mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge branch 'dev_sec_ops_package' of github.com:splunk/security_content into dev_sec_ops_package
This commit is contained in:
P4T12ICK
@@ -0,0 +1,61 @@
|
||||
name: AdsiSearcher Account Discovery
|
||||
id: de7fcadc-04f3-11ec-a241-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect a powershell command adsisearcher to do user
|
||||
enumeration to the active directory. This command can be a normal query of a network
|
||||
admin but since the output of this is not so much structure and cannot give a concrete
|
||||
or specific information that admin may look upon this is still a good TTP to alert
|
||||
some malicious activities.
|
||||
search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*"
|
||||
Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime
|
||||
by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `adsisearcher_account_discovery_filter`'
|
||||
how_to_implement: The following Hunting analytic requires PowerShell operational logs
|
||||
to be imported. Modify the powershell macro as needed to match the sourcetype or
|
||||
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
|
||||
known_false_positives: not commonly seen as a normal command from network admin but
|
||||
possible noise may exist.
|
||||
references:
|
||||
- https://www.blackhillsinfosec.com/red-blue-purple/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1087.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Message
|
||||
- ComputerName
|
||||
- User
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 50
|
||||
risk_score: 25
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage:Reconnaissance
|
||||
message: powershell process having commandline $Message$ for user enumeration
|
||||
observable:
|
||||
- name: ComputerName
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: User
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,71 @@
|
||||
name: Domain Account Discovery with Dsquery
|
||||
id: b1a8ce04-04c2-11ec-bea7-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect a suspicious process commandline of dsquery
|
||||
for enumerating users. This technique is commonly in attacker and red team to recon
|
||||
on users in targetted machine. This command can also be used by network administrator
|
||||
but not by a normal user.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.process_name="dsquery.exe"
|
||||
AND Processes.process = "*user*" by Processes.dest Processes.user Processes.parent_process
|
||||
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
|
||||
Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `domain_account_discovery_with_dsquery_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: network administrator may use this command but not commonly
|
||||
seen used by a user.
|
||||
references:
|
||||
- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1087.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_name
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 50
|
||||
risk_score: 25
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Reconnaissance
|
||||
message: an instance of process $process_name$ with commandline $process$ in $dest$
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Parent Process
|
||||
role:
|
||||
- Parent Process
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,71 @@
|
||||
name: Domain Account Discovery With Net App
|
||||
id: 98f6a534-04c2-11ec-96b2-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect a process command line for AD discovery. This
|
||||
techique is using the windows built in net.exe application to query AD users in
|
||||
the targetted machine. This techique was seen in several malware as part of there
|
||||
recon and can be a good pivot of analysis.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
|
||||
OR Processes.process_name="net1.exe") AND Processes.process = "* user*" AND Processes.process
|
||||
= "*/do*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `domain_account_discovery_with_net_app_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: network operator can execute this command
|
||||
references:
|
||||
- https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1087.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_name
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 50
|
||||
risk_score: 25
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Reconnaissance
|
||||
message: an instance of process $process_name$ with commandline $process$ in $dest$
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Parent Process
|
||||
role:
|
||||
- Parent Process
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,72 @@
|
||||
name: Domain Account Discovery with Wmic
|
||||
id: 383572e0-04c5-11ec-bdcc-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect a wmic command for enumerating user in active
|
||||
directory. This technique was commonly used in pentesting, red-team and also by
|
||||
some attacker to map all user in the targetted host. This search may also catch
|
||||
this type of query made by network admin but not common in all the user in the network.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe"
|
||||
AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process
|
||||
= "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*"
|
||||
by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `domain_account_discovery_with_wmic_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: network admin may execute this command for listing users.
|
||||
references:
|
||||
- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1087.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_name
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 50
|
||||
risk_score: 25
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Reconnaissance
|
||||
message: an instance of process $process_name$ with commandline $process$ in $dest$
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Parent Process
|
||||
role:
|
||||
- Parent Process
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,73 @@
|
||||
name: Get ADDefaultDomainPasswordPolicy with Powershell
|
||||
id: 36e46ebe-065a-11ec-b4c7-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-26'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy.
|
||||
This command can be used by attacker to mapped all password policy in a target host.
|
||||
This command may cause some noise especially in admin user that can execute this
|
||||
for policy audit. This hunting query is a good pivot to start investigating possible
|
||||
lateral movement or credential dumping as post attack.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
|
||||
OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*"
|
||||
by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `get_addefaultdomainpasswordpolicy_with_powershell_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
|
||||
known_false_positives: network operator may use this command
|
||||
references:
|
||||
- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1201
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_name
|
||||
security_domain: endpoint
|
||||
impact: 30
|
||||
confidence: 30
|
||||
risk_score: 9
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Reconnaissance
|
||||
message: an instance of process $process_name$ with commandline $process$ in $dest$
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Parent Process
|
||||
role:
|
||||
- Parent Process
|
||||
automated_detection_testing: passed
|
||||
|
||||
+61
@@ -0,0 +1,61 @@
|
||||
name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block
|
||||
id: 1ff7ccc8-065a-11ec-91e4-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-26'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy.
|
||||
This command can be used by attacker to mapped all password policy in a target host.
|
||||
This command may cause some noise especially in admin user that can execute this
|
||||
for policy audit. This hunting query is a good pivot to start investigating possible
|
||||
lateral movement or credential dumping as post attack.
|
||||
search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*"
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
|
||||
ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`'
|
||||
how_to_implement: The following Hunting analytic requires PowerShell operational logs
|
||||
to be imported. Modify the powershell macro as needed to match the sourcetype or
|
||||
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
|
||||
known_false_positives: network operator may use this command
|
||||
references:
|
||||
- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1201
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Message
|
||||
- ComputerName
|
||||
- User
|
||||
security_domain: endpoint
|
||||
impact: 30
|
||||
confidence: 30
|
||||
risk_score: 9
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage:Reconnaissance
|
||||
message: powershell process having commandline $Message$ to query domain password
|
||||
policy
|
||||
observable:
|
||||
- name: ComputerName
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: User
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,72 @@
|
||||
name: Get ADUser with PowerShell
|
||||
id: 0b6ee3f4-04e3-11ec-a87d-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect a suspicious commandline that commonly uses
|
||||
for enumerating users in active directory. This technique can be a good indicator
|
||||
to hunt further TTPs to the machine to check further anomalies. Since this is a
|
||||
hunt query expect some noise from administrator or some IT within the network that
|
||||
may use this command.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
|
||||
OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUser*"
|
||||
AND Processes.process = "*-filter*" by Processes.dest Processes.user Processes.parent_process
|
||||
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
|
||||
Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `get_aduser_with_powershell_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: network admin may use this command.
|
||||
references:
|
||||
- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1087.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_name
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 50
|
||||
risk_score: 25
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Reconnaissance
|
||||
message: an instance of process $process_name$ with commandline $process$ in $dest$
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Parent Process
|
||||
role:
|
||||
- Parent Process
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,61 @@
|
||||
name: Get ADUser with PowerShell Script Block
|
||||
id: 21432e40-04f4-11ec-b7e6-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect a powershell command get-aduser function to
|
||||
do user enumeration to the active directory. This command can be a normal query
|
||||
of a network admin but since the output of this is not so much structure and cannot
|
||||
give a concrete or specific information that admin may look upon this is still a
|
||||
good TTP to alert some malicious activities.
|
||||
search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*"
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
|
||||
ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `get_aduser_with_powershell_script_block_filter`'
|
||||
how_to_implement: The following Hunting analytic requires PowerShell operational logs
|
||||
to be imported. Modify the powershell macro as needed to match the sourcetype or
|
||||
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
|
||||
known_false_positives: network admin may use this command and other IT operator to
|
||||
check AD users.
|
||||
references:
|
||||
- https://www.blackhillsinfosec.com/red-blue-purple/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1087.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Message
|
||||
- ComputerName
|
||||
- User
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 50
|
||||
risk_score: 25
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage:Reconnaissance
|
||||
message: powershell process having commandline $Message$ for user enumeration
|
||||
observable:
|
||||
- name: ComputerName
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: User
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,72 @@
|
||||
name: Get ADUserResultantPasswordPolicy with Powershell
|
||||
id: 8b5ef342-065a-11ec-b0fc-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-26'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy.
|
||||
This command can be used by attacker to mapped all password policy in a target host.
|
||||
This command may cause some noise especially in admin user that can execute this
|
||||
for policy audit. This hunting query is a good pivot to start investigating possible
|
||||
lateral movement or credential dumping as post attack.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
|
||||
OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*"
|
||||
by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `get_aduserresultantpasswordpolicy_with_powershell_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
|
||||
known_false_positives: network operator or admin may use this command
|
||||
references:
|
||||
- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1201
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_name
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 50
|
||||
risk_score: 25
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Reconnaissance
|
||||
message: an instance of process $process_name$ with commandline $process$ in $dest$
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Parent Process
|
||||
role:
|
||||
- Parent Process
|
||||
automated_detection_testing: passed
|
||||
+61
@@ -0,0 +1,61 @@
|
||||
name: Get ADUserResultantPasswordPolicy with Powershell Script Block
|
||||
id: 737e1eb0-065a-11ec-921a-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-26'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy.
|
||||
This command can be used by attacker to mapped all password policy in a target host.
|
||||
This command may cause some noise especially in admin user that can execute this
|
||||
for policy audit. This hunting query is a good pivot to start investigating possible
|
||||
lateral movement or credential dumping as post attack.
|
||||
search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*"
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
|
||||
ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`'
|
||||
how_to_implement: The following Hunting analytic requires PowerShell operational logs
|
||||
to be imported. Modify the powershell macro as needed to match the sourcetype or
|
||||
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
|
||||
known_false_positives: network operator may use this command
|
||||
references:
|
||||
- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1201
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Message
|
||||
- ComputerName
|
||||
- User
|
||||
security_domain: endpoint
|
||||
impact: 30
|
||||
confidence: 30
|
||||
risk_score: 9
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage:Reconnaissance
|
||||
message: powershell process having commandline $Message$ to query domain user password
|
||||
policy.
|
||||
observable:
|
||||
- name: ComputerName
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: User
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,71 @@
|
||||
name: Get DomainPolicy with Powershell
|
||||
id: b8f9947e-065a-11ec-aafb-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-26'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect a possible execution of powerview pentesting
|
||||
tool for domain controller recon. This search look for function Get-DomainPolicy
|
||||
to parse the domain policy of the targeted host. This TTP may be a good pivot to
|
||||
look for credential dumping technique or lateral movement.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
|
||||
OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*"
|
||||
by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `get_domainpolicy_with_powershell_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
|
||||
known_false_positives: network operator or admin may use this command
|
||||
references:
|
||||
- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1201
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_name
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 60
|
||||
risk_score: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Reconnaissance
|
||||
message: an instance of process $process_name$ with commandline $process$ in $dest$
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Parent Process
|
||||
role:
|
||||
- Parent Process
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,58 @@
|
||||
name: Get DomainPolicy with Powershell Script Block
|
||||
id: a360d2b2-065a-11ec-b0bf-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-26'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect a possible execution of powerview pentesting
|
||||
tool for domain controller recon. This search look for function Get-DomainPolicy
|
||||
to parse the domain policy of the targeted host. This TTP may be a good pivot to
|
||||
look for credential dumping technique or lateral movement.
|
||||
search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time)
|
||||
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`'
|
||||
how_to_implement: The following Hunting analytic requires PowerShell operational logs
|
||||
to be imported. Modify the powershell macro as needed to match the sourcetype or
|
||||
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1201
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Message
|
||||
- ComputerName
|
||||
- User
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 60
|
||||
risk_score: 30
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage:Reconnaissance
|
||||
message: powershell process having commandline $Message$ to query domain policy.
|
||||
observable:
|
||||
- name: ComputerName
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: User
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,70 @@
|
||||
name: Get DomainUser with PowerShell
|
||||
id: 9a5a41d6-04e7-11ec-923c-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect a cmdlet Get-DomainUser that are common on powerview
|
||||
or powersploit tool. This cmdlet is used to recon on the targetted machine to enumerate
|
||||
all users in active directory.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
|
||||
OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainUser*"
|
||||
by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `get_domainuser_with_powershell_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1087.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_name
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 50
|
||||
risk_score: 25
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Reconnaissance
|
||||
message: an instance of process $process_name$ with commandline $process$ in $dest$
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Parent Process
|
||||
role:
|
||||
- Parent Process
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,60 @@
|
||||
name: Get DomainUser with PowerShell Script Block
|
||||
id: 61994268-04f4-11ec-865c-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: his search is to detect a powershell command Get-DomainUser to do user
|
||||
enumeration to the active directory. This command is function seen in powerspoit
|
||||
and powerview tool that are designed to pentest active directory or domain controller
|
||||
for possible attack. This is a good TTP for alerting SOC if there is a pentest or
|
||||
recon happening on the system. try to look for lateral movement technique or credential
|
||||
dumping techniques in the system.
|
||||
search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" | stats count min(_time)
|
||||
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`'
|
||||
how_to_implement: The following Hunting analytic requires PowerShell operational logs
|
||||
to be imported. Modify the powershell macro as needed to match the sourcetype or
|
||||
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1087.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Message
|
||||
- ComputerName
|
||||
- User
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 50
|
||||
risk_score: 25
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage:Reconnaissance
|
||||
message: powershell process having commandline $Message$ for user enumeration
|
||||
observable:
|
||||
- name: ComputerName
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: User
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,72 @@
|
||||
name: GetWmiObject DS User with PowerShell
|
||||
id: 22d3b118-04df-11ec-8fa3-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect a suspicious execution wmi process that enumerate
|
||||
user in active directory. This technique can be used by attacker and pentester to
|
||||
mapped all the users as part of its recon to the targetted host. Network Admin may
|
||||
seen executing this command but not often and also not common to see in user events.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
|
||||
OR Processes.process_name="powershell*") AND Processes.process = "*get-wmiobject*"
|
||||
AND Processes.process = "*ds_user*" AND Processes.process = "*root\\directory\\ldap*"
|
||||
AND Processes.process = "*-namespace*" by Processes.dest Processes.user Processes.parent_process
|
||||
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
|
||||
Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: network admin may execute this command.
|
||||
references:
|
||||
- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1087.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_name
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 50
|
||||
risk_score: 25
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Reconnaissance
|
||||
message: an instance of process $process_name$ with commandline $process$ in $dest$
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Parent Process
|
||||
role:
|
||||
- Parent Process
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,62 @@
|
||||
name: GetWmiObject DS User with PowerShell Script Block
|
||||
id: fabd364e-04f3-11ec-b34b-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-24'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect a powershell command get-wmiobject function
|
||||
to do user enumeration to the active directory. This command can be a normal query
|
||||
of a network admin but since the output of this is not so much structure and cannot
|
||||
give a concrete or specific information that admin may look upon this is still a
|
||||
good TTP to alert some malicious activities.
|
||||
search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*"
|
||||
Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time)
|
||||
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`'
|
||||
how_to_implement: he following Hunting analytic requires PowerShell operational logs
|
||||
to be imported. Modify the powershell macro as needed to match the sourcetype or
|
||||
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
|
||||
known_false_positives: not commonly seen as a normal command from network admin but
|
||||
possible noise may exist.
|
||||
references:
|
||||
- https://www.blackhillsinfosec.com/red-blue-purple/
|
||||
- https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1087.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Message
|
||||
- ComputerName
|
||||
- User
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 50
|
||||
risk_score: 25
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage:Reconnaissance
|
||||
message: powershell process having commandline $Message$ for user enumeration
|
||||
observable:
|
||||
- name: ComputerName
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: User
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,72 @@
|
||||
name: Password Policy Discovery with Net
|
||||
id: 09336538-065a-11ec-8665-acde48001122
|
||||
version: 1
|
||||
date: '2021-08-26'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect a net application command to discover password
|
||||
policy. This commandline can be used by IT and admin to list all account domain
|
||||
policy but also can be use by attacker as part of recon. this hunting query can
|
||||
be a good pivot to locate credential dumping or lateral movement as part of post
|
||||
attack.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
|
||||
OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process
|
||||
= "*/domain*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `password_policy_discovery_with_net_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
|
||||
known_false_positives: network operator or admin may use this command
|
||||
references:
|
||||
- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Discovery
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1201
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_name
|
||||
security_domain: endpoint
|
||||
impact: 30
|
||||
confidence: 30
|
||||
risk_score: 9
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Reconnaissance
|
||||
message: an instance of process $process_name$ with commandline $process$ in $dest$
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Parent Process
|
||||
role:
|
||||
- Parent Process
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,12 @@
|
||||
name: AdsiSearcher Account Discovery Unit Test
|
||||
tests:
|
||||
- name: AdsiSearcher Account Discovery
|
||||
file: endpoint/adsisearcher_account_discovery.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
|
||||
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: WinEventLog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Domain Account Discovery with Dsquery Unit Test
|
||||
tests:
|
||||
- name: Domain Account Discovery with Dsquery
|
||||
file: endpoint/domain_account_discovery_with_dsquery.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Domain Account Discovery With Net App Unit Test
|
||||
tests:
|
||||
- name: Domain Account Discovery With Net App
|
||||
file: endpoint/domain_account_discovery_with_net_app.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Domain Account Discovery with Wmic Unit Test
|
||||
tests:
|
||||
- name: Domain Account Discovery with Wmic
|
||||
file: endpoint/domain_account_discovery_with_wmic.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Get ADDefaultDomainPasswordPolicy with Powershell Unit Test
|
||||
tests:
|
||||
- name: Get ADDefaultDomainPasswordPolicy with Powershell
|
||||
file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block Unit Test
|
||||
tests:
|
||||
- name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block
|
||||
file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
|
||||
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: WinEventLog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Get ADUser with PowerShell Unit Test
|
||||
tests:
|
||||
- name: Get ADUser with PowerShell
|
||||
file: endpoint/get_aduser_with_powershell.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Get ADUser with PowerShell Script Block Unit Test
|
||||
tests:
|
||||
- name: Get ADUser with PowerShell Script Block
|
||||
file: endpoint/get_aduser_with_powershell_script_block.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
|
||||
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: WinEventLog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Get ADUserResultantPasswordPolicy with Powershell Unit Test
|
||||
tests:
|
||||
- name: Get ADUserResultantPasswordPolicy with Powershell
|
||||
file: endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Get ADUserResultantPasswordPolicy with Powershell Script Block Unit Test
|
||||
tests:
|
||||
- name: Get ADUserResultantPasswordPolicy with Powershell Script Block
|
||||
file: endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
|
||||
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: WinEventLog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Get DomainPolicy with Powershell Unit Test
|
||||
tests:
|
||||
- name: Get DomainPolicy with Powershell
|
||||
file: endpoint/get_domainpolicy_with_powershell.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Get DomainPolicy with Powershell Script Block Unit Test
|
||||
tests:
|
||||
- name: Get DomainPolicy with Powershell Script Block
|
||||
file: endpoint/get_domainpolicy_with_powershell_script_block.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
|
||||
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: WinEventLog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Get DomainUser with PowerShell Unit Test
|
||||
tests:
|
||||
- name: Get DomainUser with PowerShell
|
||||
file: endpoint/get_domainuser_with_powershell.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Get DomainUser with PowerShell Script Block Unit Test
|
||||
tests:
|
||||
- name: Get DomainUser with PowerShell Script Block
|
||||
file: endpoint/get_domainuser_with_powershell_script_block.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
|
||||
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: WinEventLog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: GetWmiObject DS User with PowerShell Unit Test
|
||||
tests:
|
||||
- name: GetWmiObject DS User with PowerShell
|
||||
file: endpoint/getwmiobject_ds_user_with_powershell.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: GetWmiObject DS User with PowerShell Script Block Unit Test
|
||||
tests:
|
||||
- name: GetWmiObject DS User with PowerShell Script Block
|
||||
file: endpoint/getwmiobject_ds_user_with_powershell_script_block.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
|
||||
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: WinEventLog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Password Policy Discovery with Net Unit Test
|
||||
tests:
|
||||
- name: Password Policy Discovery with Net
|
||||
file: endpoint/password_policy_discovery_with_net.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
Reference in New Issue
Block a user