the attack. This technique involves creating malicious
infrastructure, bypassing Multi-Factor Authentication (MFA), and bypassing Conditional Access Policies (CAPs).
The attack aims to compromise users by sending them phishing emails from attacker-controlled domains and trick
the victims into performing OAuth 2.0 device authentication. A successful execution of this attack can result
in adversaries gaining unauthorized access to Azure AD, Exchange mailboxes, and the target's Outlook Web Application (OWA).
This attack technique was detailed by security researchers including Bobby Cooke, Stephan Borosh, and others.
It's crucial for organizations to be aware of this threat, as it can lead to unauthorized access and potential data breaches.
search: '`azure_monitor_aad` category=SignInLogs "properties.authenticationProtocol"=deviceCode
| rename properties.* as *
| stats count min(_time) as firstTime max(_time) as lastTime by user src_ip, appDisplayName, userAgent
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `azure_ad_device_code_authentication_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
known_false_positives: In most organizations, device code authentication will be used to access common Microsoft service but it may be legitimate for others. Filter as needed.
references:
- https://attack.mitre.org/techniques/T1528
- https://github.com/rvrsh3ll/TokenTactics
- https://embracethered.com/blog/posts/2022/device-code-phishing/
- https://0xboku.com/2021/07/12/ArtOfDeviceCodePhish.html
- https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code
tags:
analytic_story:
- Azure Active Directory Account Takeover
asset_type: Azure AD
confidence: 50
impact: 70
message: Device code requested for $user$ from $src_ip$
mitre_attack_id:
- T1528
- T1566
- T1566.002
observable:
- name: user
type: User
role:
- Victim
- name: src_ip
type: IP Address
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 35
required_fields:
- _time
- category
- user
- properties.authenticationProtocol
- properties.ipAddress
- properties.status.additionalDetails
- properties.appDisplayName
- properties.userAgent
security_domain: identity
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/device_code_authentication/azure-audit.log
source: Azure AD
sourcetype: azure:monitor:aad
detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml
+60
View File
@@ -0,0 +1,60 @@
name: Azure AD Multi-Source Failed Authentications Spike
id: 116e11a9-63ea-41eb-a66a-6a13bdc7d2c7
version: 1
date: '2023-11-08'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
data_source: []
description: This analytic detects potential distributed password spraying attacks within an Azure AD environment. It identifies a notable increase in failed authentication attempts across a variety of unique user-and-IP address combinations, originating from multiple source IP addresses and countries, and employing different user agents. Such patterns suggest an adversary's attempt to bypass security controls by using a range of IP addresses to test commonly used passwords against numerous user accounts. The detection scrutinizes SignInLogs from Azure AD logs, particularly focusing on events with error code 50126, which signals a failed authentication due to incorrect credentials. By collating data over a five-minute interval, the analytic computes the distinct counts of user-and-IP combinations, unique users, source IPs, and countries. It then applies a set of thresholds to these metrics to pinpoint unusual activities that could indicate a coordinated attack effort. The thresholds set within the analytic (such as unique IPs, unique users, etc.) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Recognizing this behavior is vital for security operations centers (SOCs) as distributed password spraying represents a more complex form of traditional password spraying. Attackers distribute the source of their attempts to evade detection mechanisms that typically monitor for single-source IP anomalies. Prompt detection of such distributed activities is essential to thwart unauthorized access attempts, prevent account compromises, and mitigate the risk of further malicious activities within the organization's network. A true positive alert from this analytic suggests an active distributed password spraying attack against the organization's Azure AD tenant. A successful attack could result in unauthorized access, particularly to accounts with elevated privileges, leading to data breaches, privilege escalation, persistent threats, and lateral movement within the organization's infrastructure.
search: ' `azure_monitor_aad` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
| rename properties.* as *
| bucket span=5m _time
| eval uniqueIPUserCombo = src_ip . "-" . user
| stats dc(uniqueIPUserCombo) as uniqueIpUserCombinations, dc(user) as uniqueUsers, dc(src_ip) as uniqueIPs, dc(location.countryOrRegion) as uniqueCountries values(user) as users, values(src_ip) as ips, values(user_agent) as user_agents, values(location.countryOrRegion) as countries by _time
| where uniqueIpUserCombinations > 20 AND uniqueUsers > 20 AND uniqueIPs > 20
| `azure_ad_multi_source_failed_authentications_spike_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
The thresholds set within the analytic (such as unique IPs, unique users, etc.) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment.
known_false_positives: This detection may yield false positives in scenarios where legitimate bulk sign-in activities occur, such as during company-wide system updates or when users are accessing resources from varying locations in a short time frame, such as in the case of VPNs or cloud services that rotate IP addresses. Filter as needed.
references:
- https://attack.mitre.org/techniques/T1110/003/
- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
- https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
tags:
analytic_story:
- Azure Active Directory Account Takeover
asset_type: Azure AD
atomic_guid: []
confidence: 60
impact: 70
message: An anomalous multi source authentication spike ocurred at $_time$
mitre_attack_id:
- T1586
- T1586.003
- T1110
- T1110.003
- T1110.004
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 42
required_fields:
- _time
- category
- properties.authenticationDetails{}.succeeded
- properties.location.countryOrRegion
- user_agent
- src_ip
- user
security_domain: identity
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azure_ad_distributed_spray/azure_ad_distributed_spray.log
source: Azure AD
sourcetype: azure:monitor:aad
detections/cloud/azure_ad_multiple_appids_and_useragents_authentication_spike.yml
+59
View File
@@ -0,0 +1,59 @@
name: Azure AD Multiple AppIDs and UserAgents Authentication Spike
id: 5d8bb1f0-f65a-4b4e-af2e-fcdb88276314
version: 1
date: '2023-10-25'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
data_source: []
description: This analytic is crafted to identify unusual and potentially malicious authentication activity within an Azure AD environment. It triggers when a single user account is involved in more than 8 authentication attempts, using 3 or more unique application IDs and more than 5 unique user agents within a short timeframe. This pattern is atypical for regular user behavior and may indicate an adversary's attempt to probe the environment, testing for multi-factor authentication requirements across different applications and platforms. The detection is based on analysis of Azure AD audit logs, specifically focusing on authentication events. It employs statistical thresholds to highlight instances where the volume of authentication attempts and the diversity of application IDs and user agents associated with a single user account exceed normal parameters. Identifying this behavior is crucial as it provides an early indication of potential account compromise. Adversaries, once in possession of user credentials, often conduct reconnaissance to understand the security controls in place, including multi-factor authentication configurations. Tools like Invoke-MFASweep are commonly used for this purpose, automating the process of testing different user agents and application IDs to bypass MFA. By detecting these initial probing attempts, security teams can swiftly respond, potentially stopping an attack in its early stages and preventing further unauthorized access. This proactive stance is vital for maintaining the integrity of the organization's security posture. If validated as a true positive, this detection points to a compromised account, signaling that an attacker is actively attempting to navigate security controls to maintain access and potentially escalate privileges. This could lead to further exploitation, lateral movement within the network, and eventual data exfiltration. Recognizing and responding to this early stage of an attack is vital for preventing substantial harm and safeguarding sensitive organizational data and systems.
search: ' `azure_monitor_aad` category=SignInLogs operationName="Sign-in activity" (properties.authenticationRequirement="multiFactorAuthentication" AND properties.status.additionalDetails="MFA required in Azure AD") OR (properties.authenticationRequirement=singleFactorAuthentication AND "properties.authenticationDetails{}.succeeded"=true)
| bucket span=5m _time
| rename properties.* as *
| stats dc(_raw) as failed_attempts dc(appId) as unique_app_ids dc(userAgent) as unique_user_agents values(appDisplayName) values(deviceDetail.operatingSystem) by _time user src_ip
| where failed_attempts > 5 and unique_app_ids > 2 and unique_user_agents > 5
| `azure_ad_multiple_appids_and_useragents_authentication_spike_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
known_false_positives: Rapid authentication from the same user using more than 5 different user agents and 3 application IDs is highly unlikely under normal circumstances. However, there are potential scenarios that could lead to false positives.
references:
- https://attack.mitre.org/techniques/T1078/
- https://www.blackhillsinfosec.com/exploiting-mfa-inconsistencies-on-microsoft-services/
- https://github.com/dafthack/MFASweep
- https://www.youtube.com/watch?v=SK1zgqaAZ2E
tags:
analytic_story:
- Azure Active Directory Account Takeover
asset_type: Azure AD Tenant
confidence: 80
impact: 60
message: $user$ authenticated in a short periof of time with more than 5 different user agents across 3 or more unique application ids.
mitre_attack_id:
- T1078
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 48
required_fields:
- _time
- category
- operationName
- properties.authenticationRequirement
- properties.status.additionalDetails
- properties.authenticationDetails{}.succeeded
- properties.userAgent
- properties.appDisplayName
security_domain: identity
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/azure_ad_multiple_appids_and_useragents_auth/azure_ad_multiple_appids_and_useragents_auth.log
source: Azure AD
sourcetype: azure:monitor:aad
detections/cloud/azure_ad_multiple_denied_mfa_requests_for_user.yml
+65
View File
@@ -0,0 +1,65 @@
name: Azure AD Multiple Denied MFA Requests For User
id: d0895c20-de71-4fd2-b56c-3fcdb888eba1
version: 1
date: '2023-10-31'
author: Mauricio Velazco, Splunk
status: production
type: TTP
data_source: []
description: This analytic targets the detection of an unusually high number of denied Multi-Factor Authentication (MFA) requests for a single user within a 10-minute window, specifically identifying instances where more than nine MFA prompts were declined by the user. Utilizing Azure Active Directory (Azure AD) sign-in logs, particularly focusing on "Sign-in activity" events, it filters for scenarios where the MFA request was denied due to the user declining the authentication, as indicated by error code 500121 and additional details stating "MFA denied; user declined the authentication." The data is then aggregated into 10-minute intervals, counting distinct raw events and capturing the earliest and latest times of occurrence for each user. This behavior is significant for a Security Operations Center (SOC) as it could be an early indicator of a targeted attack or an account compromise attempt, with an attacker having obtained the user's credentials and the user actively declining the MFA prompts, preventing unauthorized access. A true positive detection would imply that an attacker is on the verge of gaining full access to the user's account, posing a threat that could lead to data exfiltration, lateral movement, or further malicious activities within the organization, necessitating immediate investigation and response to safeguard the organization's assets.
search: '`azure_monitor_aad` category=SignInLogs operationName="Sign-in activity"
| rename properties.* as *
| search status.errorCode=500121 status.additionalDetails="MFA denied; user declined the authentication"
| bucket span=10m _time
| stats dc(_raw) AS mfa_prompts earliest(_time) as firstTime latest(_time) as lastTime by user, status.additionalDetails, appDisplayName, userAgent, _time
| where mfa_prompts > 9
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `azure_ad_multiple_denied_mfa_requests_for_user_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Signin log category.
known_false_positives: Multiple denifed MFA requests in a short period of span may also be a sign of authentication errors. Investigate and filter as needed.
references:
- https://www.mandiant.com/resources/blog/russian-targeting-gov-business
- https://arstechnica.com/information-technology/2022/03/lapsus-and-solar-winds-hackers-both-use-the-same-old-trick-to-bypass-mfa/
- https://therecord.media/russian-hackers-bypass-2fa-by-annoying-victims-with-repeated-push-notifications/
- https://attack.mitre.org/techniques/T1621/
- https://attack.mitre.org/techniques/T1078/004/
- https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf
tags:
analytic_story:
- Azure Active Directory Account Takeover
asset_type: Azure Active Directory
confidence: 90
impact: 60
atomic_guid: []
message: User $user$ denied more than 9 MFA requests in a timespan of 10 minutes.
mitre_attack_id:
- T1621
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 54
required_fields:
- _time
- category
- category
- properties.status.errorCode
- properties.status.additionalDetails
- user
- properties.appDisplayName
- properties.userAgent
security_domain: identity
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/azure_ad_multiple_denied_mfa_requests/azure_ad_multiple_denied_mfa_requests.log
source: Azure AD
sourcetype: azure:monitor:aad
detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml
+19 -16
View File
@@ -1,6 +1,6 @@
name: Azure AD Multiple Failed MFA Requests For User
id: 264ea131-ab1f-41b8-90e0-33ad1a1888ea
version: 1
version: 2
date: '2022-08-25'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
@@ -8,24 +8,26 @@ type: TTP
description: The following analytic identifies multiple failed multi-factor authentication
requests for a single user within an Azure AD tenant. Error Code 500121 represents
a failed attempt to authenticate using a second factor. Specifically, the analytic
triggers when more than 10 MFA user prompts fail within 10 minutes. Azure AD tenants
can be very different depending on the organization, Security teams should test
triggers when more than 10 MFA user prompts fail within 10 minutes. The reasons for these failure could be several,
like the user not responding in time or receiving multiple duplicate MFA requests.
Azure AD tenants can be very different depending on the organization, Security teams should test
this detection and customize these arbitrary thresholds. The detected behavior may
represent an adversary who has obtained legitimate credentials for a user and continuously
repeats login attempts in order to bombard users with MFA push notifications, SMS
messages, and phone calls potentially resulting in the user finally accepting the
authentication request. Threat actors like the Lapsus team and APT29 have leveraged
this technique to bypass multi-factor authentication controls as reported by Mandiant
and others.
and others.
data_source: []
search: ' `azuread` category=SignInLogs properties.status.errorCode=500121
| rename properties.* as * | bucket span=10m _time | stats dc(_raw) AS mfa_prompts
values(ipAddress) as ipAddress by userPrincipalName, status.additionalDetails, appDisplayName,
userAgent, _time | where mfa_prompts > 10 | `azure_ad_multiple_failed_mfa_requests_for_user_filter`'
search: ' `azure_monitor_aad` category=SignInLogs operationName="Sign-in activity" properties.status.errorCode=500121 properties.status.additionalDetails!="MFA denied; user declined the authentication"
| rename properties.* as *
| bucket span=10m _time
| stats dc(_raw) AS mfa_prompts earliest(_time) as firstTime latest(_time) as lastTime by user, status.additionalDetails, appDisplayName, userAgent, _time
| where mfa_prompts > 9
| `azure_ad_multiple_failed_mfa_requests_for_user_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
Specifically, this analytic leverages the SignInLogs log category.
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Signin log category.
known_false_positives: Multiple Failed MFA requests may also be a sign of authentication
or application issues. Filter as needed.
references:
@@ -34,13 +36,14 @@ references:
- https://therecord.media/russian-hackers-bypass-2fa-by-annoying-victims-with-repeated-push-notifications/
- https://attack.mitre.org/techniques/T1621/
- https://attack.mitre.org/techniques/T1078/004/
- https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf
tags:
analytic_story:
- Azure Active Directory Account Takeover
asset_type: Azure Active Directory
confidence: 90
impact: 60
message: Multiple Failed MFA requests for user $userPrincipalName$
message: User $user$ failed to complete MFA authentication more than 9 times in a timespan of 10 minutes.
mitre_attack_id:
- T1586
- T1586.003
@@ -48,7 +51,7 @@ tags:
- T1078
- T1078.004
observable:
- name: userPrincipalName
- name: user
type: User
role:
- Victim
@@ -61,14 +64,14 @@ tags:
- properties.status.errorCode
- category
- properties.authenticationDetails
- properties.userPrincipalName
- properties.ipAddress
- user
risk_score: 54
security_domain: identity
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/multiple_failed_mfa_requests/azure-audit.log
source: mscs:azure:eventhub
sourcetype: mscs:azure:eventhub
source: Azure AD
sourcetype: azure:monitor:aad
update_timestamp: true
detections/cloud/azure_ad_new_mfa_method_registered.yml
+67
View File
@@ -0,0 +1,67 @@
name: Azure AD New MFA Method Registered
id: 0488e814-eb81-42c3-9f1f-b2244973e3a3
version: 1
date: '2023-10-31'
author: Mauricio Velazco, Splunk
status: production
type: TTP
data_source: []
description: This analytic detects the registration of a new Multi-Factor Authentication (MFA) method associated with a user account within Azure Active Directory by monitoring Azure AD audit logs and configurations. While adding a new MFA method can be a routine and legitimate action, it can also be indicative of an attacker's attempt to maintain persistence on a compromised account. By registering a new MFA method, attackers can potentially bypass existing security measures, allowing them to authenticate using stolen credentials without raising alarms. Monitoring for such changes is crucial, especially if the addition is not preceded by a user request or if it deviates from typical user behavior. If an attacker successfully registers a new MFA method on a compromised account, they can solidify their access, making it harder for legitimate users to regain control. The attacker can then operate with the privileges of the compromised account, potentially accessing sensitive data, making unauthorized changes, or even escalating their privileges further. Immediate action would be required to verify the legitimacy of the MFA change and, if malicious, to remediate and secure the affected account.
search: >-
`azure_monitor_aad` operationName="Update user"
| rename properties.* as *
| eval propertyName = mvindex('targetResources{}.modifiedProperties{}.displayName', 0)
| search propertyName = StrongAuthenticationMethod
| eval oldvalue = mvindex('targetResources{}.modifiedProperties{}.oldValue',0)
| eval newvalue = mvindex('targetResources{}.modifiedProperties{}.newValue',0)
| rex field=newvalue max_match=0 "(?i)(?<new_method_type>\"MethodType\")"
| rex field=oldvalue max_match=0 "(?i)(?<old_method_type>\"MethodType\")"
| eval count_new_method_type = coalesce(mvcount(new_method_type), 0)
| eval count_old_method_type = coalesce(mvcount(old_method_type), 0)
| stats earliest(_time) as firstTime latest(_time) as lastTime values(propertyName) by user newvalue oldvalue
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `azure_ad_new_mfa_method_registered_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: Users may register MFA methods legitimally, investigate and filter as needed.
references:
- https://attack.mitre.org/techniques/T1098/005/
- https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/
- https://www.csoonline.com/article/573451/sophisticated-bec-scammers-bypass-microsoft-365-multi-factor-authentication.html
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure AD
confidence: 50
impact: 60
message: A new MFA method was registered for user $user$
mitre_attack_id:
- T1098
- T1098.005
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 30
required_fields:
- _time
- operationName
- properties.targetResources{}.modifiedProperties{}.displayName
- properties.targetResources{}.modifiedProperties{}.oldValue
- properties.targetResources{}.modifiedProperties{}.newValue
- user
security_domain: identity
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.005/azure_ad_register_new_mfa_method/azure_ad_register_new_mfa_method.log
source: Azure AD
sourcetype: azure:monitor:aad
detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml
+63
View File
@@ -0,0 +1,63 @@
name: Azure AD OAuth Application Consent Granted By User
id: 10ec9031-015b-4617-b453-c0c1ab729007
version: 1
date: '2023-10-27'
author: Mauricio Velazco, Splunk
status: production
type: TTP
data_source: []
description: This analytic detects when a user in an Azure AD environment grants consent to an OAuth application, capturing any consent granted regardless of the specific permissions requested. Utilizing Azure AD audit logs, it focuses on events related to OAuth application consents, alerting security teams to instances where users actively grant consent to applications. This monitoring is crucial as it highlights potential risks associated with third-party applications gaining access to organizational data, a tactic often exploited by malicious actors to gain unauthorized access. A true positive from this analytic necessitates immediate investigation to validate the application's legitimacy, review the granted permissions, and assess potential risks, helping to prevent unauthorized access and protect sensitive data and resources. While false positives may occur with legitimate application integrations, ensuring alignment with organizational policies and security best practices is paramount.
search: >-
`azure_monitor_aad` operationName="Consent to application" properties.result=success
| rename properties.* as *
| eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions"), -1)
| eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index)
| rex field=permissions "Scope: (?<Scope>[^,]+)"
| stats count min(_time) as firstTime max(_time) as lastTime by operationName, user, Scope
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `azure_ad_oauth_application_consent_granted_by_user_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: False positives may occur if users are granting consents as part of legitimate application integrations or setups. It is crucial to review the application and the permissions it requests to ensure they align with organizational policies and security best practices.
references:
- https://attack.mitre.org/techniques/T1528/
- https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
- https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/protect-against-consent-phishing
- https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
- https://www.alteredsecurity.com/post/introduction-to-365-stealer
- https://github.com/AlteredSecurity/365-Stealer
tags:
analytic_story:
- Azure Active Directory Account Takeover
asset_type: Azure AD
confidence: 60
impact: 60
message: User $user$ consented an OAuth application.
mitre_attack_id:
- T1528
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 36
required_fields:
- _time
- operationName
- properties.targetResources{}.modifiedProperties{}.displayName
- properties.targetResources{}.modifiedProperties{}.newValue
- user
security_domain: identity
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/azure_ad_user_consent_granted/azure_ad_user_consent_granted.log
source: Azure AD
sourcetype: azure:monitor:aad
detections/cloud/azure_ad_tenant_wide_admin_consent_granted.yml
+62
View File
@@ -0,0 +1,62 @@
name: Azure AD Tenant Wide Admin Consent Granted
id: dc02c0ee-6ac0-4c7f-87ba-8ce43a4e4418
version: 2
date: '2023-09-14'
author: Mauricio Velazco, Splunk
status: production
type: TTP
data_source: []
description: The following analytic identifies instances where admin consent is granted to an application within an Azure AD tenant. It leverages Azure AD audit logs, specifically events related to the admin consent action within the ApplicationManagement category. The admin consent action allows applications to access data across the entire tenant, potentially encompassing a vast amount of organizational data. Given its broad scope and the sensitivity of some permissions that can only be granted via admin consent, it's crucial to monitor this action. Unauthorized or inadvertent granting of admin consent can lead to significant security risks, including data breaches, unauthorized data access, and potential compliance violations. If an attacker successfully tricks an administrator into granting admin consent to a malicious or compromised application, they can gain extensive and persistent access to organizational data. This can lead to data exfiltration, espionage, further malicious activities within the tenant, and potential breaches of compliance regulations
search: >-
`azure_monitor_aad` operationName="Consent to application"
| eval new_field=mvindex('properties.targetResources{}.modifiedProperties{}.newValue', 4)
| rename properties.* as *
| rex field=new_field "ConsentType: (?<ConsentType>[^\,]+)"
| stats count min(_time) as firstTime max(_time) as lastTime by operationName, user, targetResources{}.displayName, targetResources{}.id, ConsentType
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `azure_ad_tenant_wide_admin_consent_granted_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Auditlogs log category.
known_false_positives: Legitimate applications may be granted tenant wide consent, filter as needed.
references:
- https://attack.mitre.org/techniques/T1098/003/
- https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452
- https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-app-consent
- https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent?pivots=portal
- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT501/AZT501-2/
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure AD
confidence: 50
impact: 90
message: Administrator $user$ consented an OAuth application for the tenant.
mitre_attack_id:
- T1098
- T1098.003
observable:
- name: user
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 45
required_fields:
- _time
- operationName
- user
- properties.targetResources{}.modifiedProperties{}.newValue
- properties.targetResources{}.displayName
- properties.targetResources{}.id
security_domain: identity
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_admin_consent/azure_ad_admin_consent.log
source: Azure AD
sourcetype: azure:monitor:aad
detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml
+66
View File
@@ -0,0 +1,66 @@
name: Azure AD User Consent Blocked for Risky Application
id: 06b8ec9a-d3b5-4882-8f16-04b4d10f5eab
version: 1
date: '2023-10-27'
author: Mauricio Velazco, Splunk
status: production
type: TTP
data_source: []
description: The following analytic identifies instances where Azure AD has blocked a user's attempt to grant consent to an application deemed risky or potentially malicious. This suggests that the application has exhibited behaviors or characteristics that are commonly associated with malicious intent or poses a security risk. This detection leverages the Azure AD audit logs, specifically focusing on events related to user consent actions and system-driven blocks. By filtering for blocked consent actions associated with applications, the analytic highlights instances where Azure's built-in security measures have intervened. Applications that are flagged and blocked by Azure typically exhibit suspicious characteristics or behaviors. Monitoring for these blocked consent attempts helps security teams identify potential threats early on and can provide insights into users who might be targeted or susceptible to such risky applications. It's an essential layer of defense in ensuring that malicious or risky applications don't gain access to organizational data. If the detection is a true positive, it indicates that the built-in security measures of O365 successfully prevented a potentially harmful application from gaining access. However, the attempt itself suggests that either a user might be targeted or that there's a presence of malicious applications trying to infiltrate the organization. Immediate investigation is required to understand the context of the block and to take further preventive measures.
search: >-
`azure_monitor_aad` operationName="Consent to application" properties.result=failure
| rename properties.* as *
| eval reason_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Reason") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Reason"), -1)
| eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions"), -1)
| search reason_index >= 0
| eval reason = mvindex('targetResources{}.modifiedProperties{}.newValue',reason_index)
| eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index)
| search reason = "\"Risky application detected\""
| rex field=permissions "Scope: (?<Scope>[^,]+)"
| stats count min(_time) as firstTime max(_time) as lastTime by operationName, user, reason, Scope
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `azure_ad_user_consent_blocked_for_risky_application_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
references:
- https://attack.mitre.org/techniques/T1528/
- https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
- https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/protect-against-consent-phishing
- https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
- https://www.alteredsecurity.com/post/introduction-to-365-stealer
- https://github.com/AlteredSecurity/365-Stealer
tags:
analytic_story:
- Azure Active Directory Account Takeover
asset_type: Azure AD tenant
confidence: 100
impact: 30
message: Azure AD has blocked $user$ attempt to grant to consent to an application deemed risky.
mitre_attack_id:
- T1528
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 30
required_fields:
- _time
- operationName
- properties.result
- properties.targetResources{}.modifiedProperties{}.displayName
- properties.targetResources{}.modifiedProperties{}.newValue
security_domain: identity
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/azure_ad_user_consent_blocked/azure_ad_user_consent_blocked.log
source: Azure AD
sourcetype: azure:monitor:aad
detections/cloud/azure_ad_user_consent_denied_for_oauth_application.yml
+59
View File
@@ -0,0 +1,59 @@
name: Azure AD User Consent Denied for OAuth Application
id: bb093c30-d860-4858-a56e-cd0895d5b49c
version: 1
date: '2023-10-27'
author: Mauricio Velazco, Splunk
status: production
type: TTP
data_source: []
description: The following analytic identifies instances where a user has actively denied consent to an OAuth application seeking permissions within the Azure AD environment. This suggests that the user either recognized something suspicious about the application or chose not to grant it the requested permissions for other reasons. This detection leverages the Azure AD's audit logs, specifically focusing on events related to user consent actions. By filtering for denied consent actions associated with OAuth applications, the analytic captures instances where users have actively rejected permission requests. While user-denied consents can be routine, they can also be indicative of users spotting potentially suspicious or unfamiliar applications. By monitoring these denied consent attempts, security teams can gain insights into applications that might be perceived as risky or untrusted by users. It can also serve as a feedback loop for security awareness training, indicating that users are being cautious about granting permissions. If the detection is a true positive, it indicates that a user has actively prevented an OAuth application from gaining the permissions it requested. While this is a proactive security measure on the user's part, it's essential for security teams to review the context of the denial. Understanding why certain applications are being denied can help in refining application whitelisting policies and ensuring that no malicious applications are attempting to gain access.
search: ' `azure_monitor_aad` operationName="Sign-in activity" properties.status.errorCode=65004
| rename properties.* as *
| stats count min(_time) as firstTime max(_time) as lastTime by operationName, user, appDisplayName, status.failureReason
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `azure_ad_user_consent_denied_for_oauth_application_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
known_false_positives: Users may deny consent for legitimate applications by mistake, filter as needed.
references:
- https://attack.mitre.org/techniques/T1528/
- https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
- https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/protect-against-consent-phishing
- https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
- https://www.alteredsecurity.com/post/introduction-to-365-stealer
- https://github.com/AlteredSecurity/365-Stealer
tags:
analytic_story:
- Azure Active Directory Account Takeover
asset_type: Azure AD
confidence: 60
impact: 60
message: User $user$ denied consent for an OAuth application.
mitre_attack_id:
- T1528
observable:
- name: user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 36
required_fields:
- _time
- operationName
- properties.status.errorCode
- user
- properties.appDisplayName
- status.failureReason
security_domain: identity
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/azure_ad_user_consent_declined/azure_ad_user_consent_declined.log
source: Azure AD
sourcetype: azure:monitor:aad
detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml
+43
View File
@@ -0,0 +1,43 @@
name: Risk Rule for Dev Sec Ops by Repository
id: 161bc0ca-4651-4c13-9c27-27770660cf67
version: 1
date: '2023-10-27'
author: Bhavin Patel
status: production
type: Correlation
description: |-
The following analytic detects by correlating repository and risk score to identify patterns and trends in the data based on the level of risk associated. The analytic adds any null values and calculates the sum of the risk scores for each detection. Then, the analytic captures the source and user information for each detection and sorts the results in ascending order based on the risk score. Finally, the analytic filters the detections with a risk score below 80 and focuses only on high-risk detections.This detection is important because it provides valuable insights into the distribution of high-risk activities across different repositories. It also identifies the most vulnerable repositories that are frequently targeted by potential threats. Additionally, it proactively detects and responds to potential threats, thereby minimizing the impact of attacks and safeguarding critical assets. Finally, it provides a comprehensive view of the risk landscape and helps to make informed decisions to protect the organization's data and infrastructure. False positives might occur so it is important to identify the impact of the attack and prioritize response and mitigation efforts.
data_source: []
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as sum_risk_score, values(All_Risk.annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Dev Sec Ops" All_Risk.risk_object_type = "other" by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count > 3 and sum_risk_score > 100 | `risk_rule_for_dev_sec_ops_by_repository_filter`'
how_to_implement: Ensure that all relevant detections in the Dev Sec Ops analytic stories are enabled and are configured to create risk events in Enterprise Security.
known_false_positives: Unknown
references: []
tags:
analytic_story:
- Dev Sec Ops
asset_type: Amazon Elastic Container Registry
confidence: 100
impact: 70
message: Correlation triggered for repository $risk_object$
mitre_attack_id:
- T1204.003
- T1204
observable:
- name: risk_object
type: Other
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
risk_score: 70
security_domain: cloud
tests:
- name: True Positive Test
attack_data:
- data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1204.003/risk_dataset/aws_ecr_risk_dataset.log
source: aws_ecr_risk_dataset.log
sourcetype: stash
detections/cloud/correlation_by_repository_and_risk.yml → detections/deprecated/correlation_by_repository_and_risk.yml
View File
detections/cloud/correlation_by_user_and_risk.yml → detections/deprecated/correlation_by_user_and_risk.yml
View File
detections/endpoint/any_powershell_downloadstring.yml
+1
View File
@@ -44,6 +44,7 @@ tags:
- HAFNIUM Group
- Data Destruction
- IcedID
- SysAid On-Prem Software CVE-2023-47246 Vulnerability
asset_type: Endpoint
confidence: 70
impact: 80
detections/endpoint/detect_webshell_exploit_behavior.yml
+1
View File
@@ -50,6 +50,7 @@ tags:
- Citrix ShareFile RCE CVE-2023-24489
- Flax Typhoon
- WS FTP Server Critical Vulnerabilities
- SysAid On-Prem Software CVE-2023-47246 Vulnerability
asset_type: Endpoint
confidence: 80
impact: 100
detections/endpoint/java_writing_jsp_file.yml
+1
View File
@@ -37,6 +37,7 @@ tags:
analytic_story:
- Spring4Shell CVE-2022-22965
- Atlassian Confluence Server and Data Center CVE-2022-26134
- SysAid On-Prem Software CVE-2023-47246 Vulnerability
asset_type: Endpoint
confidence: 70
cve:
detections/endpoint/powershell_enable_powershell_remoting.yml
+1 -2
View File
@@ -3,7 +3,6 @@ id: 40e3b299-19a5-4460-96e9-e1467f714f8e
version: 1
date: '2023-03-22'
author: Michael Haag, Splunk
status: production
type: Anomaly
status: production
data_source:
@@ -51,4 +50,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/4104-psremoting-windows-powershell.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
sourcetype: xmlwineventlog
detections/endpoint/powershell_invoke_cimmethod_cimsession.yml
+1 -4
View File
@@ -3,14 +3,11 @@ id: 651ee958-a433-471c-b264-39725b788b83
version: 1
date: '2023-03-22'
author: Michael Haag, Splunk
status: production
type: Anomaly
status: production
data_source:
- Powershell 4104
description: This analytic identifies the use of the New-CIMSession cmdlet being created along with the Invoke-CIMMethod cmdlet being used within PowerShell. This particular behavior is similar to the usage of the Invoke-WMIMethod cmdlet, which is known for executing WMI commands on targets using NTLMv2 pass-the-hash authentication. The New-CIMSession cmdlet allows users to create a new CIM session object for a specified computer system, which can then be used to execute CIM operations remotely. Similarly, the Invoke-CIMMethod cmdlet is used to invoke a specified method on one or more CIM objects. Therefore, the combination of New-CIMSession and Invoke-CIMMethod cmdlets in PowerShell can potentially indicate malicious behavior, and this analytic can help detect such activity.
data_source:
- Powershell 4104
search: '`powershell` EventCode=4104 ScriptBlockText IN ("*invoke-CIMMethod*", "*New-CimSession*")
| stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText
| `security_content_ctime(firstTime)`
@@ -52,4 +49,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/4104-cimmethod-windows-powershell.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
sourcetype: xmlwineventlog
detections/endpoint/powershell_invoke_wmiexec_usage.yml
+1 -2
View File
@@ -3,7 +3,6 @@ id: 0734bd21-2769-4972-a5f1-78bb1e011224
version: 1
date: '2023-03-22'
author: Michael Haag, Splunk
status: production
type: TTP
status: production
data_source:
@@ -50,4 +49,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/invokewmiexec_windows-powershell.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
sourcetype: xmlwineventlog
detections/endpoint/powershell_start_or_stop_service.yml
+1 -2
View File
@@ -3,7 +3,6 @@ id: 04207f8a-e08d-4ee6-be26-1e0c4488b04a
version: 1
date: '2023-03-24'
author: Michael Haag, Splunk
status: production
type: Anomaly
status: production
data_source:
@@ -52,4 +51,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/start_stop_service_windows-powershell.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
sourcetype: xmlwineventlog
detections/endpoint/windows_autoit3_execution.yml
+68
View File
@@ -0,0 +1,68 @@
name: Windows AutoIt3 Execution
id: 0ecb40d9-492b-4a57-9f87-515dd742794c
version: 1
date: '2023-10-31'
author: Michael Haag, Splunk
status: production
type: TTP
data_source:
- Sysmon Event ID 1
description: The following analytic is designed to detect any execution of AutoIt3, a scripting language designed for automating the Windows GUI and general scripting. This includes instances where AutoIt3 has been renamed or otherwise altered in an attempt to evade detection. The analytic works by searching for process names or original file names that match 'autoit3.exe', which is the default executable for AutoIt scripts. This detection is important as AutoIt3 is often used by attackers to automate malicious activities, such as the execution of malware or other unwanted software. False positives may occur with legitimate uses of AutoIt3.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("autoit3.exe", "autoit*.exe") OR Processes.original_file_name IN ("autoit3.exe", "autoit*.exe")
by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_autoit3_execution_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present if the application is legitimately used, filter by user or endpoint as needed.
references:
- https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt
tags:
analytic_story:
- DarkGate Malware
asset_type: Endpoint
atomic_guid: []
confidence: 100
impact: 50
message: Execution of AutoIt3 detected. The source process is $parent_process_name$ and the destination process is $process_name$ on $dest$ by
mitre_attack_id:
- T1059
observable:
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
- name: dest
type: Hostname
role:
- Victim
- name: user
type: User
role:
- Other
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 50
required_fields:
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.original_file_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/autoit/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
detections/endpoint/windows_cab_file_on_disk.yml
+49
View File
@@ -0,0 +1,49 @@
name: Windows CAB File on Disk
id: 622f08d0-69ef-42c2-8139-66088bc25acd
version: 1
date: '2023-11-08'
author: Michael Haag, Splunk
status: production
type: Anomaly
data_source:
- Sysmon Event ID 11
description: The following analytic identifies .cab files being written to disk. Utilize this analytic as a way to hunt for suspect .cab files being written to non-standard paths and tune as needed. Cab files were recently being utilized to deliver .url files embedded. The .url files were then used to deliver malicious payloads. The search specifically looks for instances where the file name is '*.cab' and the action is 'write'. During the triage process, it is recommended to review the file path for additional artifacts that may provide further insights into the event.
search: '| tstats `security_content_summariesonly` count values(Filesystem.file_path)
as file_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name=*.cab) by Filesystem.dest Filesystem.action Filesystem.process_id Filesystem.file_name
| `drop_dm_object_name("Filesystem")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cab_file_on_disk_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives will only be present if a process legitimately writes a .cab file to disk. Modify the analytic as needed by file path. Filter as needed.
references:
- https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt
tags:
analytic_story:
- DarkGate Malware
asset_type: Endpoint
atomic_guid: []
confidence: 10
impact: 50
message: A .cab file was written to disk on endpoint $dest$.
mitre_attack_id:
- T1566.001
observable:
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 5
required_fields:
- Filesystem.dest
- Filesystem.action
- Filesystem.process_id
- Filesystem.file_name
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/autoit/cab_files.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
detections/endpoint/windows_conhost_with_headless_argument.yml
+60
View File
@@ -0,0 +1,60 @@
name: Windows ConHost with Headless Argument
id: d5039508-998d-4cfc-8b5e-9dcd679d9a62
version: 1
date: '2023-11-01'
author: Michael Haag, Splunk
status: production
type: TTP
data_source:
- Windows Security 4688
description: 'The following analytic detects the unusual use of the Windows Console Host process (conhost.exe) with the undocumented --headless parameter to spawn a new process. This behavior is highly unusual and indicative of suspicious activity, as the --headless parameter is not commonly used in legitimate operations. The analytic identifies this behavior by looking for instances where conhost.exe is invoked with the --headless argument. This behavior is worth identifying for a Security Operations Center (SOC) as it could indicate an attacker''s attempt to execute commands or scripts in a stealthy manner, potentially to establish persistence, perform lateral movement, or carry out other malicious activities. If a true positive is identified, it suggests that an attacker has gained a foothold in the environment and is attempting to further their attack, which could lead to serious consequences such as data exfiltration, system compromise, or deployment of ransomware. Potential false positives could arise from legitimate administrative activity, hence it is important to validate the context of the detected behavior during triage.'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=conhost.exe
Processes.process="*--headless *" by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_conhost_with_headless_argument_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present if the application is legitimately used, filter by user or endpoint as needed.
references:
- https://x.com/embee_research/status/1559410767564181504?s=20
- https://x.com/GroupIB_TI/status/1719675754886131959?s=20
tags:
analytic_story:
- Spearphishing Attachments
asset_type: endpoint
atomic_guid: []
confidence: 70
impact: 100
message: Windows ConHost with Headless Argument detected on $dest$ by $user$.
mitre_attack_id:
- T1564.003
- T1564.006
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 70
required_fields:
- Processes.dest
- Processes.user
- Processes.parent_process
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.003/headless/4688_conhost_headless.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml
+1 -2
View File
@@ -3,7 +3,6 @@ id: 12c80db8-ef62-4456-92df-b23e1b3219f6
version: 1
date: '2023-03-27'
author: Michael Haag, Splunk
status: production
type: Anomaly
status: production
data_source:
@@ -56,4 +55,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/enableat_windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: xmlwineventlog
detections/endpoint/windows_java_spawning_shells.yml
+1
View File
@@ -39,6 +39,7 @@ references:
tags:
analytic_story:
- Log4Shell CVE-2021-44228
- SysAid On-Prem Software CVE-2023-47246 Vulnerability
asset_type: Endpoint
confidence: 50
cve:
detections/endpoint/windows_modify_registry_default_icon_setting.yml
+2 -2
View File
@@ -36,8 +36,8 @@ tags:
asset_type: Endpoint
confidence: 80
impact: 80
message: a registry $Registry.registry_path$ was modified or created to modify defaulticon
settings of the $dest$
message: A suspicious registry modification to change the default icon association
of windows to ransomware was detected on endpoint $dest$ by user $user$.
mitre_attack_id:
- T1112
observable:
detections/endpoint/windows_msiexec_spawn_windbg.yml
+71
View File
@@ -0,0 +1,71 @@
name: Windows MSIExec Spawn WinDBG
id: 9a18f7c2-1fe3-47b8-9467-8b3976770a30
version: 1
date: '2023-10-31'
author: Michael Haag, Splunk
status: production
type: TTP
data_source:
- Sysmon Event ID 1
description: This analytic identifies the unusual behavior of MSIExec spawning WinDBG. It is designed to detect potential malicious activities. The search specifically looks for instances where the parent process name is 'msiexec.exe' and the process name is 'windbg.exe'. During the triage process, it is recommended to review the file path for additional artifacts that may provide further insights into the event.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msiexec.exe Processes.process_name=windbg.exe by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path Processes.parent_process Processes.process_name Processes.process_path
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `windows_msiexec_spawn_windbg_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives will only be present if the MSIExec process legitimately spawns WinDBG. Filter as needed.
references:
- https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt
tags:
analytic_story:
- DarkGate Malware
asset_type: Endpoint
atomic_guid: []
confidence: 100
impact: 100
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$.
mitre_attack_id:
- T1218.007
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process Name
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process_path
- Processes.parent_process
- Processes.process_name
- Processes.process_path
- Processes.process
- Processes.process_id
- Processes.parent_process_id
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windbg_msiexec.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml
+1 -2
View File
@@ -3,7 +3,6 @@ id: d8c972eb-ed84-431a-8869-ca4bd83257d1
version: 1
date: '2023-03-27'
author: Michael Haag, Splunk
status: production
type: Anomaly
status: production
data_source:
@@ -48,4 +47,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/get_ciminstance_windows-powershell.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
sourcetype: xmlwineventlog
detections/endpoint/windows_service_create_remcomsvc.yml
+1 -2
View File
@@ -3,7 +3,6 @@ id: 0be4b5d6-c449-4084-b945-2392b519c33b
version: 1
date: '2023-03-20'
author: Michael Haag, Splunk
status: production
type: Anomaly
status: production
data_source:
@@ -51,4 +50,4 @@ tests:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/remcom_windows-system.log
source: XmlWinEventLog:System
sourcetype: XmlWinEventLog
update_timestamp: true
update_timestamp: true
detections/endpoint/windows_windbg_spawning_autoit3.yml
+69
View File
@@ -0,0 +1,69 @@
name: Windows WinDBG Spawning AutoIt3
id: 7aec015b-cd69-46c3-85ed-dac152056aa4
version: 1
date: '2023-10-31'
author: Michael Haag, Splunk
status: production
type: TTP
data_source:
- Sysmon Event ID 1
description: The following analytic identifies instances of the WinDBG process spawning AutoIt3. This behavior may indicate malicious activity as AutoIt3 is often used by threat actors for scripting malicious automation. The search specifically looks for instances where the parent process name is 'windbg.exe' and the process name is 'autoit3.exe' or 'autoit*.exe'. During the triage process, it is recommended to review the file path for additional artifacts that may provide further insights into the event.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=windbg.exe AND (Processes.process_name IN ("autoit3.exe", "autoit*.exe") OR Processes.original_file_name IN ("autoit3.exe", "autoit*.exe")) by Processes.dest, Processes.user, Processes.parent_process_name, Processes.process_name, Processes.original_file_name, Processes.process, Processes.process_id, Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| eval matches_extension=if(match(process, "\\.(au3|a3x|exe|aut|aup)$"), "Yes", "No")
| search matches_extension="Yes" | `windows_windbg_spawning_autoit3_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives will only be present if the WinDBG process legitimately spawns AutoIt3. Filter as needed.
references:
- https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt
tags:
analytic_story:
- DarkGate Malware
asset_type: Endpoint
atomic_guid: []
confidence: 100
impact: 100
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$.
mitre_attack_id:
- T1059
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process Name
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.original_file_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/autoit/windbg_autoit.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
dev/endpoint/java_writing_jsp_file.yml
+1
View File
@@ -33,6 +33,7 @@ tags:
analytic_story:
- Spring4Shell CVE-2022-22965
- Atlassian Confluence Server and Data Center CVE-2022-26134
- SysAid On-Prem Software CVE-2023-47246 Vulnerability
asset_type: Endpoint
confidence: 70
cve:
dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Attempted Credential Dump From Registry via Reg exe
id: 14038953-e5f2-4daf-acff-5452062baf03
version: 3
version: 4
date: '2021-11-29'
author: Jose Hernandez, Splunk
status: production
dev_ssa/endpoint/ssa___delete_a_net_user.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Delete A Net User
id: 8776d79c-d26e-11eb-9a56-acde48001122
version: 4
version: 5
date: '2022-03-17'
author: Teoderick Contreras, Splunk
status: production
dev_ssa/endpoint/ssa___deleting_shadow_copies.yml
+1 -1
View File
@@ -1,7 +1,7 @@
name: Deleting Shadow Copies
id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8
date: '2023-10-03'
version: 1
version: 2
author: Bhavin Patel, Splunk
status: validation
type: TTP
dev_ssa/endpoint/ssa___deny_permission_using_cacls_utility.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Deny Permission using Cacls Utility
id: b76eae28-cd25-11eb-9c92-acde48001122
version: 3
version: 4
date: '2021-11-29'
author: Teoderick Contreras, Splunk
status: production
dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Detect Prohibited Applications Spawning cmd exe
id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
version: 4
version: 5
date: '2022-03-01'
author: Ignacio Bermudez Corrales, Splunk
status: production
dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe_browsers.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Detect Prohibited Applications Spawning cmd exe browsers
id: c10a18cb-fd70-4ffa-a844-25026e0a0c94
version: 1
version: 2
date: '2023-10-26'
author: Lou Stella, Splunk
status: validation
dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe_office.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Detect Prohibited Applications Spawning cmd exe office
id: c10a18cb-fd70-4ffa-a844-25026e0b0c94
version: 1
version: 2
date: '2023-10-26'
author: Lou Stella, Splunk
status: validation
dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe_powershell.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Detect Prohibited Applications Spawning cmd exe powershell
id: c10a18cb-fd70-4ffa-a844-25126e0b0d94
version: 1
version: 2
date: '2023-10-26'
author: Lou Stella, Splunk
status: validation
dev_ssa/endpoint/ssa___disable_net_user_account.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Disable Net User Account
id: ba858b08-d26c-11eb-af9b-acde48001122
version: 3
version: 4
date: '2021-11-30'
author: Teoderick Contreras, Splunk
status: production
dev_ssa/endpoint/ssa___grant_permission_using_cacls_utility.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Grant Permission Using Cacls Utility
id: c6da561a-cd29-11eb-ae65-acde48001122
version: 3
version: 4
date: '2021-11-30'
author: Teoderick Contreras, Splunk
status: production
dev_ssa/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Modify ACLs Permission Of Files Or Folders
id: 9ae9a48a-cdbe-11eb-875a-acde48001122
version: 3
version: 4
date: '2022-03-17'
author: Teoderick Contreras, Splunk
status: production
dev_ssa/endpoint/ssa___office_product_spawning_windows_script_host.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Office Product Spawning Windows Script Host
id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6
version: 1
version: 2
date: '2022-10-12'
author: Michael Haag, Splunk
status: production
dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Services lolbas Execution Process Spawn
id: 0d85fde3-0de9-4eec-b386-6a8ba70f3935
version: 1
version: 2
date: '2023-10-02'
author: Bhavin Patel, Splunk
status: validation
dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: System Process Running from Unexpected Location
id: 28179107-099a-464a-94d3-08301e6c055f
version: 4
version: 5
date: '2022-03-24'
author: Jose Hernadnez, Ignacio Bermudez Corrales, Splunk
status: production
dev_ssa/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Windows LOLBin Binary in Non Standard Path
id: 25689101-012a-324a-94d3-08301e6c065a
version: 4
version: 5
date: '2022-08-31'
author: Michael Haag, Splunk
status: production
dev_ssa/endpoint/ssa___windows_mshta_child_process.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Windows MSHTA Child Process
id: f63f7e9c-9526-11ec-9fc7-acde48001122
version: 2
version: 3
date: '2022-02-23'
author: Michael Haag, Splunk
status: production
dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Windows OS Credential Dumping with Procdump
id: e102e297-dbe6-4a19-b319-5c08f4c19a06
version: 1
version: 2
date: '2022-08-31'
author: Michael Haag, Splunk
status: production
dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Windows Powershell Connect to Internet With Hidden Window
id: 477e068e-8b6d-11ec-b6c1-81af21670352
version: 2
version: 3
date: '2022-02-11'
author: Jose Hernandez, David Dorsey, Michael Haag Splunk
status: production
dev_ssa/endpoint/ssa___windows_powershell_downloadfile.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Windows Powershell DownloadFile
id: 46440222-81d5-44b1-a376-19dcd70d1b08
version: 1
version: 2
date: '2022-02-11'
author: Jose Hernandez, Michael Haag, Splunk
status: production
dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml
+1 -1
View File
@@ -4,7 +4,7 @@ version: 1
date: '2023-05-18'
author: Michael Haag, Splunk
status: experimental
type: anomaly
type: Anomaly
description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate
utilizing Script Block Logging. This particular behavior is related to an adversary
attempting to steal certificates local to the Windows endpoint within the Certificate
dev_ssa/endpoint/ssa___windows_powershell_start_bitstransfer.yml
+1 -1
View File
@@ -1,6 +1,6 @@
name: Windows PowerShell Start-BitsTransfer
id: 0bafd086-8f61-11ec-996e-acde48001122
version: 1
version: 2
date: '2022-02-16'
author: Michael Haag, Splunk
status: production
dist/DA-ESS-ContentUpdate/app.manifest
Vendored
+1 -1
View File
@@ -5,7 +5,7 @@
"id": {
"group": null,
"name": "DA-ESS-ContentUpdate",
"version": "4.15.0"
"version": "4.16.0"
},
"author": [
{
dist/DA-ESS-ContentUpdate/default/analyticstories.conf
Vendored
+234 -29
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-11-01T20:44:08 UTC
# On Date: 2023-11-16T22:15:55 UTC
# Author: Splunk Threat Research Team - Splunk
# Contact: research@splunk.com
#############
@@ -305,6 +305,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
known_false_positives = This search may reveal non malicious URLs with environment variables used in organizations.
providing_technologies = null
[savedsearch://ESCU - Splunk App for Lookup File Editing RCE via User XSLT - Rule]
type = detection
asset_type = endpoint
confidence = medium
explanation = This search provides information to investigate possible remote code execution exploitation via user-supplied Extensible Stylesheet Language Transformations (XSLT), affecting Splunk versions 9.1.x. Exploitation of this vulnerability by attackers requires that the Splunk App for Lookup File Editing is, or was, installed.
how_to_implement = Because there is no way to detect the payload, this search only provides the ability to monitor the creation of lookups which are the base of this exploit. An operator must then investigate suspicious lookups. This search requires ability to perform REST queries. Note that if the Splunk App for Lookup File Editing is not, or was not, installed in the Splunk environment then it is not necessary to run the search as the enviornment was not vulnerable.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.AE"]}
known_false_positives = This search will provide information for investigation and hunting of lookup creation via user-supplied XSLT which may be indications of possible exploitation. There will be false positives as it is not possible to detect the payload executed via this exploit.
providing_technologies = null
[savedsearch://ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule]
type = detection
asset_type = Endpoint
@@ -655,6 +665,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Deliv
known_false_positives = Automation executing authentication attempts against your Splunk infrastructure with outdated credentials may cause false positives.
providing_technologies = null
[savedsearch://ESCU - Splunk XSS in Highlighted JSON Events - Rule]
type = detection
asset_type = endpoint
confidence = medium
explanation = This detection provides information about possible exploitation against affected versions of Splunk Enterprise 9.1.2. The ability to view JSON logs in the web GUI may be abused by crafting a specific request, causing the execution of javascript in script tags. This vulnerability can be used to execute javascript to access the API at the permission level of the logged-in user. If user is admin it can be used to create an admin user, giving an attacker broad access to the Splunk Environment.
how_to_implement = This search only applies to web-GUI-enabled Splunk instances and operator must have access to internal indexes.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"]}
known_false_positives = This is a hunting search and will produce false positives as it is not possible to view contents of a request payload. It shows the artifact resulting from a potential exploitation payload (the creation of a user with admin privileges).
providing_technologies = null
[savedsearch://ESCU - Splunk XSS in Monitoring Console - Rule]
type = detection
asset_type = Endpoint
@@ -1498,6 +1518,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Weaponization", "Expl
known_false_positives = Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
providing_technologies = null
[savedsearch://ESCU - Azure AD Block User Consent For Risky Apps Disabled - Rule]
type = detection
asset_type = Azure AD
confidence = medium
explanation = This analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. This setting, when enabled, prevents regular users from granting consent to potentially malicious OAuth applications, requiring an administrative step-up for consent instead. Disabling this feature could expose the organization to OAuth phishing threats.The detection operates by monitoring Azure Active Directory logs for events where the "Update authorization policy" operation is performed. It specifically looks for changes to the "AllowUserConsentForRiskyApps" setting, identifying instances where this setting is switched to "true," effectively disabling the risk-based step-up consent. Monitoring for changes to critical security settings like the "risk-based step-up consent" is vital for maintaining the integrity of an organization's security posture. Disabling this feature can make the environment more susceptible to OAuth phishing attacks, where attackers trick users into granting permissions to malicious applications. Identifying when this setting is disabled can help blue teams to quickly respond, investigate, and potentially uncover targeted phishing campaigns against their users. If an attacker successfully disables the "risk-based step-up consent" and subsequently launches an OAuth phishing campaign, they could gain unauthorized access to user data and other sensitive information within the M365 environment. This could lead to data breaches, unauthorized access to emails, and potentially further compromise within the organization
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"], "nist": ["DE.CM"]}
known_false_positives = Legitimate changes to the 'risk-based step-up consent' setting by administrators, perhaps as part of a policy update or security assessment, may trigger this alert, necessitating verification of the change's intent and authorization
providing_technologies = null
[savedsearch://ESCU - Azure AD Concurrent Sessions From Different Ips - Rule]
type = detection
asset_type = Azure AD
@@ -1508,6 +1538,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
known_false_positives = A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
providing_technologies = null
[savedsearch://ESCU - Azure AD Device Code Authentication - Rule]
type = detection
asset_type = Azure AD
confidence = medium
explanation = The following analytic identifies the execution of the Azure Device Code Phishing attack, which can lead to Azure Account Take-Over (ATO). The detection leverages Azure AD logs specifically focusing on authentication requests to identify the attack. This technique involves creating malicious infrastructure, bypassing Multi-Factor Authentication (MFA), and bypassing Conditional Access Policies (CAPs). The attack aims to compromise users by sending them phishing emails from attacker-controlled domains and trick the victims into performing OAuth 2.0 device authentication. A successful execution of this attack can result in adversaries gaining unauthorized access to Azure AD, Exchange mailboxes, and the target's Outlook Web Application (OWA). This attack technique was detailed by security researchers including Bobby Cooke, Stephan Borosh, and others. It's crucial for organizations to be aware of this threat, as it can lead to unauthorized access and potential data breaches.
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery"], "mitre_attack": ["T1528", "T1566", "T1566.002"], "nist": ["DE.CM"]}
known_false_positives = In most organizations, device code authentication will be used to access common Microsoft service but it may be legitimate for others. Filter as needed.
providing_technologies = null
[savedsearch://ESCU - Azure AD External Guest User Invited - Rule]
type = detection
asset_type = Azure Active Directory
@@ -1558,12 +1598,42 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Weaponization", "Expl
known_false_positives = Legitimate use case may require for users to disable MFA. Filter as needed.
providing_technologies = null
[savedsearch://ESCU - Azure AD Multi-Source Failed Authentications Spike - Rule]
type = detection
asset_type = Azure AD
confidence = medium
explanation = This analytic detects potential distributed password spraying attacks within an Azure AD environment. It identifies a notable increase in failed authentication attempts across a variety of unique user-and-IP address combinations, originating from multiple source IP addresses and countries, and employing different user agents. Such patterns suggest an adversary's attempt to bypass security controls by using a range of IP addresses to test commonly used passwords against numerous user accounts. The detection scrutinizes SignInLogs from Azure AD logs, particularly focusing on events with error code 50126, which signals a failed authentication due to incorrect credentials. By collating data over a five-minute interval, the analytic computes the distinct counts of user-and-IP combinations, unique users, source IPs, and countries. It then applies a set of thresholds to these metrics to pinpoint unusual activities that could indicate a coordinated attack effort. The thresholds set within the analytic (such as unique IPs, unique users, etc.) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Recognizing this behavior is vital for security operations centers (SOCs) as distributed password spraying represents a more complex form of traditional password spraying. Attackers distribute the source of their attempts to evade detection mechanisms that typically monitor for single-source IP anomalies. Prompt detection of such distributed activities is essential to thwart unauthorized access attempts, prevent account compromises, and mitigate the risk of further malicious activities within the organization's network. A true positive alert from this analytic suggests an active distributed password spraying attack against the organization's Azure AD tenant. A successful attack could result in unauthorized access, particularly to accounts with elevated privileges, leading to data breaches, privilege escalation, persistent threats, and lateral movement within the organization's infrastructure.
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category. The thresholds set within the analytic (such as unique IPs, unique users, etc.) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Weaponization", "Exploitation"], "mitre_attack": ["T1586", "T1586.003", "T1110", "T1110.003", "T1110.004"], "nist": ["DE.AE"]}
known_false_positives = This detection may yield false positives in scenarios where legitimate bulk sign-in activities occur, such as during company-wide system updates or when users are accessing resources from varying locations in a short time frame, such as in the case of VPNs or cloud services that rotate IP addresses. Filter as needed.
providing_technologies = null
[savedsearch://ESCU - Azure AD Multiple AppIDs and UserAgents Authentication Spike - Rule]
type = detection
asset_type = Azure AD Tenant
confidence = medium
explanation = This analytic is crafted to identify unusual and potentially malicious authentication activity within an Azure AD environment. It triggers when a single user account is involved in more than 8 authentication attempts, using 3 or more unique application IDs and more than 5 unique user agents within a short timeframe. This pattern is atypical for regular user behavior and may indicate an adversary's attempt to probe the environment, testing for multi-factor authentication requirements across different applications and platforms. The detection is based on analysis of Azure AD audit logs, specifically focusing on authentication events. It employs statistical thresholds to highlight instances where the volume of authentication attempts and the diversity of application IDs and user agents associated with a single user account exceed normal parameters. Identifying this behavior is crucial as it provides an early indication of potential account compromise. Adversaries, once in possession of user credentials, often conduct reconnaissance to understand the security controls in place, including multi-factor authentication configurations. Tools like Invoke-MFASweep are commonly used for this purpose, automating the process of testing different user agents and application IDs to bypass MFA. By detecting these initial probing attempts, security teams can swiftly respond, potentially stopping an attack in its early stages and preventing further unauthorized access. This proactive stance is vital for maintaining the integrity of the organization's security posture. If validated as a true positive, this detection points to a compromised account, signaling that an attacker is actively attempting to navigate security controls to maintain access and potentially escalate privileges. This could lead to further exploitation, lateral movement within the network, and eventual data exfiltration. Recognizing and responding to this early stage of an attack is vital for preventing substantial harm and safeguarding sensitive organizational data and systems.
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078"], "nist": ["DE.AE"]}
known_false_positives = Rapid authentication from the same user using more than 5 different user agents and 3 application IDs is highly unlikely under normal circumstances. However, there are potential scenarios that could lead to false positives.
providing_technologies = null
[savedsearch://ESCU - Azure AD Multiple Denied MFA Requests For User - Rule]
type = detection
asset_type = Azure Active Directory
confidence = medium
explanation = This analytic targets the detection of an unusually high number of denied Multi-Factor Authentication (MFA) requests for a single user within a 10-minute window, specifically identifying instances where more than nine MFA prompts were declined by the user. Utilizing Azure Active Directory (Azure AD) sign-in logs, particularly focusing on "Sign-in activity" events, it filters for scenarios where the MFA request was denied due to the user declining the authentication, as indicated by error code 500121 and additional details stating "MFA denied; user declined the authentication." The data is then aggregated into 10-minute intervals, counting distinct raw events and capturing the earliest and latest times of occurrence for each user. This behavior is significant for a Security Operations Center (SOC) as it could be an early indicator of a targeted attack or an account compromise attempt, with an attacker having obtained the user's credentials and the user actively declining the MFA prompts, preventing unauthorized access. A true positive detection would imply that an attacker is on the verge of gaining full access to the user's account, posing a threat that could lead to data exfiltration, lateral movement, or further malicious activities within the organization, necessitating immediate investigation and response to safeguard the organization's assets.
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Signin log category.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
known_false_positives = Multiple denifed MFA requests in a short period of span may also be a sign of authentication errors. Investigate and filter as needed.
providing_technologies = null
[savedsearch://ESCU - Azure AD Multiple Failed MFA Requests For User - Rule]
type = detection
asset_type = Azure Active Directory
confidence = medium
explanation = The following analytic identifies multiple failed multi-factor authentication requests for a single user within an Azure AD tenant. Error Code 500121 represents a failed attempt to authenticate using a second factor. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. Azure AD tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category.
explanation = The following analytic identifies multiple failed multi-factor authentication requests for a single user within an Azure AD tenant. Error Code 500121 represents a failed attempt to authenticate using a second factor. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. The reasons for these failure could be several, like the user not responding in time or receiving multiple duplicate MFA requests. Azure AD tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Signin log category.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Weaponization", "Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1586", "T1586.003", "T1621", "T1078", "T1078.004"], "nist": ["DE.CM"]}
known_false_positives = Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
providing_technologies = null
@@ -1599,6 +1669,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
known_false_positives = In most organizations, domain federation settings will be updated infrequently. Filter as needed.
providing_technologies = null
[savedsearch://ESCU - Azure AD New MFA Method Registered - Rule]
type = detection
asset_type = Azure AD
confidence = medium
explanation = This analytic detects the registration of a new Multi-Factor Authentication (MFA) method associated with a user account within Azure Active Directory by monitoring Azure AD audit logs and configurations. While adding a new MFA method can be a routine and legitimate action, it can also be indicative of an attacker's attempt to maintain persistence on a compromised account. By registering a new MFA method, attackers can potentially bypass existing security measures, allowing them to authenticate using stolen credentials without raising alarms. Monitoring for such changes is crucial, especially if the addition is not preceded by a user request or if it deviates from typical user behavior. If an attacker successfully registers a new MFA method on a compromised account, they can solidify their access, making it harder for legitimate users to regain control. The attacker can then operate with the privileges of the compromised account, potentially accessing sensitive data, making unauthorized changes, or even escalating their privileges further. Immediate action would be required to verify the legitimacy of the MFA change and, if malicious, to remediate and secure the affected account.
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1098", "T1098.005"], "nist": ["DE.CM"]}
known_false_positives = Users may register MFA methods legitimally, investigate and filter as needed.
providing_technologies = null
[savedsearch://ESCU - Azure AD New MFA Method Registered For User - Rule]
type = detection
asset_type = Azure Active Directory
@@ -1609,6 +1689,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Insta
known_false_positives = Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
providing_technologies = null
[savedsearch://ESCU - Azure AD OAuth Application Consent Granted By User - Rule]
type = detection
asset_type = Azure AD
confidence = medium
explanation = This analytic detects when a user in an Azure AD environment grants consent to an OAuth application, capturing any consent granted regardless of the specific permissions requested. Utilizing Azure AD audit logs, it focuses on events related to OAuth application consents, alerting security teams to instances where users actively grant consent to applications. This monitoring is crucial as it highlights potential risks associated with third-party applications gaining access to organizational data, a tactic often exploited by malicious actors to gain unauthorized access. A true positive from this analytic necessitates immediate investigation to validate the application's legitimacy, review the granted permissions, and assess potential risks, helping to prevent unauthorized access and protect sensitive data and resources. While false positives may occur with legitimate application integrations, ensuring alignment with organizational policies and security best practices is paramount.
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1528"], "nist": ["DE.CM"]}
known_false_positives = False positives may occur if users are granting consents as part of legitimate application integrations or setups. It is crucial to review the application and the permissions it requests to ensure they align with organizational policies and security best practices.
providing_technologies = null
[savedsearch://ESCU - Azure AD PIM Role Assigned - Rule]
type = detection
asset_type = Azure Active Directory
@@ -1719,6 +1809,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Weaponization", "Expl
known_false_positives = Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
providing_technologies = null
[savedsearch://ESCU - Azure AD Tenant Wide Admin Consent Granted - Rule]
type = detection
asset_type = Azure AD
confidence = medium
explanation = The following analytic identifies instances where admin consent is granted to an application within an Azure AD tenant. It leverages Azure AD audit logs, specifically events related to the admin consent action within the ApplicationManagement category. The admin consent action allows applications to access data across the entire tenant, potentially encompassing a vast amount of organizational data. Given its broad scope and the sensitivity of some permissions that can only be granted via admin consent, it's crucial to monitor this action. Unauthorized or inadvertent granting of admin consent can lead to significant security risks, including data breaches, unauthorized data access, and potential compliance violations. If an attacker successfully tricks an administrator into granting admin consent to a malicious or compromised application, they can gain extensive and persistent access to organizational data. This can lead to data exfiltration, espionage, further malicious activities within the tenant, and potential breaches of compliance regulations
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Auditlogs log category.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1098", "T1098.003"], "nist": ["DE.CM"]}
known_false_positives = Legitimate applications may be granted tenant wide consent, filter as needed.
providing_technologies = null
[savedsearch://ESCU - Azure AD Unusual Number of Failed Authentications From Ip - Rule]
type = detection
asset_type = Azure Active Directory
@@ -1731,6 +1831,26 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Weaponization", "Expl
known_false_positives = A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
providing_technologies = null
[savedsearch://ESCU - Azure AD User Consent Blocked for Risky Application - Rule]
type = detection
asset_type = Azure AD tenant
confidence = medium
explanation = The following analytic identifies instances where Azure AD has blocked a user's attempt to grant consent to an application deemed risky or potentially malicious. This suggests that the application has exhibited behaviors or characteristics that are commonly associated with malicious intent or poses a security risk. This detection leverages the Azure AD audit logs, specifically focusing on events related to user consent actions and system-driven blocks. By filtering for blocked consent actions associated with applications, the analytic highlights instances where Azure's built-in security measures have intervened. Applications that are flagged and blocked by Azure typically exhibit suspicious characteristics or behaviors. Monitoring for these blocked consent attempts helps security teams identify potential threats early on and can provide insights into users who might be targeted or susceptible to such risky applications. It's an essential layer of defense in ensuring that malicious or risky applications don't gain access to organizational data. If the detection is a true positive, it indicates that the built-in security measures of O365 successfully prevented a potentially harmful application from gaining access. However, the attempt itself suggests that either a user might be targeted or that there's a presence of malicious applications trying to infiltrate the organization. Immediate investigation is required to understand the context of the block and to take further preventive measures.
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1528"], "nist": ["DE.CM"]}
known_false_positives = UPDATE_KNOWN_FALSE_POSITIVES
providing_technologies = null
[savedsearch://ESCU - Azure AD User Consent Denied for OAuth Application - Rule]
type = detection
asset_type = Azure AD
confidence = medium
explanation = The following analytic identifies instances where a user has actively denied consent to an OAuth application seeking permissions within the Azure AD environment. This suggests that the user either recognized something suspicious about the application or chose not to grant it the requested permissions for other reasons. This detection leverages the Azure AD's audit logs, specifically focusing on events related to user consent actions. By filtering for denied consent actions associated with OAuth applications, the analytic captures instances where users have actively rejected permission requests. While user-denied consents can be routine, they can also be indicative of users spotting potentially suspicious or unfamiliar applications. By monitoring these denied consent attempts, security teams can gain insights into applications that might be perceived as risky or untrusted by users. It can also serve as a feedback loop for security awareness training, indicating that users are being cautious about granting permissions. If the detection is a true positive, it indicates that a user has actively prevented an OAuth application from gaining the permissions it requested. While this is a proactive security measure on the user's part, it's essential for security teams to review the context of the denial. Understanding why certain applications are being denied can help in refining application whitelisting policies and ensuring that no malicious applications are attempting to gain access.
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1528"], "nist": ["DE.CM"]}
known_false_positives = Users may deny consent for legitimate applications by mistake, filter as needed.
providing_technologies = null
[savedsearch://ESCU - Azure AD User Enabled And Password Reset - Rule]
type = detection
asset_type = Azure Active Directory
@@ -1905,26 +2025,6 @@ known_false_positives = This is a strictly behavioral search, so we define "fals
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
providing_technologies = null
[savedsearch://ESCU - Correlation by Repository and Risk - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = The following analytic detects by correlating repository and risk score to identify patterns and trends in the data based on the level of risk associated. The analytic adds any null values and calculates the sum of the risk scores for each detection. Then, the analytic captures the source and user information for each detection and sorts the results in ascending order based on the risk score. Finally, the analytic filters the detections with a risk score below 80 and focuses only on high-risk detections.This detection is important because it provides valuable insights into the distribution of high-risk activities across different repositories. It also identifies the most vulnerable repositories that are frequently targeted by potential threats. Additionally, it proactively detects and responds to potential threats, thereby minimizing the impact of attacks and safeguarding critical assets. Finally, it provides a comprehensive view of the risk landscape and helps to make informed decisions to protect the organization's data and infrastructure. False positives might occur so it is important to identify the impact of the attack and prioritize response and mitigation efforts.
how_to_implement = For Dev Sec Ops POC
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["DE.AE"]}
known_false_positives = unknown
providing_technologies = null
[savedsearch://ESCU - Correlation by User and Risk - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = The following analytic detects the correlation between the user and risk score and identifies users with a high risk score that pose a significant security risk such as unauthorized access attempts, suspicious behavior, or potential insider threats. Next, the analytic calculates the sum of the risk scores and groups the results by user, the corresponding signals, and the repository. The results are sorted in descending order based on the risk score and filtered to include records with a risk score greater than 80. Finally, the results are passed through a correlation filter specific to the user and risk. This detection is important because it identifies users who have a high risk score and helps to prioritize investigations and allocate resources. False positives might occur but the impact of such an attack can vary depending on the specific scenario such as data exfiltration, system compromise, or the disruption of critical services. Please investigate this notable event.
how_to_implement = For Dev Sec Ops POC
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["DE.AE"]}
known_false_positives = unknown
providing_technologies = null
[savedsearch://ESCU - Detect AWS Console Login by New User - Rule]
type = detection
asset_type = AWS Instance
@@ -2425,6 +2525,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
known_false_positives = unknown
providing_technologies = null
[savedsearch://ESCU - Risk Rule for Dev Sec Ops by Repository - Rule]
type = detection
asset_type = Amazon Elastic Container Registry
confidence = medium
explanation = The following analytic detects by correlating repository and risk score to identify patterns and trends in the data based on the level of risk associated. The analytic adds any null values and calculates the sum of the risk scores for each detection. Then, the analytic captures the source and user information for each detection and sorts the results in ascending order based on the risk score. Finally, the analytic filters the detections with a risk score below 80 and focuses only on high-risk detections.This detection is important because it provides valuable insights into the distribution of high-risk activities across different repositories. It also identifies the most vulnerable repositories that are frequently targeted by potential threats. Additionally, it proactively detects and responds to potential threats, thereby minimizing the impact of attacks and safeguarding critical assets. Finally, it provides a comprehensive view of the risk landscape and helps to make informed decisions to protect the organization's data and infrastructure. False positives might occur so it is important to identify the impact of the attack and prioritize response and mitigation efforts.
how_to_implement = Ensure that all relevant detections in the Dev Sec Ops analytic stories are enabled and are configured to create risk events in Enterprise Security.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["DE.AE"]}
known_false_positives = Unknown
providing_technologies = null
[savedsearch://ESCU - Abnormally High AWS Instances Launched by User - Rule]
type = detection
asset_type = AWS Instance
@@ -2541,6 +2651,26 @@ annotations = {"cis20": ["CIS 13"], "nist": ["DE.AE"]}
known_false_positives = It's possible that a user has legitimately deleted a network ACL.
providing_technologies = ["Amazon Web Services - Cloudtrail"]
[savedsearch://ESCU - Correlation by Repository and Risk - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = The following analytic detects by correlating repository and risk score to identify patterns and trends in the data based on the level of risk associated. The analytic adds any null values and calculates the sum of the risk scores for each detection. Then, the analytic captures the source and user information for each detection and sorts the results in ascending order based on the risk score. Finally, the analytic filters the detections with a risk score below 80 and focuses only on high-risk detections.This detection is important because it provides valuable insights into the distribution of high-risk activities across different repositories. It also identifies the most vulnerable repositories that are frequently targeted by potential threats. Additionally, it proactively detects and responds to potential threats, thereby minimizing the impact of attacks and safeguarding critical assets. Finally, it provides a comprehensive view of the risk landscape and helps to make informed decisions to protect the organization's data and infrastructure. False positives might occur so it is important to identify the impact of the attack and prioritize response and mitigation efforts.
how_to_implement = For Dev Sec Ops POC
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["DE.AE"]}
known_false_positives = unknown
providing_technologies = null
[savedsearch://ESCU - Correlation by User and Risk - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = The following analytic detects the correlation between the user and risk score and identifies users with a high risk score that pose a significant security risk such as unauthorized access attempts, suspicious behavior, or potential insider threats. Next, the analytic calculates the sum of the risk scores and groups the results by user, the corresponding signals, and the repository. The results are sorted in descending order based on the risk score and filtered to include records with a risk score greater than 80. Finally, the results are passed through a correlation filter specific to the user and risk. This detection is important because it identifies users who have a high risk score and helps to prioritize investigations and allocate resources. False positives might occur but the impact of such an attack can vary depending on the specific scenario such as data exfiltration, system compromise, or the disruption of critical services. Please investigate this notable event.
how_to_implement = For Dev Sec Ops POC
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["DE.AE"]}
known_false_positives = unknown
providing_technologies = null
[savedsearch://ESCU - Detect Activity Related to Pass the Hash Attacks - Rule]
type = detection
asset_type = Endpoint
@@ -9934,6 +10064,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command And Control"]
known_false_positives = False positives may be present. Filter based on pipe name or process.
providing_technologies = null
[savedsearch://ESCU - Windows AutoIt3 Execution - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = The following analytic is designed to detect any execution of AutoIt3, a scripting language designed for automating the Windows GUI and general scripting. This includes instances where AutoIt3 has been renamed or otherwise altered in an attempt to evade detection. The analytic works by searching for process names or original file names that match 'autoit3.exe', which is the default executable for AutoIt scripts. This detection is important as AutoIt3 is often used by attackers to automate malicious activities, such as the execution of malware or other unwanted software. False positives may occur with legitimate uses of AutoIt3.
how_to_implement = The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
known_false_positives = False positives may be present if the application is legitimately used, filter by user or endpoint as needed.
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
[savedsearch://ESCU - Windows Autostart Execution LSASS Driver Registry Modification - Rule]
type = detection
asset_type = Endpoint
@@ -9984,6 +10124,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
known_false_positives = False positives may be present on recent Windows Operating Systems. Filtering may be required based on process_name. In addition, look for non-standard, unsigned, module loads into LSASS. If query is too noisy, modify by adding Endpoint.processes process_name to query to identify the process making the modification.
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
[savedsearch://ESCU - Windows CAB File on Disk - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = The following analytic identifies .cab files being written to disk. Utilize this analytic as a way to hunt for suspect .cab files being written to non-standard paths and tune as needed. Cab files were recently being utilized to deliver .url files embedded. The .url files were then used to deliver malicious payloads. The search specifically looks for instances where the file name is '*.cab' and the action is 'write'. During the triage process, it is recommended to review the file path for additional artifacts that may provide further insights into the event.
how_to_implement = The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001"], "nist": ["DE.AE"]}
known_false_positives = False positives will only be present if a process legitimately writes a .cab file to disk. Modify the analytic as needed by file path. Filter as needed.
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
[savedsearch://ESCU - Windows Cached Domain Credentials Reg Query - Rule]
type = detection
asset_type = Endpoint
@@ -10104,6 +10254,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
known_false_positives = It is possible third party applications may add these SPNs to Computer Accounts, filtering may be needed.
providing_technologies = ["Microsoft Windows"]
[savedsearch://ESCU - Windows ConHost with Headless Argument - Rule]
type = detection
asset_type = endpoint
confidence = medium
explanation = The following analytic detects the unusual use of the Windows Console Host process (conhost.exe) with the undocumented --headless parameter to spawn a new process. This behavior is highly unusual and indicative of suspicious activity, as the --headless parameter is not commonly used in legitimate operations. The analytic identifies this behavior by looking for instances where conhost.exe is invoked with the --headless argument. This behavior is worth identifying for a Security Operations Center (SOC) as it could indicate an attacker's attempt to execute commands or scripts in a stealthy manner, potentially to establish persistence, perform lateral movement, or carry out other malicious activities. If a true positive is identified, it suggests that an attacker has gained a foothold in the environment and is attempting to further their attack, which could lead to serious consequences such as data exfiltration, system compromise, or deployment of ransomware. Potential false positives could arise from legitimate administrative activity, hence it is important to validate the context of the detected behavior during triage.
how_to_implement = The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.003", "T1564.006"], "nist": ["DE.CM"]}
known_false_positives = False positives may be present if the application is legitimately used, filter by user or endpoint as needed.
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
[savedsearch://ESCU - Windows Create Local Account - Rule]
type = detection
asset_type = Endpoint
@@ -11548,6 +11708,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
known_false_positives = False positives will be present with MSIExec spawning Cmd or PowerShell. Filtering will be needed. In addition, add other known discovery processes to enhance query.
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
[savedsearch://ESCU - Windows MSIExec Spawn WinDBG - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = This analytic identifies the unusual behavior of MSIExec spawning WinDBG. It is designed to detect potential malicious activities. The search specifically looks for instances where the parent process name is 'msiexec.exe' and the process name is 'windbg.exe'. During the triage process, it is recommended to review the file path for additional artifacts that may provide further insights into the event.
how_to_implement = The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007"], "nist": ["DE.CM"]}
known_false_positives = False positives will only be present if the MSIExec process legitimately spawns WinDBG. Filter as needed.
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
[savedsearch://ESCU - Windows MSIExec Unregister DLLRegisterServer - Rule]
type = detection
asset_type = Endpoint
@@ -13104,6 +13274,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Explo
known_false_positives = False positives will be present. Drill down into the driver further by version number and cross reference by signer. Review the reference material in the lookup. In addition, modify the query to look within specific paths, which will remove a lot of "normal" drivers.
providing_technologies = null
[savedsearch://ESCU - Windows WinDBG Spawning AutoIt3 - Rule]
type = detection
asset_type = Endpoint
confidence = medium
explanation = The following analytic identifies instances of the WinDBG process spawning AutoIt3. This behavior may indicate malicious activity as AutoIt3 is often used by threat actors for scripting malicious automation. The search specifically looks for instances where the parent process name is 'windbg.exe' and the process name is 'autoit3.exe' or 'autoit*.exe'. During the triage process, it is recommended to review the file path for additional artifacts that may provide further insights into the event.
how_to_implement = The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
known_false_positives = False positives will only be present if the WinDBG process legitimately spawns AutoIt3. Filter as needed.
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
[savedsearch://ESCU - Windows WinLogon with Public Network Connection - Rule]
type = detection
asset_type = Endpoint
@@ -14555,7 +14735,7 @@ version = 2
references = ["https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis", "https://azure.microsoft.com/en-us/services/active-directory/#overview", "https://attack.mitre.org/techniques/T1586/", "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad", "https://www.imperva.com/learn/application-security/account-takeover-ato/", "https://www.varonis.com/blog/azure-active-directory", "https://www.barracuda.com/glossary/account-takeover"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
spec_version = 3
searches = ["ESCU - Azure Active Directory High Risk Sign-in - Rule", "ESCU - Azure AD Authentication Failed During MFA Challenge - Rule", "ESCU - Azure AD Concurrent Sessions From Different Ips - Rule", "ESCU - Azure AD High Number Of Failed Authentications For User - Rule", "ESCU - Azure AD High Number Of Failed Authentications From Ip - Rule", "ESCU - Azure AD Multi-Factor Authentication Disabled - Rule", "ESCU - Azure AD Multiple Failed MFA Requests For User - Rule", "ESCU - Azure AD Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - Azure AD New MFA Method Registered For User - Rule", "ESCU - Azure AD Successful Authentication From Different Ips - Rule", "ESCU - Azure AD Successful PowerShell Authentication - Rule", "ESCU - Azure AD Successful Single-Factor Authentication - Rule", "ESCU - Azure AD Unusual Number of Failed Authentications From Ip - Rule"]
searches = ["ESCU - Azure Active Directory High Risk Sign-in - Rule", "ESCU - Azure AD Authentication Failed During MFA Challenge - Rule", "ESCU - Azure AD Block User Consent For Risky Apps Disabled - Rule", "ESCU - Azure AD Concurrent Sessions From Different Ips - Rule", "ESCU - Azure AD Device Code Authentication - Rule", "ESCU - Azure AD High Number Of Failed Authentications For User - Rule", "ESCU - Azure AD High Number Of Failed Authentications From Ip - Rule", "ESCU - Azure AD Multi-Factor Authentication Disabled - Rule", "ESCU - Azure AD Multi-Source Failed Authentications Spike - Rule", "ESCU - Azure AD Multiple AppIDs and UserAgents Authentication Spike - Rule", "ESCU - Azure AD Multiple Denied MFA Requests For User - Rule", "ESCU - Azure AD Multiple Failed MFA Requests For User - Rule", "ESCU - Azure AD Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - Azure AD New MFA Method Registered For User - Rule", "ESCU - Azure AD OAuth Application Consent Granted By User - Rule", "ESCU - Azure AD Successful Authentication From Different Ips - Rule", "ESCU - Azure AD Successful PowerShell Authentication - Rule", "ESCU - Azure AD Successful Single-Factor Authentication - Rule", "ESCU - Azure AD Unusual Number of Failed Authentications From Ip - Rule", "ESCU - Azure AD User Consent Blocked for Risky Application - Rule", "ESCU - Azure AD User Consent Denied for OAuth Application - Rule"]
description = Monitor for activities and techniques associated with Account Takover attacks against Azure Active Directory tenants.
narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.
@@ -14566,7 +14746,7 @@ version = 1
references = ["https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis", "https://azure.microsoft.com/en-us/services/active-directory/#overview", "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad", "https://attack.mitre.org/tactics/TA0003/", "https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/Persistence/"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
spec_version = 3
searches = ["ESCU - Azure AD External Guest User Invited - Rule", "ESCU - Azure AD Global Administrator Role Assigned - Rule", "ESCU - Azure AD New Custom Domain Added - Rule", "ESCU - Azure AD New Federated Domain Added - Rule", "ESCU - Azure AD PIM Role Assigned - Rule", "ESCU - Azure AD PIM Role Assignment Activated - Rule", "ESCU - Azure AD Privileged Role Assigned - Rule", "ESCU - Azure AD Service Principal Created - Rule", "ESCU - Azure AD Service Principal New Client Credentials - Rule", "ESCU - Azure AD Service Principal Owner Added - Rule", "ESCU - Azure AD User Enabled And Password Reset - Rule", "ESCU - Azure AD User ImmutableId Attribute Updated - Rule", "ESCU - Azure Automation Account Created - Rule", "ESCU - Azure Automation Runbook Created - Rule", "ESCU - Azure Runbook Webhook Created - Rule"]
searches = ["ESCU - Azure AD External Guest User Invited - Rule", "ESCU - Azure AD Global Administrator Role Assigned - Rule", "ESCU - Azure AD New Custom Domain Added - Rule", "ESCU - Azure AD New Federated Domain Added - Rule", "ESCU - Azure AD New MFA Method Registered - Rule", "ESCU - Azure AD PIM Role Assigned - Rule", "ESCU - Azure AD PIM Role Assignment Activated - Rule", "ESCU - Azure AD Privileged Role Assigned - Rule", "ESCU - Azure AD Service Principal Created - Rule", "ESCU - Azure AD Service Principal New Client Credentials - Rule", "ESCU - Azure AD Service Principal Owner Added - Rule", "ESCU - Azure AD Tenant Wide Admin Consent Granted - Rule", "ESCU - Azure AD User Enabled And Password Reset - Rule", "ESCU - Azure AD User ImmutableId Attribute Updated - Rule", "ESCU - Azure Automation Account Created - Rule", "ESCU - Azure Automation Runbook Created - Rule", "ESCU - Azure Runbook Webhook Created - Rule"]
description = Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants.
narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants.
@@ -14960,6 +15140,20 @@ searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - CMD Carry Out S
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the DcRat malware including ddos, spawning more process, botnet c2 communication, defense evasion and etc. The DcRat malware is known commercial backdoor that was first released in 2018. This tool was sold in underground forum and known to be one of the cheapest commercial RATs. DcRat is modular and bespoke plugin framework make it a very flexible option, helpful for a range of nefearious uses.
narrative = Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal.
[analytic_story://DarkGate Malware]
category = Adversary Tactics
last_updated = 2023-10-31
version = 1
references = ["https://github.security.telekom.com/2023/08/darkgate-loader.html", "https://redcanary.com/blog/intelligence-insights-october-2023"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
spec_version = 3
searches = ["ESCU - Windows AutoIt3 Execution - Rule", "ESCU - Windows CAB File on Disk - Rule", "ESCU - Windows MSIExec Spawn WinDBG - Rule", "ESCU - Windows WinDBG Spawning AutoIt3 - Rule"]
description = Telekom Security CTI has uncovered a new phishing-driven malware campaign distributing DarkGate malware. This campaign utilizes stolen email threads to trick users into downloading malicious payloads via hyperlinks. An initial false link to Emotet stirred the security community, but deeper analysis confirmed its true identity as DarkGate, with characteristics like AutoIt scripts and a known command-and-control protocol. This report by Fabian Marquardt details the intricate infection mechanisms, including MSI and VBS file deliveries, sophisticated evasion techniques, and a robust configuration extraction method surpassing current standards. The single developer behind DarkGate, active on cybercrime forums, has shifted the malware's use from private to a rent-out model, implying an expected rise in its deployment. Researchers have also developed a decryption technique for the DarkGate malware, which aids in static analysis and detection, though it requires careful validation to avoid false positives.
narrative = Telekom Security CTi has recently put a spotlight on the proliferation of DarkGate malware via a sophisticated malspam campaign, initially mistaken for the notorious Emotet malware. The campaign smartly manipulates stolen email conversations, embedding hyperlinks that, once clicked, activate a malware download. Fabian Marquardt's analysis traces the infection's footprint, revealing a dual delivery mechanism through MSI and VBS files. These files, cloaked in legitimate wrappers or obscured with junk code, ultimately download the malware via embedded scripts. \
Marquardt delves into the AutoIt script-based infection, uncovering the calculated use of compiled scripts and base64-encoded data to disguise the execution of malicious shellcode. The subsequent stages of infection exhibit the malware's capability to evade detection, leveraging memory allocation techniques to bypass security measures. Marquardt also explores the loader's function, which decrypts further malicious payloads by interacting with the script's encoded components. \
The analytical narrative captures a cross-section of the cybersecurity landscape, reflecting the shift in DarkGate's operational strategy from exclusive use by the developer to a broader dissemination through a Malware-as-a-Service (MaaS) model. This transition suggests an anticipated escalation in DarkGate-related attacks. \
Significantly, the report contributes to cybersecurity defenses by outlining a more effective method for extracting malware configurations, providing the community with the means to anticipate and mitigate the evolving threats posed by this pernicious malware. With the insights gained, researchers and security professionals are better equipped to adapt their strategies, constructing more robust defenses against the sophisticated tactics employed by DarkGate and similar malware strains.
[analytic_story://Data Destruction]
category = Malware
last_updated = 2023-04-06
@@ -15178,7 +15372,7 @@ version = 1
references = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}]
spec_version = 3
searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Circle CI Disable Security Job - Rule", "ESCU - Circle CI Disable Security Step - Rule", "ESCU - Correlation by Repository and Risk - Rule", "ESCU - Correlation by User and Risk - Rule", "ESCU - GitHub Actions Disable Security Workflow - Rule", "ESCU - Github Commit Changes In Master - Rule", "ESCU - Github Commit In Develop - Rule", "ESCU - GitHub Dependabot Alert - Rule", "ESCU - GitHub Pull Request from Unknown User - Rule", "ESCU - Gsuite Drive Share In External Email - Rule", "ESCU - GSuite Email Suspicious Attachment - Rule", "ESCU - Gsuite Email Suspicious Subject With Attachment - Rule", "ESCU - Gsuite Email With Known Abuse Web Service Link - Rule", "ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - Gsuite Suspicious Shared File Name - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule"]
searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Circle CI Disable Security Job - Rule", "ESCU - Circle CI Disable Security Step - Rule", "ESCU - GitHub Actions Disable Security Workflow - Rule", "ESCU - Github Commit Changes In Master - Rule", "ESCU - Github Commit In Develop - Rule", "ESCU - GitHub Dependabot Alert - Rule", "ESCU - GitHub Pull Request from Unknown User - Rule", "ESCU - Gsuite Drive Share In External Email - Rule", "ESCU - GSuite Email Suspicious Attachment - Rule", "ESCU - Gsuite Email Suspicious Subject With Attachment - Rule", "ESCU - Gsuite Email With Known Abuse Web Service Link - Rule", "ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - Gsuite Suspicious Shared File Name - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule", "ESCU - Risk Rule for Dev Sec Ops by Repository - Rule", "ESCU - Correlation by Repository and Risk - Rule", "ESCU - Correlation by User and Risk - Rule"]
description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter.
@@ -16299,7 +16493,7 @@ version = 1
references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}]
spec_version = 3
searches = ["ESCU - Gdrive suspicious file sharing - Rule", "ESCU - Gsuite suspicious calendar invite - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule", "ESCU - Detect RTLO In File Name - Rule", "ESCU - Detect RTLO In Process - Rule", "ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Windows Script Host - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Office Product Spawning MSDT - Rule", "ESCU - Windows Phishing PDF File Executes URL Link - Rule", "ESCU - Windows Spearphishing Attachment Connect To None MS Office Domain - Rule", "ESCU - Windows Spearphishing Attachment Onenote Spawn Mshta - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Winword Spawning Windows Script Host - Rule"]
searches = ["ESCU - Gdrive suspicious file sharing - Rule", "ESCU - Gsuite suspicious calendar invite - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule", "ESCU - Detect RTLO In File Name - Rule", "ESCU - Detect RTLO In Process - Rule", "ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Windows Script Host - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Windows ConHost with Headless Argument - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Office Product Spawning MSDT - Rule", "ESCU - Windows Phishing PDF File Executes URL Link - Rule", "ESCU - Windows Spearphishing Attachment Connect To None MS Office Domain - Rule", "ESCU - Windows Spearphishing Attachment Onenote Spawn Mshta - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Winword Spawning Windows Script Host - Rule"]
description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack.
narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \
As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \
@@ -16312,12 +16506,12 @@ This Analytic Story focuses on detecting signs that a malicious payload has been
[analytic_story://Splunk Vulnerabilities]
category = Best Practices
last_updated = 2022-03-28
last_updated = 2023-11-16
version = 1
references = ["https://www.splunk.com/en_us/product-security/announcements.html"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
spec_version = 3
searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Absolute Path Traversal Using runshellscript - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS Using Malformed SAML Request - Rule", "ESCU - Splunk DOS Via Dump SPL Command - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk DOS via printf search function - Rule", "ESCU - Splunk Edit User Privilege Escalation - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule", "ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule", "ESCU - Splunk list all nonstandard admin accounts - Rule", "ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule", "ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule", "ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule", "ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule", "ESCU - Splunk RCE via Serialized Session Payload - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway Splunk Mobile alerts feature - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk Reflected XSS on App Search Table Endpoint - Rule", "ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule", "ESCU - Splunk Stored XSS via Data Model objectName field - Rule", "ESCU - Splunk Unauthenticated Log Injection Web Service Log - Rule", "ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Splunk XSS via View - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Absolute Path Traversal Using runshellscript - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk App for Lookup File Editing RCE via User XSLT - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS Using Malformed SAML Request - Rule", "ESCU - Splunk DOS Via Dump SPL Command - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk DOS via printf search function - Rule", "ESCU - Splunk Edit User Privilege Escalation - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk HTTP Response Splitting Via Rest SPL Command - Rule", "ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule", "ESCU - Splunk list all nonstandard admin accounts - Rule", "ESCU - Splunk Low Privilege User Can View Hashed Splunk Password - Rule", "ESCU - Splunk Path Traversal In Splunk App For Lookup File Edit - Rule", "ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule", "ESCU - Splunk Persistent XSS Via URL Validation Bypass W Dashboard - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RBAC Bypass On Indexing Preview REST Endpoint - Rule", "ESCU - Splunk RCE via Serialized Session Payload - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway Splunk Mobile alerts feature - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk Reflected XSS on App Search Table Endpoint - Rule", "ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule", "ESCU - Splunk Stored XSS via Data Model objectName field - Rule", "ESCU - Splunk Unauthenticated Log Injection Web Service Log - Rule", "ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Highlighted JSON Events - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Splunk XSS via View - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product.
narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly.
@@ -16624,6 +16818,17 @@ searches = ["ESCU - Executables Or Script Creation In Suspicious Path - Rule", "
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the swift slicer malware including overwriting of files and etc.
narrative = Swift Slicer is one of Windows destructive malware found by ESET that was used in a targeted organizarion to wipe critical files like windows drivers and other files to destroy and left the machine inoperable. This malware like Caddy Wiper was deliver through GPO which suggests that the attacker had taken control of the victims active directory environment.
[analytic_story://SysAid On-Prem Software CVE-2023-47246 Vulnerability]
category = Malware
last_updated = 2023-11-09
version = 1
references = ["https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
spec_version = 3
searches = ["ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Webshell Exploit Behavior - Rule", "ESCU - Java Writing JSP File - Rule", "ESCU - Windows Java Spawning Shells - Rule"]
description = A zero-day vulnerability was discovered in SysAid's on-premise software, exploited by the group DEV-0950 (Lace Tempest). The attackers uploaded a WebShell and other payloads, gaining unauthorized access and control. SysAid has released a patch (version 23.3.36) to remediate the vulnerability and urges customers to conduct a comprehensive compromise assessment.
narrative = The analytics tagged to this analytic story will aid in capturing initial access and some post-exploitation activities. In addition to the application spawning a shell, consider reviewing STRT's Cobalt Strike and PowerShell script block logging analytic stories. On November 2nd, SysAid's security team identified a potential vulnerability in their on-premise software. The investigation revealed a zero-day vulnerability exploited by the group known as DEV-0950 (Lace Tempest). The attackers uploaded a WebShell and other payloads into the webroot of the SysAid Tomcat web service, thereby gaining unauthorized access and control over the affected system. SysAid promptly initiated their incident response protocol and began proactive communication with their on-premise customers to implement a mitigation solution. SysAid has released a patch (version 23.3.36) to remediate the vulnerability and strongly recommends all customers to conduct a comprehensive compromise assessment of their network.
[analytic_story://Text4Shell CVE-2022-42889]
category = Adversary Tactics
last_updated = 2022-10-26
dist/DA-ESS-ContentUpdate/default/app.conf
Vendored
+3 -3
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-11-01T20:44:08 UTC
# On Date: 2023-11-16T22:15:55 UTC
# Author: Splunk Threat Research Team - Splunk
# Contact: research@splunk.com
#############
@@ -10,7 +10,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
build = 20231101204321
build = 20231116221053
[triggers]
reload.analytic_stories = simple
@@ -26,7 +26,7 @@ reload.es_investigations = simple
[launcher]
author = Splunk
version = 4.15.0
version = 4.16.0
description = Explore the Analytic Stories included with ES Content Updates.
[ui]
dist/DA-ESS-ContentUpdate/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-11-01T20:44:08 UTC
# On Date: 2023-11-16T22:15:55 UTC
# Author: Splunk Threat Research Team - Splunk
# Contact: research@splunk.com
#############
dist/DA-ESS-ContentUpdate/default/content-version.conf
Vendored
+2 -2
View File
@@ -1,8 +1,8 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-11-01T20:44:08 UTC
# On Date: 2023-11-16T22:15:55 UTC
# Author: Splunk Threat Research Team - Splunk
# Contact: research@splunk.com
#############
[content-version]
version = 4.15.0
version = 4.16.0
dist/DA-ESS-ContentUpdate/default/es_investigations.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-11-01T20:44:08 UTC
# On Date: 2023-11-16T22:15:55 UTC
# Author: Splunk Threat Research Team - Splunk
# Contact: research@splunk.com
#############
dist/DA-ESS-ContentUpdate/default/macros.conf
Vendored
+85 -9
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-11-01T20:44:08 UTC
# On Date: 2023-11-16T22:15:55 UTC
# Author: Splunk Threat Research Team - Splunk
# Contact: research@splunk.com
#############
@@ -117,6 +117,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_app_for_lookup_file_editing_rce_via_user_xslt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_code_injection_via_custom_dashboard_leading_to_rce_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -257,6 +261,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_xss_in_highlighted_json_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_xss_in_monitoring_console_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -593,10 +601,18 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_block_user_consent_for_risky_apps_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_concurrent_sessions_from_different_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_device_code_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_external_guest_user_invited_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -617,6 +633,18 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_multi_source_failed_authentications_spike_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_multiple_appids_and_useragents_authentication_spike_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_multiple_denied_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_multiple_failed_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -633,10 +661,18 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_new_mfa_method_registered_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_new_mfa_method_registered_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_oauth_application_consent_granted_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_pim_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -681,10 +717,22 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_tenant_wide_admin_consent_granted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_unusual_number_of_failed_authentications_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_user_consent_blocked_for_risky_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_user_consent_denied_for_oauth_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_user_enabled_and_password_reset_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -753,14 +801,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[correlation_by_repository_and_risk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[correlation_by_user_and_risk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_aws_console_login_by_new_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -961,6 +1001,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[risk_rule_for_dev_sec_ops_by_repository_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_aws_instances_launched_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1005,6 +1049,14 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[correlation_by_repository_and_risk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[correlation_by_user_and_risk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_activity_related_to_pass_the_hash_attacks_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3897,6 +3949,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_autoit3_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_autostart_execution_lsass_driver_registry_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3917,6 +3973,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_cab_file_on_disk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_cached_domain_credentials_reg_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3965,6 +4025,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_conhost_with_headless_argument_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_create_local_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -4533,6 +4597,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_msiexec_spawn_windbg_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_msiexec_unregister_dllregisterserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -5137,6 +5205,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_windbg_spawning_autoit3_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_winlogon_with_public_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -5610,6 +5682,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
definition = sourcetype=mscs:azure:audit
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[azure_monitor_aad]
definition = sourcetype=azure:monitor:aad
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[azuread]
definition = sourcetype=mscs:azure:eventhub
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
dist/DA-ESS-ContentUpdate/default/savedsearches.conf
Vendored
+899 -116
View File
File diff suppressed because it is too large Load Diff
dist/DA-ESS-ContentUpdate/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-11-01T20:44:08 UTC
# On Date: 2023-11-16T22:15:55 UTC
# Author: Splunk Threat Research Team - Splunk
# Contact: research@splunk.com
#############
dist/DA-ESS-ContentUpdate/default/workflow_actions.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2023-11-01T20:44:08 UTC
# On Date: 2023-11-16T22:15:55 UTC
# Author: Splunk Threat Research Team - Splunk
# Contact: research@splunk.com
#############
dist/api/detections.json
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/api/lookups.json
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/api/macros.json
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/api/response_tasks.json
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/api/stories.json
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/api/version.json
Vendored
+1
View File
@@ -0,0 +1 @@
{"version": {"name": "v4.16.0", "published_at": "2023-11-16T22:23:38Z"}}
dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
Vendored
+3 -3
View File
@@ -1,6 +1,6 @@
name: Attempted Credential Dump From Registry via Reg exe
id: 14038953-e5f2-4daf-acff-5452062baf03
version: 3
version: 4
status: production
description: The following analytic identifies the use of `reg.exe` attempting to
export Windows registry keys that contain hashed credentials. Adversaries will utilize
@@ -12,8 +12,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="reg.exe" OR
process_file_name="cmd.exe") AND (match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true
| eval device_hostname = device.hostname | where (process_file_name IN ("reg.exe",
"cmd.exe")) AND (match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true
OR match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match(process_cmd_line,
/(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match(process_cmd_line, /(?i)HKLM\\System/)=true
OR match(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match(process_cmd_line, /(?i)HKLM\\Security/)=true)
dist/ssa/srs/ssa___delete_a_net_user.yml
Vendored
+2 -2
View File
@@ -1,6 +1,6 @@
name: Delete A Net User
id: 8776d79c-d26e-11eb-9a56-acde48001122
version: 4
version: 5
status: production
description: This analytic will detect a suspicious net.exe/net1.exe command-line
to delete a user on a system. This technique may be use by an administrator for
@@ -16,7 +16,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%"
AND process_cmd_line LIKE "%/delete%" AND (process_file_name="net.exe" OR process_file_name="net1.exe")
AND process_cmd_line LIKE "%/delete%" AND (process_file_name IN ("net.exe", "net1.exe"))
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
dist/ssa/srs/ssa___deleting_shadow_copies.yml
Vendored
+4 -4
View File
@@ -1,6 +1,6 @@
name: Deleting Shadow Copies
id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8
version: 1
version: 2
status: validation
description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy
Service. Wmic is an interface to the Windows Management Instrumentation. This search
@@ -12,9 +12,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="vssadmin.exe"
OR process_file_name="wmic.exe") AND process_cmd_line LIKE "%delete%" AND process_cmd_line
LIKE "%shadow%"
| eval device_hostname = device.hostname | where (process_file_name IN ("vssadmin.exe",
"wmic.exe")) AND process_cmd_line LIKE "%delete%" AND process_cmd_line LIKE "%shadow%"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml
Vendored
+3 -4
View File
@@ -1,6 +1,6 @@
name: Deny Permission using Cacls Utility
id: b76eae28-cd25-11eb-9c92-acde48001122
version: 3
version: 4
status: production
description: The following analytic identifies the use of `cacls.exe`, `icacls.exe`
or `xcacls.exe` placing the deny permission on a file or directory. Adversaries
@@ -13,9 +13,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="icacls.exe"
OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match(process_cmd_line,
/(?i)deny/)=true
| eval device_hostname = device.hostname | where (process_file_name IN ("icacls.exe",
"xcacls.exe", "cacls.exe")) AND match(process_cmd_line, /(?i)deny/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
Vendored
+7 -9
View File
@@ -1,6 +1,6 @@
name: Detect Prohibited Applications Spawning cmd exe
id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
version: 4
version: 5
status: production
description: The following analytic identifies parent processes, browsers, Windows
terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
@@ -13,14 +13,12 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me
= actor_user.name | eval actor_process = actor.process | eval actor_process_pid
= actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path
= actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name)
| eval device_hostname = device.hostname | where ((actor_process_file_name="winword.exe"
OR actor_process_file_name="excel.exe" OR actor_process_file_name="outlook.exe"
OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe"
OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe"
OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe")
OR (actor_process_file_name="java.exe" AND (NOT match(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true))
OR (actor_process_file_name="chrome.exe" AND (NOT process_cmd_line="chrome-extension")))
AND process_file_name="cmd.exe"
| eval device_hostname = device.hostname | where ((actor_process_file_name IN ("winword.exe",
"excel.exe", "outlook.exe", "acrobat.exe", "acrord32.exe", "iexplore.exe", "opera.exe",
"firefox.exe", "powershell.exe")) OR (actor_process_file_name="java.exe" AND (NOT
match(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe"
AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe_browsers.yml
Vendored
+110
View File
@@ -0,0 +1,110 @@
name: Detect Prohibited Applications Spawning cmd exe browsers
id: c10a18cb-fd70-4ffa-a844-25026e0a0c94
version: 2
status: validation
description: The following analytic identifies parent processes that are browsers,
spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or
built into macros. Much of this will need to be tuned to further enhance the risk.
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line
= lower(process.cmd_line) | eval actor_user = actor.user | eval actor_user_name
= actor_user.name | eval actor_process = actor.process | eval actor_process_pid
= actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path
= actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name)
| eval device_hostname = device.hostname | where ((actor_process_file_name IN ("iexplore.exe",
"opera.exe", "firefox.exe")) OR (actor_process_file_name="chrome.exe" AND (NOT process_cmd_line="chrome-extension")))
AND process_file_name="cmd.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Detect Prohibited Applications Spawning cmd exe browsers has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Suspicious Command-Line Executions", "Insider Threat"],
class_name = "Detection Report",
confidence = 50,
confidence_id = 2,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Installation", "phase_id": 5}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 35,
severity_id = 0,
rule = {"name": "Detect Prohibited Applications Spawning cmd exe browsers", "uid": "c10a18cb-fd70-4ffa-a844-25026e0a0c94", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: In order to successfully implement this analytic, you will need
endpoint process data from a EDR product or Sysmon. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
known_false_positives: There are circumstances where an application may legitimately
execute and interact with the Windows command-line interface.
references:
- https://attack.mitre.org/techniques/T1059/
tags:
required_fields:
- process.pid
- process.file.path
- process.file.name
- process.cmd_line
- actor.user.name
- actor.process.pid
- actor.process.file.path
- actor.process.file.name
- device.hostname
risk_score: 35
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd70-4ffa-a844-25026e0a0c94/
event_schema: ocsf
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
cim: process
- ocsf: actor.user.name
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
cim: dest
annotations:
analytic_story:
- Suspicious Command-Line Executions
- Insider Threat
cis20:
- CIS 10
kill_chain_phases:
- Installation
mitre_attack_id:
- T1059
nist:
- DE.AE
test:
name: Detect Prohibited Applications Spawning cmd exe browsers Unit Test
tests:
- name: Detect Prohibited Applications Spawning cmd exe browsers
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ssa_validation/browsers/windows-security.log
source: WinEventLog:Security
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe_office.yml
Vendored
+111
View File
@@ -0,0 +1,111 @@
name: Detect Prohibited Applications Spawning cmd exe office
id: c10a18cb-fd70-4ffa-a844-25026e0b0c94
version: 2
status: validation
description: The following analytic identifies parent processes that are office/productivity
applications, spawning cmd.exe. By its very nature, many applications spawn cmd.exe
natively or built into macros. Much of this will need to be tuned to further enhance
the risk.
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name)
| eval device_hostname = device.hostname | where (actor_process_file_name IN ("winword.exe",
"excel.exe", "outlook.exe", "acrobat.exe", "acrord32.exe")) AND process_file_name="cmd.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Detect Prohibited Applications Spawning cmd exe office has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Suspicious Command-Line Executions", "Insider Threat"],
class_name = "Detection Report",
confidence = 50,
confidence_id = 2,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Installation", "phase_id": 5}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 35,
severity_id = 0,
rule = {"name": "Detect Prohibited Applications Spawning cmd exe office", "uid": "c10a18cb-fd70-4ffa-a844-25026e0b0c94", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: In order to successfully implement this analytic, you will need
endpoint process data from a EDR product or Sysmon. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
known_false_positives: There are circumstances where an application may legitimately
execute and interact with the Windows command-line interface.
references:
- https://attack.mitre.org/techniques/T1059/
tags:
required_fields:
- process.pid
- process.file.path
- process.file.name
- process.cmd_line
- actor.user.name
- actor.process.pid
- actor.process.file.path
- actor.process.file.name
- device.hostname
risk_score: 35
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd70-4ffa-a844-25026e0b0c94/
event_schema: ocsf
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
cim: process
- ocsf: actor.user.name
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
cim: dest
annotations:
analytic_story:
- Suspicious Command-Line Executions
- Insider Threat
cis20:
- CIS 10
kill_chain_phases:
- Installation
mitre_attack_id:
- T1059
nist:
- DE.AE
test:
name: Detect Prohibited Applications Spawning cmd exe office Unit Test
tests:
- name: Detect Prohibited Applications Spawning cmd exe office
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ssa_validation/office/windows-security.log
source: WinEventLog:Security
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe_powershell.yml
Vendored
+109
View File
@@ -0,0 +1,109 @@
name: Detect Prohibited Applications Spawning cmd exe powershell
id: c10a18cb-fd70-4ffa-a844-25126e0b0d94
version: 2
status: validation
description: The following analytic identifies parent processes that are powershell,
spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or
built into macros. Much of this will need to be tuned to further enhance the risk.
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name)
| eval device_hostname = device.hostname | where actor_process_file_name="powershell.exe"
AND process_file_name="cmd.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
message = "Detect Prohibited Applications Spawning cmd exe powershell has been triggered on " + device_hostname + " by " + actor_user_name + ".",
users = [{"name": actor_user_name, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = ["Suspicious Command-Line Executions", "Insider Threat"],
class_name = "Detection Report",
confidence = 50,
confidence_id = 2,
duration = 0,
impact = 70,
impact_id = 4,
kill_chain = [{"phase": "Installation", "phase_id": 5}],
nist = ["DE.AE"],
risk_level = "Low",
category_uid = 2,
class_uid = 102001,
risk_level_id = 1,
risk_score = 35,
severity_id = 0,
rule = {"name": "Detect Prohibited Applications Spawning cmd exe powershell", "uid": "c10a18cb-fd70-4ffa-a844-25126e0b0d94", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink; '
how_to_implement: In order to successfully implement this analytic, you will need
endpoint process data from a EDR product or Sysmon. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
known_false_positives: There are circumstances where an application may legitimately
execute and interact with the Windows command-line interface.
references:
- https://attack.mitre.org/techniques/T1059/
tags:
required_fields:
- process.pid
- process.file.path
- process.file.name
- process.cmd_line
- actor.user.name
- actor.process.pid
- actor.process.file.path
- actor.process.file.name
- device.hostname
risk_score: 35
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd70-4ffa-a844-25126e0b0d94/
event_schema: ocsf
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
cim: process
- ocsf: actor.user.name
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
cim: dest
annotations:
analytic_story:
- Suspicious Command-Line Executions
- Insider Threat
cis20:
- CIS 10
kill_chain_phases:
- Installation
mitre_attack_id:
- T1059
nist:
- DE.AE
test:
name: Detect Prohibited Applications Spawning cmd exe powershell Unit Test
tests:
- name: Detect Prohibited Applications Spawning cmd exe powershell
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
source: WinEventLog:Security
runtime: SPL2
internalVersion: 2
dist/ssa/srs/ssa___disable_net_user_account.yml
Vendored
+2 -2
View File
@@ -1,6 +1,6 @@
name: Disable Net User Account
id: ba858b08-d26c-11eb-af9b-acde48001122
version: 3
version: 4
status: production
description: This analytic will identify a suspicious command-line that disables a
user account using the native `net.exe` or `net1.exe` utility to Windows. This technique
@@ -14,7 +14,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%"
AND process_cmd_line LIKE "%/active:no%" AND (process_file_name="net.exe" OR process_file_name="net1.exe")
AND process_cmd_line LIKE "%/active:no%" AND (process_file_name IN ("net.exe", "net1.exe"))
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml
Vendored
+3 -4
View File
@@ -1,6 +1,6 @@
name: Grant Permission Using Cacls Utility
id: c6da561a-cd29-11eb-ae65-acde48001122
version: 3
version: 4
status: production
description: The following analytic identifies the use of `cacls.exe`, `icacls.exe`
or `xcacls.exe` placing the grant permission on a file or directory. Adversaries
@@ -13,9 +13,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="icacls.exe"
OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match(process_cmd_line,
/(?i)grant/)=true
| eval device_hostname = device.hostname | where (process_file_name IN ("icacls.exe",
"xcacls.exe", "cacls.exe")) AND match(process_cmd_line, /(?i)grant/)=true
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml
Vendored
+2 -3
View File
@@ -1,6 +1,6 @@
name: Modify ACLs Permission Of Files Or Folders
id: 9ae9a48a-cdbe-11eb-875a-acde48001122
version: 3
version: 4
status: production
description: This analytic identifies suspicious modification of ACL permission to
a files or folder to make it available to everyone or to a specific user. This technique
@@ -17,8 +17,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)S-1-1-0:/)=true
OR match(process_cmd_line, /(?i)SYSTEM:/)=true OR match(process_cmd_line, /(?i)everyone:/)=true)
AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
AND (process_file_name IN ("icacls.exe", "xcacls.exe", "cacls.exe"))
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml
Vendored
+6 -6
View File
@@ -1,6 +1,6 @@
name: Office Product Spawning Windows Script Host
id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6
version: 1
version: 2
status: production
description: The following analytic will identify a Windows Office Product spawning
WScript.exe or CScript.exe. Tuning may be required based on legitimate application
@@ -12,11 +12,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="cscript.exe"
OR process_file_name="wscript.exe") AND (match(actor_process_file_name, /(?i)visio.exe/)=true
OR match(actor_process_file_name, /(?i)mspub.exe/)=true OR match(actor_process_file_name,
/(?i)powerpnt.exe/)=true OR match(actor_process_file_name, /(?i)excel.exe/)=true
OR match(actor_process_file_name, /(?i)winword.exe/)=true)
| eval device_hostname = device.hostname | where (process_file_name IN ("cscript.exe",
"wscript.exe")) AND (match(actor_process_file_name, /(?i)visio.exe/)=true OR match(actor_process_file_name,
/(?i)mspub.exe/)=true OR match(actor_process_file_name, /(?i)powerpnt.exe/)=true
OR match(actor_process_file_name, /(?i)excel.exe/)=true OR match(actor_process_file_name,
/(?i)winword.exe/)=true)
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},
dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
name: Services lolbas Execution Process Spawn
id: 0d85fde3-0de9-4eec-b386-6a8ba70f3935
version: 1
version: 2
status: validation
description: The following analytic identifies services.exe spawning a LOLBAS execution
process. When adversaries execute code on remote endpoints abusing the Service Control
dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml
Vendored
+2 -2
View File
@@ -1,6 +1,6 @@
name: System Process Running from Unexpected Location
id: 28179107-099a-464a-94d3-08301e6c055f
version: 4
version: 5
status: production
description: An attacker tries might try to use different version of a system command
without overriding original, or they might try to avoid some detection running the
@@ -10,7 +10,7 @@ description: An attacker tries might try to use different version of a system co
and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid |
eval process_pid = process.pid | eval process_file = process.file | eval process_file_path
= process_file.path | eval process_file_name = process_file.name | eval process_cmd_line
= process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line
= process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
name: Windows LOLBin Binary in Non Standard Path
id: 25689101-012a-324a-94d3-08301e6c065a
version: 4
version: 5
status: production
description: The following analytic identifies native living off the land binaries
within the Windows operating system that may be abused by adversaries by moving
dist/ssa/srs/ssa___windows_mshta_child_process.yml
Vendored
+5 -7
View File
@@ -1,6 +1,6 @@
name: Windows MSHTA Child Process
id: f63f7e9c-9526-11ec-9fc7-acde48001122
version: 2
version: 3
status: production
description: The following analytic identifies child processes spawning from "mshta.exe".
The search will return the first time and last time these command-line arguments
@@ -13,12 +13,10 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me
| eval actor_process = actor.process | eval actor_process_pid = actor_process.pid
| eval actor_process_file = actor_process.file | eval actor_process_file_path =
actor_process_file.path | eval actor_process_file_name = actor_process_file.name
| eval device_hostname = device.hostname | where (process_file_name="wscript.exe"
OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe"
OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe"
OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe"
OR process_file_name="powershell.exe") AND actor_process_file_name LIKE "%mshta.exe"
| eval device_hostname = device.hostname | where (process_file_name IN ("wscript.exe",
"cscript.exe", "searchprotocolhost.exe", "microsoft.workflow.compiler.exe", "msbuild.exe",
"colorcpl.exe", "scrcons.exe", "cmd.exe", "powershell.exe")) AND actor_process_file_name
LIKE "%mshta.exe"
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname},

Some files were not shown because too many files have changed in this diff Show More