From 9689073946596957ee01536ff876634348ddffcf Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Fri, 1 Jul 2022 16:24:42 -0400 Subject: [PATCH 1/2] Edit windows_powerview_kerberos_service_ticket_request detection Edit the windows_powerview_kerberos_service_ticket_request detection to support xml logs --- ...ws_powerview_kerberos_service_ticket_request.yml | 13 ++++++------- .../endpoint/windows_powerview_spn_discovery.yml | 7 +++---- ...werview_kerberos_service_ticket_request.test.yml | 8 ++++---- 3 files changed, 13 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml index 1aec804c00..136384ffb2 100644 --- a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml +++ b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml @@ -13,8 +13,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev using password cracking tools like hashcat to extract the password of the SPN account. Red Teams and adversaries alike may leverage PowerView and these commandlets to identify accounts that can be attacked with the Kerberoasting technique. -search: '`powershell` EventCode=4104 Message=*Get-DomainSPNTicket* -| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +search: '`powershell` EventCode=4104 ScriptBlockText=*Get-DomainSPNTicket* +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_kerberos_service_ticket_request_filter`' how_to_implement: The following analytic requires PowerShell operational logs @@ -40,11 +40,11 @@ tags: - Source:Endpoint - Stage:Recon dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell-xml.log impact: 30 kill_chain_phases: - Exploitation - message: PowerView commandlets used for requesting SPN service ticket executed on $Computer_Name$ + message: PowerView commandlets used for requesting SPN service ticket executed on $Computer$ mitre_attack_id: - T1558 - T1558.003 @@ -62,8 +62,7 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Computer + - ScriptBlockText risk_score: 27 security_domain: endpoint diff --git a/detections/endpoint/windows_powerview_spn_discovery.yml b/detections/endpoint/windows_powerview_spn_discovery.yml index 7a02c52b2e..223591c5aa 100644 --- a/detections/endpoint/windows_powerview_spn_discovery.yml +++ b/detections/endpoint/windows_powerview_spn_discovery.yml @@ -43,7 +43,7 @@ tags: kill_chain_phases: - Reconnaissance - Exploitation - message: PowerView commandlets used for SPN discovery executed on $Computer_Name$ + message: PowerView commandlets used for SPN discovery executed on $Computer$ mitre_attack_id: - T1558 - T1558.003 @@ -61,8 +61,7 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Computer + - ScriptBlockText risk_score: 27 security_domain: endpoint diff --git a/tests/endpoint/windows_powerview_kerberos_service_ticket_request.test.yml b/tests/endpoint/windows_powerview_kerberos_service_ticket_request.test.yml index 178ac8db66..ccad67d5a9 100644 --- a/tests/endpoint/windows_powerview_kerberos_service_ticket_request.test.yml +++ b/tests/endpoint/windows_powerview_kerberos_service_ticket_request.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: windows-powershell-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog From 0ed61a57f40bb8f715a2a04cd0582b0ea162c40e Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Fri, 1 Jul 2022 17:12:05 -0400 Subject: [PATCH 2/2] Edit the search SPL Edit the search SPL of windows_powerview_kerberos_service_ticket_request --- .../windows_powerview_kerberos_service_ticket_request.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml index 136384ffb2..62f617ca3e 100644 --- a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml +++ b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml @@ -13,7 +13,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev using password cracking tools like hashcat to extract the password of the SPN account. Red Teams and adversaries alike may leverage PowerView and these commandlets to identify accounts that can be attacked with the Kerberoasting technique. -search: '`powershell` EventCode=4104 ScriptBlockText=*Get-DomainSPNTicket* +search: '`powershell` EventCode=4104 ScriptBlockText=*Get-DomainSPNTicket* | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_kerberos_service_ticket_request_filter`'