diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml new file mode 100644 index 0000000000..fccf6eb36a --- /dev/null +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -0,0 +1,61 @@ +name: AdsiSearcher Account Discovery +id: de7fcadc-04f3-11ec-a241-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a powershell command adsisearcher to do user + enumeration to the active directory. This command can be a normal query of a network + admin but since the output of this is not so much structure and cannot give a concrete + or specific information that admin may look upon this is still a good TTP to alert + some malicious activities. +search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*" + Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime + by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `adsisearcher_account_discovery_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: not commonly seen as a normal command from network admin but + possible noise may exist. +references: +- https://www.blackhillsinfosec.com/red-blue-purple/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml new file mode 100644 index 0000000000..f6cb42ade4 --- /dev/null +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -0,0 +1,71 @@ +name: Domain Account Discovery with Dsquery +id: b1a8ce04-04c2-11ec-bea7-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search is to detect a suspicious process commandline of dsquery + for enumerating users. This technique is commonly in attacker and red team to recon + on users in targetted machine. This command can also be used by network administrator + but not by a normal user. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="dsquery.exe" + AND Processes.process = "*user*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `domain_account_discovery_with_dsquery_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network administrator may use this command but not commonly + seen used by a user. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml new file mode 100644 index 0000000000..957e770258 --- /dev/null +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -0,0 +1,71 @@ +name: Domain Account Discovery With Net App +id: 98f6a534-04c2-11ec-96b2-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a process command line for AD discovery. This + techique is using the windows built in net.exe application to query AD users in + the targetted machine. This techique was seen in several malware as part of there + recon and can be a good pivot of analysis. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" + OR Processes.process_name="net1.exe") AND Processes.process = "* user*" AND Processes.process + = "*/do*" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `domain_account_discovery_with_net_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network operator can execute this command +references: +- https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml new file mode 100644 index 0000000000..bc8df65b34 --- /dev/null +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -0,0 +1,72 @@ +name: Domain Account Discovery with Wmic +id: 383572e0-04c5-11ec-bdcc-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a wmic command for enumerating user in active + directory. This technique was commonly used in pentesting, red-team and also by + some attacker to map all user in the targetted host. This search may also catch + this type of query made by network admin but not common in all the user in the network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" + AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process + = "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `domain_account_discovery_with_wmic_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network admin may execute this command for listing users. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml new file mode 100644 index 0000000000..3c7fd85f4c --- /dev/null +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -0,0 +1,73 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell +id: 36e46ebe-065a-11ec-b4c7-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_addefaultdomainpasswordpolicy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: network operator may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed + diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml new file mode 100644 index 0000000000..4493f83d9e --- /dev/null +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml @@ -0,0 +1,61 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block +id: 1ff7ccc8-065a-11ec-91e4-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: network operator may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ to query domain password + policy + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml new file mode 100644 index 0000000000..ee1a676957 --- /dev/null +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -0,0 +1,72 @@ +name: Get ADUser with PowerShell +id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search is to detect a suspicious commandline that commonly uses + for enumerating users in active directory. This technique can be a good indicator + to hunt further TTPs to the machine to check further anomalies. Since this is a + hunt query expect some noise from administrator or some IT within the network that + may use this command. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUser*" + AND Processes.process = "*-filter*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network admin may use this command. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml new file mode 100644 index 0000000000..bec9395557 --- /dev/null +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -0,0 +1,61 @@ +name: Get ADUser with PowerShell Script Block +id: 21432e40-04f4-11ec-b7e6-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search is to detect a powershell command get-aduser function to + do user enumeration to the active directory. This command can be a normal query + of a network admin but since the output of this is not so much structure and cannot + give a concrete or specific information that admin may look upon this is still a + good TTP to alert some malicious activities. +search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_aduser_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: network admin may use this command and other IT operator to + check AD users. +references: +- https://www.blackhillsinfosec.com/red-blue-purple/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml new file mode 100644 index 0000000000..ad490becb3 --- /dev/null +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml @@ -0,0 +1,72 @@ +name: Get ADUserResultantPasswordPolicy with Powershell +id: 8b5ef342-065a-11ec-b0fc-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_aduserresultantpasswordpolicy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: network operator or admin may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml new file mode 100644 index 0000000000..6dd5fd9fbb --- /dev/null +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml @@ -0,0 +1,61 @@ +name: Get ADUserResultantPasswordPolicy with Powershell Script Block +id: 737e1eb0-065a-11ec-921a-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: network operator may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ to query domain user password + policy. + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml new file mode 100644 index 0000000000..133acaf599 --- /dev/null +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -0,0 +1,71 @@ +name: Get DomainPolicy with Powershell +id: b8f9947e-065a-11ec-aafb-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a possible execution of powerview pentesting + tool for domain controller recon. This search look for function Get-DomainPolicy + to parse the domain policy of the targeted host. This TTP may be a good pivot to + look for credential dumping technique or lateral movement. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_domainpolicy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: network operator or admin may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 60 + risk_score: 30 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml new file mode 100644 index 0000000000..f0f5889b81 --- /dev/null +++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml @@ -0,0 +1,58 @@ +name: Get DomainPolicy with Powershell Script Block +id: a360d2b2-065a-11ec-b0bf-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a possible execution of powerview pentesting + tool for domain controller recon. This search look for function Get-DomainPolicy + to parse the domain policy of the targeted host. This TTP may be a good pivot to + look for credential dumping technique or lateral movement. +search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: unknown +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 60 + risk_score: 30 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ to query domain policy. + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml new file mode 100644 index 0000000000..d6f9432887 --- /dev/null +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -0,0 +1,70 @@ +name: Get DomainUser with PowerShell +id: 9a5a41d6-04e7-11ec-923c-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a cmdlet Get-DomainUser that are common on powerview + or powersploit tool. This cmdlet is used to recon on the targetted machine to enumerate + all users in active directory. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainUser*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_domainuser_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml new file mode 100644 index 0000000000..7dced17095 --- /dev/null +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -0,0 +1,60 @@ +name: Get DomainUser with PowerShell Script Block +id: 61994268-04f4-11ec-865c-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: his search is to detect a powershell command Get-DomainUser to do user + enumeration to the active directory. This command is function seen in powerspoit + and powerview tool that are designed to pentest active directory or domain controller + for possible attack. This is a good TTP for alerting SOC if there is a pentest or + recon happening on the system. try to look for lateral movement technique or credential + dumping techniques in the system. +search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: unknown +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml new file mode 100644 index 0000000000..7664fa83e3 --- /dev/null +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -0,0 +1,72 @@ +name: GetWmiObject DS User with PowerShell +id: 22d3b118-04df-11ec-8fa3-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious execution wmi process that enumerate + user in active directory. This technique can be used by attacker and pentester to + mapped all the users as part of its recon to the targetted host. Network Admin may + seen executing this command but not often and also not common to see in user events. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*get-wmiobject*" + AND Processes.process = "*ds_user*" AND Processes.process = "*root\\directory\\ldap*" + AND Processes.process = "*-namespace*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network admin may execute this command. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml new file mode 100644 index 0000000000..26b31ee511 --- /dev/null +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -0,0 +1,62 @@ +name: GetWmiObject DS User with PowerShell Script Block +id: fabd364e-04f3-11ec-b34b-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a powershell command get-wmiobject function + to do user enumeration to the active directory. This command can be a normal query + of a network admin but since the output of this is not so much structure and cannot + give a concrete or specific information that admin may look upon this is still a + good TTP to alert some malicious activities. +search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" + Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`' +how_to_implement: he following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: not commonly seen as a normal command from network admin but + possible noise may exist. +references: +- https://www.blackhillsinfosec.com/red-blue-purple/ +- https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml new file mode 100644 index 0000000000..0ba6d0f025 --- /dev/null +++ b/detections/endpoint/password_policy_discovery_with_net.yml @@ -0,0 +1,72 @@ +name: Password Policy Discovery with Net +id: 09336538-065a-11ec-8665-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search is to detect a net application command to discover password + policy. This commandline can be used by IT and admin to list all account domain + policy but also can be use by attacker as part of recon. this hunting query can + be a good pivot to locate credential dumping or lateral movement as part of post + attack. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" + OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process + = "*/domain*" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `password_policy_discovery_with_net_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: network operator or admin may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/tests/endpoint/adsisearcher_account_discovery.test.yml b/tests/endpoint/adsisearcher_account_discovery.test.yml new file mode 100644 index 0000000000..b727b66bb5 --- /dev/null +++ b/tests/endpoint/adsisearcher_account_discovery.test.yml @@ -0,0 +1,12 @@ +name: AdsiSearcher Account Discovery Unit Test +tests: +- name: AdsiSearcher Account Discovery + file: endpoint/adsisearcher_account_discovery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/domain_account_discovery_with_dsquery.test.yml b/tests/endpoint/domain_account_discovery_with_dsquery.test.yml new file mode 100644 index 0000000000..998b007966 --- /dev/null +++ b/tests/endpoint/domain_account_discovery_with_dsquery.test.yml @@ -0,0 +1,12 @@ +name: Domain Account Discovery with Dsquery Unit Test +tests: +- name: Domain Account Discovery with Dsquery + file: endpoint/domain_account_discovery_with_dsquery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/domain_account_discovery_with_net_app.test.yml b/tests/endpoint/domain_account_discovery_with_net_app.test.yml new file mode 100644 index 0000000000..4a78b48b43 --- /dev/null +++ b/tests/endpoint/domain_account_discovery_with_net_app.test.yml @@ -0,0 +1,12 @@ +name: Domain Account Discovery With Net App Unit Test +tests: +- name: Domain Account Discovery With Net App + file: endpoint/domain_account_discovery_with_net_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/domain_account_discovery_with_wmic.test.yml b/tests/endpoint/domain_account_discovery_with_wmic.test.yml new file mode 100644 index 0000000000..0cd381fae0 --- /dev/null +++ b/tests/endpoint/domain_account_discovery_with_wmic.test.yml @@ -0,0 +1,12 @@ +name: Domain Account Discovery with Wmic Unit Test +tests: +- name: Domain Account Discovery with Wmic + file: endpoint/domain_account_discovery_with_wmic.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml new file mode 100644 index 0000000000..40479d3a9a --- /dev/null +++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell Unit Test +tests: +- name: Get ADDefaultDomainPasswordPolicy with Powershell + file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..15b4775f0f --- /dev/null +++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block Unit Test +tests: +- name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block + file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/get_aduser_with_powershell.test.yml b/tests/endpoint/get_aduser_with_powershell.test.yml new file mode 100644 index 0000000000..461b37924d --- /dev/null +++ b/tests/endpoint/get_aduser_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Get ADUser with PowerShell Unit Test +tests: +- name: Get ADUser with PowerShell + file: endpoint/get_aduser_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_aduser_with_powershell_script_block.test.yml b/tests/endpoint/get_aduser_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..31858a93c2 --- /dev/null +++ b/tests/endpoint/get_aduser_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get ADUser with PowerShell Script Block Unit Test +tests: +- name: Get ADUser with PowerShell Script Block + file: endpoint/get_aduser_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml new file mode 100644 index 0000000000..ace51f6c21 --- /dev/null +++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml @@ -0,0 +1,12 @@ +name: Get ADUserResultantPasswordPolicy with Powershell Unit Test +tests: +- name: Get ADUserResultantPasswordPolicy with Powershell + file: endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..1e9fd7eb85 --- /dev/null +++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get ADUserResultantPasswordPolicy with Powershell Script Block Unit Test +tests: +- name: Get ADUserResultantPasswordPolicy with Powershell Script Block + file: endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/get_domainpolicy_with_powershell.test.yml b/tests/endpoint/get_domainpolicy_with_powershell.test.yml new file mode 100644 index 0000000000..f484567632 --- /dev/null +++ b/tests/endpoint/get_domainpolicy_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Get DomainPolicy with Powershell Unit Test +tests: +- name: Get DomainPolicy with Powershell + file: endpoint/get_domainpolicy_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..705eb31b67 --- /dev/null +++ b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get DomainPolicy with Powershell Script Block Unit Test +tests: +- name: Get DomainPolicy with Powershell Script Block + file: endpoint/get_domainpolicy_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/get_domainuser_with_powershell.test.yml b/tests/endpoint/get_domainuser_with_powershell.test.yml new file mode 100644 index 0000000000..0abe5e6722 --- /dev/null +++ b/tests/endpoint/get_domainuser_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Get DomainUser with PowerShell Unit Test +tests: +- name: Get DomainUser with PowerShell + file: endpoint/get_domainuser_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..bae14d79d5 --- /dev/null +++ b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get DomainUser with PowerShell Script Block Unit Test +tests: +- name: Get DomainUser with PowerShell Script Block + file: endpoint/get_domainuser_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml b/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml new file mode 100644 index 0000000000..6637d3263c --- /dev/null +++ b/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: GetWmiObject DS User with PowerShell Unit Test +tests: +- name: GetWmiObject DS User with PowerShell + file: endpoint/getwmiobject_ds_user_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..ee1809782e --- /dev/null +++ b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: GetWmiObject DS User with PowerShell Script Block Unit Test +tests: +- name: GetWmiObject DS User with PowerShell Script Block + file: endpoint/getwmiobject_ds_user_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/password_policy_discovery_with_net.test.yml b/tests/endpoint/password_policy_discovery_with_net.test.yml new file mode 100644 index 0000000000..7513d219d9 --- /dev/null +++ b/tests/endpoint/password_policy_discovery_with_net.test.yml @@ -0,0 +1,12 @@ +name: Password Policy Discovery with Net Unit Test +tests: +- name: Password Policy Discovery with Net + file: endpoint/password_policy_discovery_with_net.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file