From c076fbc6bea35eaadfd54f289e8259bb24da72ee Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 7 Feb 2022 18:52:34 -0500 Subject: [PATCH 01/16] adding analytic story and three new detections --- ...asting_spn_request_with_rc4_encryption.yml | 1 + ...z_passtheticket_commandline_parameters.yml | 68 ++++++++++++++++++ .../rubeus_command_line_parameters.yml | 72 +++++++++++++++++++ ...ticket_exports_through_winlogon_access.yml | 67 +++++++++++++++++ ...incipalnames_discovery_with_powershell.yml | 1 + ...ceprincipalnames_discovery_with_setspn.yml | 1 + stories/active_directory_kerberos_attacks.yml | 22 ++++++ ...stheticket_commandline_parameters.test.yml | 12 ++++ .../rubeus_command_line_parameters.test.yml | 12 ++++ ...t_exports_through_winlogon_access.test.yml | 12 ++++ 10 files changed, 268 insertions(+) create mode 100644 detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml create mode 100644 detections/endpoint/rubeus_command_line_parameters.yml create mode 100644 detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml create mode 100644 stories/active_directory_kerberos_attacks.yml create mode 100644 tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml create mode 100644 tests/endpoint/rubeus_command_line_parameters.test.yml create mode 100644 tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index 70038db580..7ea40e6c1f 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -21,6 +21,7 @@ references: tags: analytic_story: - Windows Privilege Escalation + - Active Directory Kerberos Attacks asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml new file mode 100644 index 0000000000..1dbe7a24d1 --- /dev/null +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -0,0 +1,68 @@ +name: Mimikatz PassTheTicket CommandLine Parameters +id: 13bbd574-83ac-11ec-99d4-acde48001122 +version: 1 +date: '2022-02-01' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. + Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. + Defenders should be aware that adversaries may customize the source code of Mimikatz and modify the command line parameters. This would effectively bypass this analytic. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*sekurlsa::tickets /export*" + OR Processes.process = "*kerberos::ptt*") by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz. +references: +- https://github.com/gentilkiwi/mimikatz +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1550.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 60 + confidence: 60 + risk_score: 36 + context: + - Source:Endpoint + - Stage:PrivilegeEscalation + message: Mimikatz command line parameters for pass the ticket attacks were used on $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process \ No newline at end of file diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml new file mode 100644 index 0000000000..54cc2d20ab --- /dev/null +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -0,0 +1,72 @@ +name: Rubeus Command Line Parameters +id: cca37478-8377-11ec-b59a-acde48001122 +version: 1 +date: '2022-02-01' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs + MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized in common Kerberos attacks like exporting and importing tickets, + forging silver and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory networks. + Defenders should be aware that adversaries may customize the source code of Rubeus and modify the command line parameters. This would effectively bypass this analytic. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*" + OR Processes.process = "* monitor*" OR Processes.process ="* asktgt* /user:*" OR Processes.process ="* asktgs* /service:*" + OR Processes.process ="* golden* /user:*" OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*" + OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*" OR Processes.process = "* brute* /password:*" + OR Processes.process = "* brute* /passwords:*" OR Processes.process ="* harvest*") by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed. +references: +- https://github.com/GhostPack/Rubeus +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1550.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 60 + confidence: 60 + risk_score: 36 + context: + - Source:Endpoint + - Stage:PrivilegeEscalation + message: Rubeus command line parameters were used on $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process \ No newline at end of file diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml new file mode 100644 index 0000000000..2a13663144 --- /dev/null +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -0,0 +1,67 @@ +name: Rubeus Kerberos Ticket Exports Through Winlogon Access +id: 5ed8c50a-8869-11ec-876f-acde48001122 +version: 1 +date: '2022-02-07' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic looks for a process accessing the winlogon.exe system process. The Splunk Threat Research team identified this behavior + when using the Rubeus tool to monitor for and export kerberos tickets from memory. Exporting tickets from memory is typically the first step for pass the ticket attacks. + Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. + Defenders should be aware that adversaries may customize the source code of Rubeus to potentially bypass this analytic. +search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff) + (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND + SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND + SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) + | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage, + SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename + Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`' +how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which + includes EventCode 10.exe. This search uses an input macro named `sysmon`. + We strongly recommend that you specify your environment-specific configurations + (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition + with configurations for your Splunk environment. +known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed +references: +- https://github.com/GhostPack/Rubeus +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log + kill_chain_phases: + - Privilege Escalation + - Lateral Movement + mitre_attack_id: + - T1550.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - TargetImage + - CallTrace + - Computer + - TargetProcessId + - SourceImage + - SourceProcessId + security_domain: endpoint + impact: 60 + confidence: 60 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: Winlogon.exe was accessed by $SourceImage$ on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: TargetImage + type: Process + role: + - Target diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml index ea52e4a955..63098b3965 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml @@ -48,6 +48,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Active Directory Kerberos Attacks automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index 2f456df538..fbe2681a0c 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -66,6 +66,7 @@ tags: impact: 80 kill_chain_phases: - Privilege Escalation + - Active Directory Kerberos Attacks message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names. mitre_attack_id: diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml new file mode 100644 index 0000000000..d261a896d8 --- /dev/null +++ b/stories/active_directory_kerberos_attacks.yml @@ -0,0 +1,22 @@ +name: Active Directory Kerberos Attacks +id: 38b8cf16-8461-11ec-ade1-acde48001122 +version: 1 +date: '2022-02-02' +author: Mauricio Velazco, Splunk +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: +- https://www.destroyallsoftware.com/talks/wat +tags: + analytic_story: + - Active Directory Kerberos Attacks + category: + - Adversary Tactics + - Account Compromise + - Lateral Movement + - Privilege Escalation + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml b/tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml new file mode 100644 index 0000000000..048ca7bf0c --- /dev/null +++ b/tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml @@ -0,0 +1,12 @@ +name: Mimikatz PassTheTicket CommandLine Parameters Unit Test +tests: +- name: Mimikatz PassTheTicket CommandLine Parameters + file: endpoint/mimikatz_passtheticket_commandline_parameters.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rubeus_command_line_parameters.test.yml b/tests/endpoint/rubeus_command_line_parameters.test.yml new file mode 100644 index 0000000000..8453ca23c7 --- /dev/null +++ b/tests/endpoint/rubeus_command_line_parameters.test.yml @@ -0,0 +1,12 @@ +name: Rubeus Command Line Parameters Unit Test +tests: +- name: Rubeus Command Line Parameters + file: endpoint/rubeus_command_line_parameters.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml b/tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml new file mode 100644 index 0000000000..d20b693254 --- /dev/null +++ b/tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml @@ -0,0 +1,12 @@ +name: Rubeus Kerberos Ticket Exports Through Winlogon Access Unit Test +tests: +- name: Rubeus Kerberos Ticket Exports Through Winlogon Access + file: endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From e83767a9db50e8e2c0316c5b43ad259f4825261c Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 8 Feb 2022 14:24:15 -0500 Subject: [PATCH 02/16] adding missing references --- .../mimikatz_passtheticket_commandline_parameters.yml | 4 +++- detections/endpoint/rubeus_command_line_parameters.yml | 5 ++++- ...ubeus_kerberos_ticket_exports_through_winlogon_access.yml | 3 +++ 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml index 1dbe7a24d1..448da5f4e2 100644 --- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -21,7 +21,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. known_false_positives: Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz. references: -- https://github.com/gentilkiwi/mimikatz +- https://github.com/gentilkiwi/mimikatz +- https://attack.mitre.org/techniques/T1550/003/ tags: analytic_story: - Active Directory Kerberos Attacks @@ -30,6 +31,7 @@ tags: kill_chain_phases: - Privilege Escalation mitre_attack_id: + - T1550 - T1550.003 product: - Splunk Enterprise diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index 54cc2d20ab..befe3f64e0 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -25,7 +25,9 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed. references: -- https://github.com/GhostPack/Rubeus +- https://github.com/GhostPack/Rubeus +- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ +- https://attack.mitre.org/techniques/T1550/003/ tags: analytic_story: - Active Directory Kerberos Attacks @@ -34,6 +36,7 @@ tags: kill_chain_phases: - Privilege Escalation mitre_attack_id: + - T1550 - T1550.003 product: - Splunk Enterprise diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index 2a13663144..33fea11916 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -25,6 +25,8 @@ how_to_implement: This search needs Sysmon Logs and a sysmon configuration, whic known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed references: - https://github.com/GhostPack/Rubeus +- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ +- https://attack.mitre.org/techniques/T1550/003/ tags: analytic_story: - Active Directory Kerberos Attacks @@ -34,6 +36,7 @@ tags: - Privilege Escalation - Lateral Movement mitre_attack_id: + - T1550 - T1550.003 product: - Splunk Enterprise From c51621060c0824a6a0a7044aa8321e4ed9d7dfb1 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 16 Feb 2022 14:16:15 -0500 Subject: [PATCH 03/16] update detection and adding a new one --- ...asting_spn_request_with_rc4_encryption.yml | 25 ++++--- ...ticket_exports_through_winlogon_access.yml | 5 +- ..._of_kerberos_service_tickets_requested.yml | 69 +++++++++++++++++++ ...erberos_service_tickets_requested.test.yml | 12 ++++ 4 files changed, 98 insertions(+), 13 deletions(-) create mode 100644 detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml create mode 100644 tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index 7ea40e6c1f..0c9a953140 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -1,20 +1,23 @@ name: Kerberoasting spn request with RC4 encryption id: 5cc67381-44fa-4111-8a37-7a230943f027 -version: 3 -date: '2020-10-16' -author: Jose Hernandez, Patrick Bareiss, Splunk +version: 4 +date: '2022-02-09' +author: Jose Hernandez, Patrick Bareiss, Mauricio Velazcu, Splunk type: TTP datamodel: [] -description: This search detects a potential kerberoasting attack via service principal - name requests -search: '`wineventlog_security` EventCode=4769 Ticket_Options=0x40810000 Ticket_Encryption_Type=0x17 +description: The following analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack + against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and + attempt to crack them offline allowing them to obtain privileged access to the domain. This analytic looks for a specific combination of the Ticket_Options field + based on common kerberoasting tools. Defenders should be aware that it may be possible for a Kerberoast attack to use different Ticket_Options. +search: '`wineventlog_security` EventCode=4769 Service_Name!="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000) Ticket_Encryption_Type=0x17 | stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id, Ticket_Encryption_Type, Ticket_Options | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `kerberoasting_spn_request_with_rc4_encryption_filter`' -how_to_implement: You must be ingesting endpoint data that tracks process activity, - and include the windows security event logs that contain kerberos -known_false_positives: Older systems that support kerberos RC4 by default NetApp may - generate false positives +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: Older systems that support kerberos RC4 by default like NetApp may + generate false positives. Filter as needed references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md - https://www.trimarcsecurity.com/post/trimarcresearch-detecting-kerberoasting-activity @@ -39,8 +42,8 @@ tags: message: Potential kerberoasting attack via service principal name requests detected on $dest$ mitre_attack_id: - - T1558.003 - T1558 + - T1558.003 nist: - DE.CM observable: diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index 33fea11916..e2bc4817d8 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -6,7 +6,8 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: [] description: The following analytic looks for a process accessing the winlogon.exe system process. The Splunk Threat Research team identified this behavior - when using the Rubeus tool to monitor for and export kerberos tickets from memory. Exporting tickets from memory is typically the first step for pass the ticket attacks. + when using the Rubeus tool to monitor for and export kerberos tickets from memory. Before being able to export tickets. Rubeus will try to escalate privileges to SYSTEM by + obtaining a handle to winlogon.exe before trying to monitor for kerberos tickets. Exporting tickets from memory is typically the first step for pass the ticket attacks. Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Defenders should be aware that adversaries may customize the source code of Rubeus to potentially bypass this analytic. search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff) @@ -18,7 +19,7 @@ search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`' how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which - includes EventCode 10.exe. This search uses an input macro named `sysmon`. + includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml new file mode 100644 index 0000000000..8e7b49bf95 --- /dev/null +++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml @@ -0,0 +1,69 @@ +name: Unusual Number of Kerberos Service Tickets Requested +id: eb3e6702-8936-11ec-98fe-acde48001122 +version: 1 +date: '2022-02-08' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack + against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and + attempt to crack them offline allowing them to obtain privileged access to the domain. + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number service ticket requests. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. + +search: ' `wineventlog_security` EventCode=4769 Service_Name!="*$" Ticket_Encryption_Type=0x17 +| bucket span=2m _time +| stats dc(Service_Name) AS unique_services values(Service_Name) as requested_services by _time, Client_Address +| eventstats avg(unique_services) as comp_avg , stdev(unique_services) as comp_std by Client_Address +| eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_services > 2 and unique_services >= upperBound, 1, 0) +| search isOutlier=1 +| `unusual_number_of_kerberos_service_tickets_requested_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: An single endpoint requesting a large number of kerberos service + tickets is not common behavior. Possible false positive scenarios include but are + not limited to vulnerability scanners, administration systems and missconfigured + systems. +references: +- https://attack.mitre.org/techniques/T1558/003/ +- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1558 + - T1558.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Ticket_Options + - Ticket_Encryption_Type + - dest + - Service_Name + - service_id + - Client_Address + security_domain: endpoint + impact: 60 + confidence: 60 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: + observable: + - name: Client_Address + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml b/tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml new file mode 100644 index 0000000000..b942d279d0 --- /dev/null +++ b/tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml @@ -0,0 +1,12 @@ +name: Unusual Number of Kerberos Service Tickets Requested Unit Test +tests: +- name: Unusual Number of Kerberos Service Tickets Requested + file: endpoint/unusual_number_of_kerberos_service_tickets_requested.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file From 0be99ab0d6b0edf87a732740a41ae6184ce11ccd Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 16 Feb 2022 12:23:54 -0800 Subject: [PATCH 04/16] Removed extra newlines Extra newlines in 'description' was were causing issues with the generation of saved_searches.conf --- .../unusual_number_of_kerberos_service_tickets_requested.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml index 8e7b49bf95..6f52ce6dee 100644 --- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml +++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml @@ -8,12 +8,10 @@ datamodel: [] description: The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and attempt to crack them offline allowing them to obtain privileged access to the domain. - The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number service ticket requests. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. - search: ' `wineventlog_security` EventCode=4769 Service_Name!="*$" Ticket_Encryption_Type=0x17 | bucket span=2m _time | stats dc(Service_Name) AS unique_services values(Service_Name) as requested_services by _time, Client_Address @@ -66,4 +64,4 @@ tags: - name: Client_Address type: Endpoint role: - - Victim \ No newline at end of file + - Victim From 550a592f78d64992c35dd9ce7b64d7a332e6ff0e Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 16 Feb 2022 13:42:16 -0800 Subject: [PATCH 05/16] Re-adding newline Adding newline back with proper format. Requires a backslash in front. --- .../unusual_number_of_kerberos_service_tickets_requested.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml index 6f52ce6dee..dbafa42be0 100644 --- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml +++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml @@ -7,7 +7,8 @@ type: Anomaly datamodel: [] description: The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and - attempt to crack them offline allowing them to obtain privileged access to the domain. + attempt to crack them offline allowing them to obtain privileged access to the domain.\ + The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number service ticket requests. To customize this analytic, users can try different combinations of the `bucket` span time and the From b472113e648640b47091c98d31bdfb828c7c0571 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 17 Feb 2022 10:52:51 -0500 Subject: [PATCH 06/16] updating detection with proper dataset --- ...kerberoasting_spn_request_with_rc4_encryption.yml | 4 ++-- stories/active_directory_kerberos_attacks.yml | 12 +++++++++--- ...roasting_spn_request_with_rc4_encryption.test.yml | 2 +- 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index 0c9a953140..cb6069ae6d 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -2,7 +2,7 @@ name: Kerberoasting spn request with RC4 encryption id: 5cc67381-44fa-4111-8a37-7a230943f027 version: 4 date: '2022-02-09' -author: Jose Hernandez, Patrick Bareiss, Mauricio Velazcu, Splunk +author: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Splunk type: TTP datamodel: [] description: The following analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack @@ -35,7 +35,7 @@ tags: - Source:Endpoint - Stage:Credential Access dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log impact: 90 kill_chain_phases: - Privilege Escalation diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml index d261a896d8..e59016ba52 100644 --- a/stories/active_directory_kerberos_attacks.yml +++ b/stories/active_directory_kerberos_attacks.yml @@ -3,10 +3,16 @@ id: 38b8cf16-8461-11ec-ade1-acde48001122 version: 1 date: '2022-02-02' author: Mauricio Velazco, Splunk -description: UPDATE_DESCRIPTION -narrative: UPDATE_NARRATIVE +description: Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments. +narrative: Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and + users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access + to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks. references: -- https://www.destroyallsoftware.com/talks/wat +- https://en.wikipedia.org/wiki/Kerberos_(protocol) +- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9 +- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://attack.mitre.org/techniques/T1558/003/ +- https://attack.mitre.org/techniques/T1550/003/ tags: analytic_story: - Active Directory Kerberos Attacks diff --git a/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml b/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml index 5ae101f436..0e95642c09 100644 --- a/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml +++ b/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog update_timestamp: True From 98f6bc09c6434eb469b6a07f26ed346924ded025 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 18 Feb 2022 10:30:54 -0500 Subject: [PATCH 07/16] updating analytic story description --- .../kerberoasting_spn_request_with_rc4_encryption.yml | 2 +- stories/active_directory_kerberos_attacks.yml | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index cb6069ae6d..d1379ef8d1 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -9,7 +9,7 @@ description: The following analytic leverages Kerberos Event 4769, A Kerberos se against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and attempt to crack them offline allowing them to obtain privileged access to the domain. This analytic looks for a specific combination of the Ticket_Options field based on common kerberoasting tools. Defenders should be aware that it may be possible for a Kerberoast attack to use different Ticket_Options. -search: '`wineventlog_security` EventCode=4769 Service_Name!="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000) Ticket_Encryption_Type=0x17 +search: '`wineventlog_security` EventCode=4769 Service_Name!="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17 | stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id, Ticket_Encryption_Type, Ticket_Options | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `kerberoasting_spn_request_with_rc4_encryption_filter`' diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml index e59016ba52..4e145a4e4c 100644 --- a/stories/active_directory_kerberos_attacks.yml +++ b/stories/active_directory_kerberos_attacks.yml @@ -6,7 +6,11 @@ author: Mauricio Velazco, Splunk description: Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments. narrative: Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access - to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks. + to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks since + the introduction of Windows Server 2003. With Kerberos being the backbone of Windows authentication, it is commonly abused by adversaries across the different phases + of a breach including initial access, privilege escalation, defense evasion, credential access, lateral movement, etc.\ + This Analytic Story groups detection use cases in which the Kerberos protocol is abused. Defenders can leverage these analytics to detect and hunt for adversaries engaging in + Kerberos based attacks. references: - https://en.wikipedia.org/wiki/Kerberos_(protocol) - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9 From c544488575d7b6c891c291484f8ea3839d3c7088 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 18 Feb 2022 17:42:58 -0500 Subject: [PATCH 08/16] adding asp roasting detection T1558.004 --- ...uthentication_discovery_with_powerview.yml | 58 +++++++++++++++++++ .../rubeus_command_line_parameters.yml | 3 + ...tication_discovery_with_powerview.test.yml | 12 ++++ 3 files changed, 73 insertions(+) create mode 100644 detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml create mode 100644 tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml new file mode 100644 index 0000000000..7c474cfba5 --- /dev/null +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -0,0 +1,58 @@ +name: Disabled Kerberos Pre-Authentication Discovery With PowerView +id: b0b34e2c-90de-11ec-baeb-acde48001122 +version: 1 +date: '2022-02-18' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser` + is part of PowerView, a PowerShell tool used to perform enumeration on Windows Active Directory networks. + As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired` + allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ + Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline. +search: ' `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message="*PreauthNotRequired*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerView for troubleshooting +references: +- https://attack.mitre.org/techniques/T1558/004/ +- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1558 + - T1558.004 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 60 + confidence: 90 + risk_score: 54 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$ \ No newline at end of file diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index befe3f64e0..b3117686de 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -38,6 +38,9 @@ tags: mitre_attack_id: - T1550 - T1550.003 + - T1558 + - T1558.003 + - T1558.004 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml new file mode 100644 index 0000000000..95445f94db --- /dev/null +++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml @@ -0,0 +1,12 @@ +name: Disabled Kerberos Pre-Authentication Discovery With PowerView Unit Test +tests: +- name: Disabled Kerberos Pre-Authentication Discovery With PowerView + file: endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file From 78b79d31e77446d7cc6ec35816c3b2643a5da925 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 22 Feb 2022 13:19:13 -0500 Subject: [PATCH 09/16] adding new detection for T1558.004 --- ...thentication_discovery_with_get_aduser.yml | 62 +++++++++++++++++++ ...uthentication_discovery_with_powerview.yml | 2 +- stories/active_directory_kerberos_attacks.yml | 1 + ...ication_discovery_with_get_aduser.test.yml | 15 +++++ 4 files changed, 79 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml create mode 100644 tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml new file mode 100644 index 0000000000..27ee132288 --- /dev/null +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml @@ -0,0 +1,62 @@ +name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser +id: 114c6bfe-9406-11ec-bcce-acde48001122 +version: 1 +date: '2022-02-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser` + is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. + As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser + allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ + Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline. +search: ' `powershell` EventCode=4104 (Message = "*Get-ADUser*" AND Message="*4194304*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes. +references: +- https://attack.mitre.org/techniques/T1558/004/ +- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1558 + - T1558.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 60 + confidence: 90 + risk_score: 54 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$ \ No newline at end of file diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml index 7c474cfba5..37adc01659 100644 --- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -17,7 +17,7 @@ search: ' `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message= how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Administrators or power users may use this PowerView for troubleshooting +known_false_positives: Administrators or power users may use PowerView for troubleshooting references: - https://attack.mitre.org/techniques/T1558/004/ - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml index 4e145a4e4c..44adeb59ac 100644 --- a/stories/active_directory_kerberos_attacks.yml +++ b/stories/active_directory_kerberos_attacks.yml @@ -15,6 +15,7 @@ references: - https://en.wikipedia.org/wiki/Kerberos_(protocol) - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9 - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ - https://attack.mitre.org/techniques/T1558/003/ - https://attack.mitre.org/techniques/T1550/003/ tags: diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml new file mode 100644 index 0000000000..034af504ea --- /dev/null +++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml @@ -0,0 +1,15 @@ +name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser Unit Test +tests: +- name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser + file: endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog + + + From 18fe0a505065d22586626ecf0382fbee19919879 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 23 Feb 2022 11:24:04 -0500 Subject: [PATCH 10/16] adding new detection for T1558.004 --- ...on_flag_disabled_in_useraccountcontrol.yml | 59 +++++++++++++++++++ ...ag_disabled_in_useraccountcontrol.test.yml | 13 ++++ 2 files changed, 72 insertions(+) create mode 100644 detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml create mode 100644 tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml new file mode 100644 index 0000000000..246ac64829 --- /dev/null +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml @@ -0,0 +1,59 @@ +name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl +id: 0cb847ee-9423-11ec-b2df-acde48001122 +version: 1 +date: '2022-02-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic leverages Windows Security Event 4738, `A user account was changed`, + to identify a change performed on a domain user object that disables Kerberos Pre-Authentication. + Disabling the Pre Authentication flag in the UserAccountControl property allows an adversary to easily perform a brute + force attack against the user's password offline leveraging the ASP REP Roasting technique. + Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor + or a way to escalate privileges. +search: ' EventCode=4738 MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*" +| table EventCode, Account_Name, Security_ID, MSADChangedAttributes +| `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller events. The Advanced Security Audit policy setting + `User Account Management` within `Account Management` needs to be enabled. +known_false_positives: Unknown. +references: +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties +- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log + kill_chain_phases: + - Intrusion + - Privilege Escalation + mitre_attack_id: + - T1558 + - T1558.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Account_Name + - Security_ID + - MSADChangedAttributes + security_domain: endpoint + impact: 50 + confidence: 90 + risk_score: 45 + context: + - Source:Endpoint + - Stage:PrivilegeEscalation + - Stage:Persistence + message: + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml new file mode 100644 index 0000000000..df1569133d --- /dev/null +++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml @@ -0,0 +1,13 @@ +name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl Unit Test +tests: +- name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl + file: endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True \ No newline at end of file From 42e4f1784c2c7539e427d0a9d5a1e2090713eaae Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 23 Feb 2022 13:02:23 -0500 Subject: [PATCH 11/16] adding new detection for T1558.004 --- ...on_flag_disabled_in_useraccountcontrol.yml | 4 +- ...tication_flag_disabled_with_powershell.yml | 57 +++++++++++++++++++ stories/active_directory_kerberos_attacks.yml | 1 + ...ion_flag_disabled_with_powershell.test.yml | 13 +++++ 4 files changed, 73 insertions(+), 2 deletions(-) create mode 100644 detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml create mode 100644 tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml index 246ac64829..3764b64382 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml @@ -11,7 +11,7 @@ description: The following analytic leverages Windows Security Event 4738, `A us force attack against the user's password offline leveraging the ASP REP Roasting technique. Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor or a way to escalate privileges. -search: ' EventCode=4738 MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*" +search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*" | table EventCode, Account_Name, Security_ID, MSADChangedAttributes | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -51,7 +51,7 @@ tags: - Source:Endpoint - Stage:PrivilegeEscalation - Stage:Persistence - message: + message: Kerberos Pre Authentication was Disabled for $Account_Name$ observable: - name: dest type: Endpoint diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml new file mode 100644 index 0000000000..accc8e3f26 --- /dev/null +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml @@ -0,0 +1,57 @@ +name: Kerberos Pre-Authentication Flag Disabled with PowerShell +id: 59b51620-94c9-11ec-b3d5-acde48001122 +version: 1 +date: '2022-02-23' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Set-ADAccountControl` commandlet with specific parameters. `Set-ADAccountControl` + is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. + As the name suggests, `Set-ADAccountControl` is used to modify User Account Control values for an Active Directory domain account. + With the appropiate parameters, Set-ADAccountControl allows adversaries to disable Kerberos Pre-Authentication for an account to + to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique. + Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor + or a way to escalate privileges. +search: ' `powershell` EventCode=4104 (Message = "*Set-ADAccountControl*" AND Message="*DoesNotRequirePreAuth:$true*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Although unlikely, Administrators may need to set this flag for legitimate purposes. +references: +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties +- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log + kill_chain_phases: + - Intrusion + - Privilege Escalation + mitre_attack_id: + - T1558 + - T1558.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 50 + confidence: 90 + risk_score: 45 + context: + - Source:Endpoint + - Stage:PrivilegeEscalation + - Stage:Persistence + message: Kerberos Pre Authentication was Disabled using PowerShell on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml index 44adeb59ac..fe3ad3cd62 100644 --- a/stories/active_directory_kerberos_attacks.yml +++ b/stories/active_directory_kerberos_attacks.yml @@ -18,6 +18,7 @@ references: - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ - https://attack.mitre.org/techniques/T1558/003/ - https://attack.mitre.org/techniques/T1550/003/ +- https://attack.mitre.org/techniques/T1558/004/ tags: analytic_story: - Active Directory Kerberos Attacks diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml new file mode 100644 index 0000000000..3dec3df43a --- /dev/null +++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml @@ -0,0 +1,13 @@ +name: Kerberos Pre-Authentication Flag Disabled with PowerShell Unit Test +tests: +- name: Kerberos Pre-Authentication Flag Disabled with PowerShell + file: endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True \ No newline at end of file From fd78987f8c28db66c68458c6afc6130d391a7c92 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 23 Feb 2022 13:23:53 -0500 Subject: [PATCH 12/16] updating dataset url --- ...erberos_pre_authentication_flag_disabled_with_powershell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml index accc8e3f26..18446fda3a 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml @@ -28,7 +28,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log kill_chain_phases: - Intrusion - Privilege Escalation From 9a0770e78f1cd282622cd396aee27ed7bc645b7c Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 23 Feb 2022 13:40:43 -0500 Subject: [PATCH 13/16] fixing source in test file --- ..._pre_authentication_flag_disabled_with_powershell.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml index 3dec3df43a..2abcf3d741 100644 --- a/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml +++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml @@ -8,6 +8,6 @@ tests: attack_data: - file_name: windows-powershell.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log - source: WinEventLog:Security - sourcetype: WinEventLog + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog update_timestamp: True \ No newline at end of file From a3fc0779ae842b7c2f72f7634508ddb78a8010ae Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 24 Feb 2022 12:40:36 -0500 Subject: [PATCH 14/16] tagging password spraying detections --- ...ed_users_failing_to_authenticate_from_host_using_kerberos.yml | 1 + ...id_users_failing_to_authenticate_from_host_using_kerberos.yml | 1 + ...le_users_failing_to_authenticate_from_host_using_kerberos.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml index 8e60ca1557..7448859a68 100644 --- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -44,6 +44,7 @@ references: tags: analytic_story: - Active Directory Password Spraying + - Active Directory Kerberos Attacks automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml index 3612834bee..135b96420c 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -44,6 +44,7 @@ references: tags: analytic_story: - Active Directory Password Spraying + - Active Directory Kerberos Attacks automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index 2cc0ffadc0..5ebf02b7cc 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -44,6 +44,7 @@ references: tags: analytic_story: - Active Directory Password Spraying + - Active Directory Kerberos Attacks automated_detection_testing: passed confidence: 70 context: From 15a77c78cc860240625ef2e14b64aaaac9785b14 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 24 Feb 2022 14:46:20 -0500 Subject: [PATCH 15/16] adding analytic story tag --- .../endpoint/serviceprincipalnames_discovery_with_setspn.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index b6afcc0355..8e3be8fa03 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -56,6 +56,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Active Directory Kerberos Attacks automated_detection_testing: passed confidence: 100 context: From d075ca883b3fa4a156f705883db265506b7d181c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 24 Feb 2022 12:31:07 -0800 Subject: [PATCH 16/16] Update rubeus_command_line_parameters.yml minor change to context --- detections/endpoint/rubeus_command_line_parameters.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index b3117686de..49b18089a9 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -61,7 +61,7 @@ tags: risk_score: 36 context: - Source:Endpoint - - Stage:PrivilegeEscalation + - Stage:Privilege Escalation message: Rubeus command line parameters were used on $dest$ observable: - name: user @@ -75,4 +75,4 @@ tags: - name: parent_process_name type: Parent Process role: - - Parent Process \ No newline at end of file + - Parent Process