From ed612666f06be7e8ac684af72d9faee2088fd246 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 25 Aug 2021 11:00:06 +0200 Subject: [PATCH 01/49] AD_Discovery_TR-789_2 --- .../adsisearcher_account_discovery.yml | 60 ++++++++++++++++ .../domain_account_discovery_with_dsquery.yml | 71 +++++++++++++++++++ .../domain_account_discovery_with_net_app.yml | 69 ++++++++++++++++++ .../domain_account_discovery_with_wmic.yml | 71 +++++++++++++++++++ .../endpoint/get_aduser_with_powershell.yml | 71 +++++++++++++++++++ ...et_aduser_with_powershell_script_block.yml | 59 +++++++++++++++ .../get_domainuser_with_powershell.yml | 69 ++++++++++++++++++ ...omainuser_with_powershell_script_block.yml | 61 ++++++++++++++++ .../getwmiobject_ds_user_with_powershell.yml | 71 +++++++++++++++++++ ...t_ds_user_with_powershell_script_block.yml | 61 ++++++++++++++++ .../adsisearcher_account_discovery.test.yml | 12 ++++ ...in_account_discovery_with_dsquery.test.yml | 12 ++++ ...in_account_discovery_with_net_app.test.yml | 12 ++++ ...omain_account_discovery_with_wmic.test.yml | 12 ++++ .../get_aduser_with_powershell.test.yml | 12 ++++ ...user_with_powershell_script_block.test.yml | 12 ++++ .../get_domainuser_with_powershell.test.yml | 12 ++++ ...user_with_powershell_script_block.test.yml | 12 ++++ ...wmiobject_ds_user_with_powershell.test.yml | 12 ++++ ...user_with_powershell_script_block.test.yml | 12 ++++ 20 files changed, 783 insertions(+) create mode 100644 detections/endpoint/adsisearcher_account_discovery.yml create mode 100644 detections/endpoint/domain_account_discovery_with_dsquery.yml create mode 100644 detections/endpoint/domain_account_discovery_with_net_app.yml create mode 100644 detections/endpoint/domain_account_discovery_with_wmic.yml create mode 100644 detections/endpoint/get_aduser_with_powershell.yml create mode 100644 detections/endpoint/get_aduser_with_powershell_script_block.yml create mode 100644 detections/endpoint/get_domainuser_with_powershell.yml create mode 100644 detections/endpoint/get_domainuser_with_powershell_script_block.yml create mode 100644 detections/endpoint/getwmiobject_ds_user_with_powershell.yml create mode 100644 detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml create mode 100644 tests/endpoint/adsisearcher_account_discovery.test.yml create mode 100644 tests/endpoint/domain_account_discovery_with_dsquery.test.yml create mode 100644 tests/endpoint/domain_account_discovery_with_net_app.test.yml create mode 100644 tests/endpoint/domain_account_discovery_with_wmic.test.yml create mode 100644 tests/endpoint/get_aduser_with_powershell.test.yml create mode 100644 tests/endpoint/get_aduser_with_powershell_script_block.test.yml create mode 100644 tests/endpoint/get_domainuser_with_powershell.test.yml create mode 100644 tests/endpoint/get_domainuser_with_powershell_script_block.test.yml create mode 100644 tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml create mode 100644 tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml new file mode 100644 index 0000000000..f41fa74301 --- /dev/null +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -0,0 +1,60 @@ +name: AdsiSearcher Account Discovery +id: de7fcadc-04f3-11ec-a241-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a powershell command adsisearcher to do user enumeration to the active directory. + This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or + specific information that admin may look upon this is still a good TTP to alert some malicious activities. +search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*" Message = "*.findAll()*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `adsisearcher_account_discovery_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. + Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, + or PowerShell Script Block Logging. +known_false_positives: not commonly seen as a normal command from network admin but possible noise may exist. +references: +- https://www.blackhillsinfosec.com/red-blue-purple/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml new file mode 100644 index 0000000000..3b6dc6a699 --- /dev/null +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -0,0 +1,71 @@ +name: Domain Account Discovery with Dsquery +id: b1a8ce04-04c2-11ec-bea7-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: Hunt +datamodel: +- Endpoint +description: This search is to detect a suspicious process commandline of dsquery for enumerating users. + This technique is commonly in attacker and red team to recon on users in targetted machine. + This command can also be used by network administrator but not by a normal user. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name="dsquery.exe" AND Processes.process = "*user*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `domain_account_discovery_with_dsquery_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network administrator may use this command but not commonly seen used by a user. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + \ No newline at end of file diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml new file mode 100644 index 0000000000..8cc9121553 --- /dev/null +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -0,0 +1,69 @@ +name: Domain Account Discovery With Net App +id: 98f6a534-04c2-11ec-96b2-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a process command line for AD discovery. This techique is using the windows built in net.exe application + to query AD users in the targetted machine. This techique was seen in several malware as part of there recon and can be a good pivot of analysis. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") AND Processes.process = "* user*" AND Processes.process = "*/do*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `domain_account_discovery_with_net_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network operator can execute this command +references: +- https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process \ No newline at end of file diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml new file mode 100644 index 0000000000..f0315614a3 --- /dev/null +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -0,0 +1,71 @@ +name: Domain Account Discovery with Wmic +id: 383572e0-04c5-11ec-bdcc-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a wmic command for enumerating user in active directory. + This technique was commonly used in pentesting, red-team and also by some attacker to map all user in the targetted host. + This search may also catch this type of query made by network admin but not common in all the user in the network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name="wmic.exe" AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process = "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `domain_account_discovery_with_wmic_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network admin may execute this command for listing users. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + \ No newline at end of file diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml new file mode 100644 index 0000000000..2849c15766 --- /dev/null +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -0,0 +1,71 @@ +name: Get_ADUser with PowerShell +id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: Hunt +datamodel: +- Endpoint +description: This search is to detect a suspicious commandline that commonly uses for enumerating users in active directory. + This technique can be a good indicator to hunt further TTPs to the machine to check further anomalies. Since this is a hunt query expect + some noise from administrator or some IT within the network that may use this command. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUser*" AND Processes.process = "*-filter*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `get_aduser_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network admin may use this command. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + \ No newline at end of file diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml new file mode 100644 index 0000000000..9fd21ba2ea --- /dev/null +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -0,0 +1,59 @@ +name: Get_ADUser with PowerShell Script Block +id: 21432e40-04f4-11ec-b7e6-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: Hunt +datamodel: +- Endpoint +description: This search is to detect a powershell command get-aduser function to do user enumeration to the active directory. + This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or + specific information that admin may look upon this is still a good TTP to alert some malicious activities. +search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `get_aduser_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. + Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, + or PowerShell Script Block Logging. +known_false_positives: network admin may use this command and other IT operator to check AD users. +references: +- https://www.blackhillsinfosec.com/red-blue-purple/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml new file mode 100644 index 0000000000..a805a03eaf --- /dev/null +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -0,0 +1,69 @@ +name: Get_DomainUser with PowerShell +id: 9a5a41d6-04e7-11ec-923c-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a cmdlet Get-DomainUser that are common on powerview or powersploit tool. + This cmdlet is used to recon on the targetted machine to enumerate all users in active directory. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainUser*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `get_domainuser_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process \ No newline at end of file diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml new file mode 100644 index 0000000000..5ec13cf5c8 --- /dev/null +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -0,0 +1,61 @@ +name: Get DomainUser with PowerShell Script Block +id: 61994268-04f4-11ec-865c-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: his search is to detect a powershell command Get-DomainUser to do user enumeration to the active directory. + This command is function seen in powerspoit and powerview tool that are designed to pentest active directory or domain controller for possible attack. + This is a good TTP for alerting SOC if there is a pentest or recon happening on the system. try to look for lateral movement technique or credential + dumping techniques in the system. +search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `get_domainuser_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. + Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, + or PowerShell Script Block Logging. +known_false_positives: unknown +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml new file mode 100644 index 0000000000..42ea86e85d --- /dev/null +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -0,0 +1,71 @@ +name: GetWmiObject DS_User with PowerShell +id: 22d3b118-04df-11ec-8fa3-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious execution wmi process that enumerate user in active directory. + This technique can be used by attacker and pentester to mapped all the users as part of its recon to the targetted host. + Network Admin may seen executing this command but not often and also not common to see in user events. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*get-wmiobject*" AND Processes.process = "*ds_user*" AND Processes.process = "*root\\directory\\ldap*" AND Processes.process = "*-namespace*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `getwmiobject_ds_user_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network admin may execute this command. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + \ No newline at end of file diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml new file mode 100644 index 0000000000..13664a1d18 --- /dev/null +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -0,0 +1,61 @@ +name: GetWmiObject DS_User with PowerShell Script Block +id: fabd364e-04f3-11ec-b34b-acde48001122 +version: 1 +date: '2021-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a powershell command get-wmiobject function to do user enumeration to the active directory. + This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or + specific information that admin may look upon this is still a good TTP to alert some malicious activities. +search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" Message = "*-namespace*" Message = "*root\\directory\\ldap*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `getwmiobject_ds_user_with_powershell_script_block_filter`' +how_to_implement: he following Hunting analytic requires PowerShell operational logs to be imported. + Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, + or PowerShell Script Block Logging. +known_false_positives: not commonly seen as a normal command from network admin but possible noise may exist. +references: +- https://www.blackhillsinfosec.com/red-blue-purple/ +- https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/adsisearcher_account_discovery.test.yml b/tests/endpoint/adsisearcher_account_discovery.test.yml new file mode 100644 index 0000000000..b727b66bb5 --- /dev/null +++ b/tests/endpoint/adsisearcher_account_discovery.test.yml @@ -0,0 +1,12 @@ +name: AdsiSearcher Account Discovery Unit Test +tests: +- name: AdsiSearcher Account Discovery + file: endpoint/adsisearcher_account_discovery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/domain_account_discovery_with_dsquery.test.yml b/tests/endpoint/domain_account_discovery_with_dsquery.test.yml new file mode 100644 index 0000000000..998b007966 --- /dev/null +++ b/tests/endpoint/domain_account_discovery_with_dsquery.test.yml @@ -0,0 +1,12 @@ +name: Domain Account Discovery with Dsquery Unit Test +tests: +- name: Domain Account Discovery with Dsquery + file: endpoint/domain_account_discovery_with_dsquery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/domain_account_discovery_with_net_app.test.yml b/tests/endpoint/domain_account_discovery_with_net_app.test.yml new file mode 100644 index 0000000000..4a78b48b43 --- /dev/null +++ b/tests/endpoint/domain_account_discovery_with_net_app.test.yml @@ -0,0 +1,12 @@ +name: Domain Account Discovery With Net App Unit Test +tests: +- name: Domain Account Discovery With Net App + file: endpoint/domain_account_discovery_with_net_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/domain_account_discovery_with_wmic.test.yml b/tests/endpoint/domain_account_discovery_with_wmic.test.yml new file mode 100644 index 0000000000..0cd381fae0 --- /dev/null +++ b/tests/endpoint/domain_account_discovery_with_wmic.test.yml @@ -0,0 +1,12 @@ +name: Domain Account Discovery with Wmic Unit Test +tests: +- name: Domain Account Discovery with Wmic + file: endpoint/domain_account_discovery_with_wmic.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_aduser_with_powershell.test.yml b/tests/endpoint/get_aduser_with_powershell.test.yml new file mode 100644 index 0000000000..e849e85044 --- /dev/null +++ b/tests/endpoint/get_aduser_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Get_ADUser with PowerShell Unit Test +tests: +- name: Get_ADUser with PowerShell + file: endpoint/get_aduser_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_aduser_with_powershell_script_block.test.yml b/tests/endpoint/get_aduser_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..551e9e029e --- /dev/null +++ b/tests/endpoint/get_aduser_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get_ADUser with PowerShell Script Block Unit Test +tests: +- name: Get_ADUser with PowerShell Script Block + file: endpoint/get_aduser_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/get_domainuser_with_powershell.test.yml b/tests/endpoint/get_domainuser_with_powershell.test.yml new file mode 100644 index 0000000000..9f537cc3bc --- /dev/null +++ b/tests/endpoint/get_domainuser_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Get_DomainUser with PowerShell Unit Test +tests: +- name: Get_DomainUser with PowerShell + file: endpoint/get_domainuser_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..ba153d19dd --- /dev/null +++ b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get DomainUser with PowerShell Script Block Unit Test +tests: +- name: Get DomainUser with PowerShell Script Block + file: detections/endpoint/get_domainuser_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml b/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml new file mode 100644 index 0000000000..67502e39bf --- /dev/null +++ b/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: GetWmiObject DS_User with PowerShell Unit Test +tests: +- name: GetWmiObject DS_User with PowerShell + file: endpoint/getwmiobject_ds_user_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..b4f5151cad --- /dev/null +++ b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: GetWmiObject DS_User with PowerShell Script Block Unit Test +tests: +- name: GetWmiObject DS_User with PowerShell Script Block + file: endpoint/getwmiobject_ds_user_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file From ef362396b2291f367df6d935f803c9162310730c Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 25 Aug 2021 17:16:13 +0200 Subject: [PATCH 02/49] AD_Discovery_TR-789_2 --- ...et_domainuser_with_powershell_script_block.test.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml index ba153d19dd..1b74cec450 100644 --- a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml @@ -1,12 +1,12 @@ name: Get DomainUser with PowerShell Script Block Unit Test tests: - name: Get DomainUser with PowerShell Script Block - file: detections/endpoint/get_domainuser_with_powershell_script_block.yml + file: endpoint/get_domainuser_with_powershell_script_block.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file From b371f23f6a60bd642e9dd917bb45eb062528531c Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 25 Aug 2021 17:51:44 +0200 Subject: [PATCH 03/49] AD_Discovery_TR-789_2 --- detections/endpoint/adsisearcher_account_discovery.yml | 2 +- detections/endpoint/domain_account_discovery_with_dsquery.yml | 2 +- detections/endpoint/domain_account_discovery_with_wmic.yml | 2 +- detections/endpoint/get_aduser_with_powershell.yml | 2 +- detections/endpoint/get_aduser_with_powershell_script_block.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index f41fa74301..3ce89c3cd2 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -3,7 +3,7 @@ id: de7fcadc-04f3-11ec-a241-acde48001122 version: 1 date: '2021-08-24' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a powershell command adsisearcher to do user enumeration to the active directory. diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml index 3b6dc6a699..50740f59d8 100644 --- a/detections/endpoint/domain_account_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -3,7 +3,7 @@ id: b1a8ce04-04c2-11ec-bea7-acde48001122 version: 1 date: '2021-08-24' author: Teoderick Contreras, Splunk -type: Hunt +type: Hunting datamodel: - Endpoint description: This search is to detect a suspicious process commandline of dsquery for enumerating users. diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml index f0315614a3..9c62578cd5 100644 --- a/detections/endpoint/domain_account_discovery_with_wmic.yml +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -3,7 +3,7 @@ id: 383572e0-04c5-11ec-bdcc-acde48001122 version: 1 date: '2021-08-24' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a wmic command for enumerating user in active directory. diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index 2849c15766..b37aebd272 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -3,7 +3,7 @@ id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 version: 1 date: '2021-08-24' author: Teoderick Contreras, Splunk -type: Hunt +type: Hunting datamodel: - Endpoint description: This search is to detect a suspicious commandline that commonly uses for enumerating users in active directory. diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index 9fd21ba2ea..5ddb228220 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -3,7 +3,7 @@ id: 21432e40-04f4-11ec-b7e6-acde48001122 version: 1 date: '2021-08-24' author: Teoderick Contreras, Splunk -type: Hunt +type: Hunting datamodel: - Endpoint description: This search is to detect a powershell command get-aduser function to do user enumeration to the active directory. From 6bfad13aae72ce79d095dcc367c0b5a69204afe7 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 25 Aug 2021 17:57:13 +0200 Subject: [PATCH 04/49] AD_Discovery_TR-789_2 --- detections/endpoint/get_aduser_with_powershell.yml | 2 +- .../endpoint/get_aduser_with_powershell_script_block.yml | 2 +- detections/endpoint/get_domainuser_with_powershell.yml | 2 +- .../getwmiobject_ds_user_with_powershell_script_block.yml | 2 +- tests/endpoint/get_aduser_with_powershell.test.yml | 4 ++-- .../endpoint/get_aduser_with_powershell_script_block.test.yml | 4 ++-- tests/endpoint/get_domainuser_with_powershell.test.yml | 4 ++-- tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml | 4 ++-- ...getwmiobject_ds_user_with_powershell_script_block.test.yml | 4 ++-- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index b37aebd272..5dd526e6be 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -1,4 +1,4 @@ -name: Get_ADUser with PowerShell +name: Get ADUser with PowerShell id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 version: 1 date: '2021-08-24' diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index 5ddb228220..995401212c 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -1,4 +1,4 @@ -name: Get_ADUser with PowerShell Script Block +name: Get ADUser with PowerShell Script Block id: 21432e40-04f4-11ec-b7e6-acde48001122 version: 1 date: '2021-08-24' diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index a805a03eaf..531a62f336 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -1,4 +1,4 @@ -name: Get_DomainUser with PowerShell +name: Get DomainUser with PowerShell id: 9a5a41d6-04e7-11ec-923c-acde48001122 version: 1 date: '2021-08-24' diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml index 13664a1d18..c344da01df 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -1,4 +1,4 @@ -name: GetWmiObject DS_User with PowerShell Script Block +name: GetWmiObject DS User with PowerShell Script Block id: fabd364e-04f3-11ec-b34b-acde48001122 version: 1 date: '2021-08-24' diff --git a/tests/endpoint/get_aduser_with_powershell.test.yml b/tests/endpoint/get_aduser_with_powershell.test.yml index e849e85044..461b37924d 100644 --- a/tests/endpoint/get_aduser_with_powershell.test.yml +++ b/tests/endpoint/get_aduser_with_powershell.test.yml @@ -1,6 +1,6 @@ -name: Get_ADUser with PowerShell Unit Test +name: Get ADUser with PowerShell Unit Test tests: -- name: Get_ADUser with PowerShell +- name: Get ADUser with PowerShell file: endpoint/get_aduser_with_powershell.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' diff --git a/tests/endpoint/get_aduser_with_powershell_script_block.test.yml b/tests/endpoint/get_aduser_with_powershell_script_block.test.yml index 551e9e029e..31858a93c2 100644 --- a/tests/endpoint/get_aduser_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_aduser_with_powershell_script_block.test.yml @@ -1,6 +1,6 @@ -name: Get_ADUser with PowerShell Script Block Unit Test +name: Get ADUser with PowerShell Script Block Unit Test tests: -- name: Get_ADUser with PowerShell Script Block +- name: Get ADUser with PowerShell Script Block file: endpoint/get_aduser_with_powershell_script_block.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' diff --git a/tests/endpoint/get_domainuser_with_powershell.test.yml b/tests/endpoint/get_domainuser_with_powershell.test.yml index 9f537cc3bc..0abe5e6722 100644 --- a/tests/endpoint/get_domainuser_with_powershell.test.yml +++ b/tests/endpoint/get_domainuser_with_powershell.test.yml @@ -1,6 +1,6 @@ -name: Get_DomainUser with PowerShell Unit Test +name: Get DomainUser with PowerShell Unit Test tests: -- name: Get_DomainUser with PowerShell +- name: Get DomainUser with PowerShell file: endpoint/get_domainuser_with_powershell.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' diff --git a/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml b/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml index 67502e39bf..6637d3263c 100644 --- a/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml +++ b/tests/endpoint/getwmiobject_ds_user_with_powershell.test.yml @@ -1,6 +1,6 @@ -name: GetWmiObject DS_User with PowerShell Unit Test +name: GetWmiObject DS User with PowerShell Unit Test tests: -- name: GetWmiObject DS_User with PowerShell +- name: GetWmiObject DS User with PowerShell file: endpoint/getwmiobject_ds_user_with_powershell.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' diff --git a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml index b4f5151cad..89c7c1a25e 100644 --- a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml +++ b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml @@ -1,6 +1,6 @@ -name: GetWmiObject DS_User with PowerShell Script Block Unit Test +name: GetWmiObject DS User with PowerShell Script Block Unit Test tests: -- name: GetWmiObject DS_User with PowerShell Script Block +- name: GetWmiObject DS User with PowerShell Script Block file: endpoint/getwmiobject_ds_user_with_powershell_script_block.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' From b32a41893e54cc67e96b62b265c39d59ca8c1da6 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 25 Aug 2021 18:04:43 +0200 Subject: [PATCH 05/49] AD_Discovery_TR-789_2 --- detections/endpoint/getwmiobject_ds_user_with_powershell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml index 42ea86e85d..638591a31b 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -1,4 +1,4 @@ -name: GetWmiObject DS_User with PowerShell +name: GetWmiObject DS User with PowerShell id: 22d3b118-04df-11ec-8fa3-acde48001122 version: 1 date: '2021-08-24' From c4f3cf78999e86b60d6a8b3e0a61a28ce0f8b860 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 19 Aug 2021 15:45:36 +0200 Subject: [PATCH 06/49] dev_sec2 --- ...ail_suspicious_subject_with_attachment.yml | 64 +++++++++++++++++++ ...uspicious_subject_with_attachment.test.yml | 12 ++++ 2 files changed, 76 insertions(+) create mode 100644 detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml create mode 100644 tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml new file mode 100644 index 0000000000..830034e639 --- /dev/null +++ b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml @@ -0,0 +1,64 @@ +name: Gsuite Email Suspicious Subject With Attachment +id: 8ef3971e-00f2-11ec-b54f-acde48001122 +version: 1 +date: '2021-08-19' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +- Email +- Updates +description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. + This technique is really a very common and effective entry vector of attacker to compromise a network by clicking or running the suspicous attachment + send from external email account. +search: '`gsuite_gmail` num_message_attachments > 0 + subject IN ("*dhl*", "* ups *”, “*delivery*”, “*parcel*”, “*label*”, “*invoice*”, “*postal*”, “* fedex *”, “* usps *”, “* express *”, “*shipment*”, “*Banking/Tax*”,”*shipment*”, “*new order*”) + attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar”, “html”,”htm”,”hta”) + | rex field=source.from_header_address "[^@]+@(?[^@]+)" + | rex field=destination{}.address "[^@]+@(?[^@]+)" + | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" + | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by + destination{}.service num_message_attachments subject destination{}.address source.address + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_email_suspicious_subject_with_attachment_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: normal user or normal transaction may contain the subject and file type attachment that + this detection try to search. +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops +tags: + analytic_story: + - DevSecOps + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious email from $source.address$ to $destination{}.address$ + observable: + - name: source.address + type: User + role: + - attacker + - name: destination{}.address + type: User + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml new file mode 100644 index 0000000000..0e535c5fae --- /dev/null +++ b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Email Suspicious Subject With Attachment Unit Test +tests: +- name: Gsuite Email Suspicious Subject With Attachment + file: detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From a2f338a91b5c23a1cf0b7069f0766e9c68a975f0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 20 Aug 2021 10:40:33 +0200 Subject: [PATCH 07/49] dev_sec2 --- ...gsuite_email_suspicious_subject_with_attachment.yml | 8 +++++--- ...e_email_suspicious_subject_with_attachment.test.yml | 10 +++++----- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml index 830034e639..99ca5cfd98 100644 --- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml @@ -9,8 +9,10 @@ datamodel: - Email - Updates description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. - This technique is really a very common and effective entry vector of attacker to compromise a network by clicking or running the suspicous attachment - send from external email account. + This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment + send from external email account because of the effective social engineering of subject related to delivery, bank and so on. + On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. + avoid click link or opening the attachment if you are not expecting this type of e-mail. search: '`gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *”, “*delivery*”, “*parcel*”, “*label*”, “*invoice*”, “*postal*”, “* fedex *”, “* usps *”, “* express *”, “*shipment*”, “*Banking/Tax*”,”*shipment*”, “*new order*”) attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar”, “html”,”htm”,”hta”) @@ -33,7 +35,7 @@ tags: analytic_story: - DevSecOps dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml index 0e535c5fae..c3cb0a32c8 100644 --- a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml +++ b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml @@ -1,12 +1,12 @@ name: Gsuite Email Suspicious Subject With Attachment Unit Test tests: - name: Gsuite Email Suspicious Subject With Attachment - file: detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml + file: endpoint/gsuite_email_suspicious_subject_with_attachment.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: gsuite_susp_subj_attach.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log + source: http:gsuite + sourcetype: gsuite:gmail:bigquery \ No newline at end of file From 476487d6d5dc97c77f298f898e690b951147952c Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 13:13:53 +0200 Subject: [PATCH 08/49] dev_sec2 --- ...ail_suspicious_subject_with_attachment.yml | 1 + .../gsuite_suspicious_shared_file_name.yml | 69 +++++++++++++++++++ ...suite_suspicious_shared_file_name.test.yml | 12 ++++ 3 files changed, 82 insertions(+) create mode 100644 detections/endpoint/gsuite_suspicious_shared_file_name.yml create mode 100644 tests/endpoint/gsuite_suspicious_shared_file_name.test.yml diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml index 99ca5cfd98..566f03c8a9 100644 --- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml @@ -31,6 +31,7 @@ known_false_positives: normal user or normal transaction may contain the subject this detection try to search. references: - https://www.redhat.com/en/topics/devops/what-is-devsecops +- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf tags: analytic_story: - DevSecOps diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml new file mode 100644 index 0000000000..f078dbcbeb --- /dev/null +++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml @@ -0,0 +1,69 @@ +name: Gsuite Suspicious Shared File Name +id: 07eed200-03f5-11ec-98fb-acde48001122 +version: 1 +date: '2021-08-23' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +- Email +description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. + This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. + This detection can also catch some normal email communication between organization and its external customer. +search: 'index=obs-gsuite sourcetype=gsuite:drive:json parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") + | rex field=parameters.owner "[^@]+@(?[^@]+)" + | rex field=parameters.target_user "[^@]+@(?[^@]+)" + | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" + | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_suspicious_shared_file_name_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: normal user or normal transaction may contain the subject and file type attachment that + this detection try to search +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops +- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf +tags: + analytic_story: + - DevSecOps + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - parameters.doc_title + - src_domain + - dest_domain + - email + - parameters.visibility + - parameters.owner + - parameters.doc_type + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ + observable: + - name: parameters.owner + type: User + role: + - attacker + - name: email + type: User + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml b/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml new file mode 100644 index 0000000000..a59374a794 --- /dev/null +++ b/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Suspicious Shared File Name Unit Test +tests: +- name: Gsuite Suspicious Shared File Name + file: endpoint/gsuite_suspicious_shared_file_name.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: gdrive_susp_attach.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log + source: http:gsuite + sourcetype: gsuite:drive:json \ No newline at end of file From 9a0227affd2700c6821ab1fd152b128290417d56 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 13:16:30 +0200 Subject: [PATCH 09/49] dev_sec2 --- detections/endpoint/gsuite_suspicious_shared_file_name.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml index f078dbcbeb..87f2ecbb87 100644 --- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml +++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml @@ -3,7 +3,7 @@ id: 07eed200-03f5-11ec-98fb-acde48001122 version: 1 date: '2021-08-23' author: Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: - Endpoint - Email From 64ef47d844deb20350ec831688a7eaff71a9f461 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 13:18:57 +0200 Subject: [PATCH 10/49] dev_sec2 --- detections/endpoint/gsuite_suspicious_shared_file_name.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml index 87f2ecbb87..dda923e569 100644 --- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml +++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml @@ -10,7 +10,7 @@ datamodel: description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer. -search: 'index=obs-gsuite sourcetype=gsuite:drive:json parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") +search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") | rex field=parameters.owner "[^@]+@(?[^@]+)" | rex field=parameters.target_user "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" From 99fb9f0c16999c1d00a8bcc224eaaeb88cefa953 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 17:30:20 +0200 Subject: [PATCH 11/49] dev_sec2 --- .../gsuite_email_suspicious_subject_with_attachment.yml | 5 +---- .../gsuite_suspicious_shared_file_name.yml | 4 +--- .../gsuite_email_suspicious_subject_with_attachment.test.yml | 2 +- .../gsuite_suspicious_shared_file_name.test.yml | 2 +- 4 files changed, 4 insertions(+), 9 deletions(-) rename detections/{endpoint => cloud}/gsuite_email_suspicious_subject_with_attachment.yml (98%) rename detections/{endpoint => cloud}/gsuite_suspicious_shared_file_name.yml (98%) rename tests/{endpoint => cloud}/gsuite_email_suspicious_subject_with_attachment.test.yml (87%) rename tests/{endpoint => cloud}/gsuite_suspicious_shared_file_name.test.yml (89%) diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml similarity index 98% rename from detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml rename to detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index 566f03c8a9..cba0a58be3 100644 --- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -4,10 +4,7 @@ version: 1 date: '2021-08-19' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint -- Email -- Updates +datamodel: [] description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml similarity index 98% rename from detections/endpoint/gsuite_suspicious_shared_file_name.yml rename to detections/cloud/gsuite_suspicious_shared_file_name.yml index dda923e569..9b7bd30b24 100644 --- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -4,9 +4,7 @@ version: 1 date: '2021-08-23' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint -- Email +datamodel: [] description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer. diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml similarity index 87% rename from tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml rename to tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml index c3cb0a32c8..bd6e1a260c 100644 --- a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml +++ b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml @@ -1,7 +1,7 @@ name: Gsuite Email Suspicious Subject With Attachment Unit Test tests: - name: Gsuite Email Suspicious Subject With Attachment - file: endpoint/gsuite_email_suspicious_subject_with_attachment.yml + file: cloud/gsuite_email_suspicious_subject_with_attachment.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml similarity index 89% rename from tests/endpoint/gsuite_suspicious_shared_file_name.test.yml rename to tests/cloud/gsuite_suspicious_shared_file_name.test.yml index a59374a794..70297baf7d 100644 --- a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml +++ b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml @@ -1,7 +1,7 @@ name: Gsuite Suspicious Shared File Name Unit Test tests: - name: Gsuite Suspicious Shared File Name - file: endpoint/gsuite_suspicious_shared_file_name.yml + file: cloud/gsuite_suspicious_shared_file_name.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 5c5146d9fc52b1e55cd1d4de8ae6c3665d772c6f Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 18:42:24 +0200 Subject: [PATCH 12/49] dev_sec2 --- ...mail_with_known_abuse_web_service_link.yml | 57 +++++++++++++++++++ ...with_known_abuse_web_service_link.test.yml | 12 ++++ 2 files changed, 69 insertions(+) create mode 100644 detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml create mode 100644 tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml new file mode 100644 index 0000000000..9c9e04c81b --- /dev/null +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -0,0 +1,57 @@ +name: Gsuite Email With Known Abuse Web Service Link +id: 8630aa22-042b-11ec-af39-acde48001122 +version: 1 +date: '2021-08-23' +author: Teoderick Contreras, Splunk +type: batch +datamodel: [] +description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. + This event can encounter some normal email traffic within organization and external email that normally using this application and services. +search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") +| rex field=source.from_header_address "[^@]+@(?[^@]+)" + | rex field=destination{}.address "[^@]+@(?[^@]+)" + | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" + |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address src_user subject destination{}.address + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_email_with_known_abuse_web_service_link_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection. +references: +- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/ +tags: + analytic_story: + - DevSecOps + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious email from $source.address$ to $destination{}.address$ + observable: + - name: source.address + type: User + role: + - attacker + - name: destination{}.address + type: User + role: + - Victim + \ No newline at end of file diff --git a/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml b/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml new file mode 100644 index 0000000000..d8161f3f21 --- /dev/null +++ b/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Email With Known Abuse Web Service Link Unit Test +tests: +- name: Gsuite Email With Known Abuse Web Service Link + file: cloud/gsuite_email_with_known_abuse_web_service_link.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: gsuite_susp_url.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log + source: http:gsuite + sourcetype: gsuite:gmail:bigquery \ No newline at end of file From 1a51aa26ce528314933cba74e57fd6c07afaa41f Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 18:44:45 +0200 Subject: [PATCH 13/49] dev_sec2 --- .../cloud/gsuite_email_with_known_abuse_web_service_link.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index 9c9e04c81b..c1c4f72ba8 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -3,7 +3,7 @@ id: 8630aa22-042b-11ec-af39-acde48001122 version: 1 date: '2021-08-23' author: Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: [] description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services. From f817aeb64ee9597651ddebc6ca489a313ce06282 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 20:08:35 +0200 Subject: [PATCH 14/49] dev_sec2 --- .../cloud/gsuite_email_with_known_abuse_web_service_link.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index c1c4f72ba8..440dbbf50b 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -11,7 +11,7 @@ search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*tel | rex field=source.from_header_address "[^@]+@(?[^@]+)" | rex field=destination{}.address "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" - |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address src_user subject destination{}.address + |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_with_known_abuse_web_service_link_filter`' From 4583dd84fb22a59d90e9d11de872ad90392fb3ee Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 26 Aug 2021 12:23:47 +0200 Subject: [PATCH 15/49] dev_sec2 --- .../cloud/gsuite_email_with_known_abuse_web_service_link.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index 440dbbf50b..cf0bf78c3a 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -5,7 +5,7 @@ date: '2021-08-23' author: Teoderick Contreras, Splunk type: Anomaly datamodel: [] -description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. +description: This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services. search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") | rex field=source.from_header_address "[^@]+@(?[^@]+)" From 211a3cd42cd9c1f7c3d1ece4c601c5c02073cf36 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 27 Aug 2021 12:21:48 +0200 Subject: [PATCH 16/49] AD_Discovery_TR-789_4 --- ...ltdomainpasswordpolicy_with_powershell.yml | 72 +++++++++++++++++++ ...ordpolicy_with_powershell_script_block.yml | 61 ++++++++++++++++ ...sultantpasswordpolicy_with_powershell_.yml | 71 ++++++++++++++++++ ...ordpolicy_with_powershell_script_block.yml | 60 ++++++++++++++++ .../get_domainpolicy_with_powershell.yml | 71 ++++++++++++++++++ ...ainpolicy_with_powershell_script_block.yml | 58 +++++++++++++++ .../password_policy_discovery_with_net.yml | 71 ++++++++++++++++++ ...ainpasswordpolicy_with_powershell.test.yml | 12 ++++ ...licy_with_powershell_script_block.test.yml | 12 ++++ ...ntpasswordpolicy_with_powershell_.test.yml | 12 ++++ ...licy_with_powershell_script_block.test.yml | 12 ++++ .../get_domainpolicy_with_powershell.test.yml | 12 ++++ ...licy_with_powershell_script_block.test.yml | 12 ++++ ...assword_policy_discovery_with_net.test.yml | 12 ++++ 14 files changed, 548 insertions(+) create mode 100644 detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml create mode 100644 detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml create mode 100644 detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml create mode 100644 detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml create mode 100644 detections/endpoint/get_domainpolicy_with_powershell.yml create mode 100644 detections/endpoint/get_domainpolicy_with_powershell_script_block.yml create mode 100644 detections/endpoint/password_policy_discovery_with_net.yml create mode 100644 tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml create mode 100644 tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml create mode 100644 tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml create mode 100644 tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml create mode 100644 tests/endpoint/get_domainpolicy_with_powershell.test.yml create mode 100644 tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml create mode 100644 tests/endpoint/password_policy_discovery_with_net.test.yml diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml new file mode 100644 index 0000000000..d20834c34c --- /dev/null +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -0,0 +1,72 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell +id: 36e46ebe-065a-11ec-b4c7-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially + in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or + credential dumping as post attack. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `get_addefaultdomainpasswordpolicy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: network operator may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + \ No newline at end of file diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml new file mode 100644 index 0000000000..92210f835c --- /dev/null +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml @@ -0,0 +1,61 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block +id: 1ff7ccc8-065a-11ec-91e4-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially + in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or + credential dumping as post attack. +search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. + Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, + or PowerShell Script Block Logging. +known_false_positives: network operator may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ to query domain password policy + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml new file mode 100644 index 0000000000..cf5049d951 --- /dev/null +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml @@ -0,0 +1,71 @@ +name: Get ADUserResultantPasswordPolicy with Powershell +id: 8b5ef342-065a-11ec-b0fc-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially + in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or + credential dumping as post attack. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `get_aduserresultantpasswordpolicy_with_powershell__filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: network operator or admin may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process \ No newline at end of file diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml new file mode 100644 index 0000000000..216df909e3 --- /dev/null +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml @@ -0,0 +1,60 @@ +name: Get ADUserResultantPasswordPolicy with Powershell Script Block +id: 737e1eb0-065a-11ec-921a-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially + in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or + credential dumping as post attack. +search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. + Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, + or PowerShell Script Block Logging. +known_false_positives: network operator may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ to query domain user password policy. + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml new file mode 100644 index 0000000000..b29d0088cd --- /dev/null +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -0,0 +1,71 @@ +name: Get DomainPolicy with Powershell +id: b8f9947e-065a-11ec-aafb-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a possible execution of powerview pentesting tool for domain controller recon. + This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. + This TTP may be a good pivot to look for credential dumping technique or lateral movement. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `get_domainpolicy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: network operator or admin may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 60 + # (impact * confidence)/100 + risk_score: 30 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + \ No newline at end of file diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml new file mode 100644 index 0000000000..c80f8356f4 --- /dev/null +++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml @@ -0,0 +1,58 @@ +name: Get DomainPolicy with Powershell Script Block +id: a360d2b2-065a-11ec-b0bf-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a possible execution of powerview pentesting tool for domain controller recon. + This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. + This TTP may be a good pivot to look for credential dumping technique or lateral movement. +search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. + Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, + or PowerShell Script Block Logging. +known_false_positives: unknown +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 60 + # (impact * confidence)/100 + risk_score: 30 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ to query domain policy. + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml new file mode 100644 index 0000000000..88653cc896 --- /dev/null +++ b/detections/endpoint/password_policy_discovery_with_net.yml @@ -0,0 +1,71 @@ +name: Password Policy Discovery with Net +id: 09336538-065a-11ec-8665-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search is to detect a net application command to discover password policy. + This commandline can be used by IT and admin to list all account domain policy but also can be use by attacker as part of recon. + this hunting query can be a good pivot to locate credential dumping or lateral movement as part of post attack. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process = "*/domain*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `password_policy_discovery_with_net_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: network operator or admin may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + \ No newline at end of file diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml new file mode 100644 index 0000000000..b755e420a1 --- /dev/null +++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell Unit Test +tests: +- name: Get ADDefaultDomainPasswordPolicy with Powershell + file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..10993c4630 --- /dev/null +++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block Unit Test +tests: +- name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block + file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml new file mode 100644 index 0000000000..036c1f0f45 --- /dev/null +++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml @@ -0,0 +1,12 @@ +name: Get ADUserResultantPasswordPolicy with Powershell Unit Test +tests: +- name: Get ADUserResultantPasswordPolicy with Powershell + file: endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..f7bd7768d9 --- /dev/null +++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get ADUserResultantPasswordPolicy with Powershell Script Block Unit Test +tests: +- name: Get ADUserResultantPasswordPolicy with Powershell Script Block + file: endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/get_domainpolicy_with_powershell.test.yml b/tests/endpoint/get_domainpolicy_with_powershell.test.yml new file mode 100644 index 0000000000..ed86135bf1 --- /dev/null +++ b/tests/endpoint/get_domainpolicy_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Get DomainPolicy with Powershell Unit Test +tests: +- name: Get DomainPolicy with Powershell + file: endpoint/get_domainpolicy_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..46622ed27d --- /dev/null +++ b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get DomainPolicy with Powershell Script Block Unit Test +tests: +- name: Get DomainPolicy with Powershell Script Block + file: endpoint/get_domainpolicy_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/password_policy_discovery_with_net.test.yml b/tests/endpoint/password_policy_discovery_with_net.test.yml new file mode 100644 index 0000000000..5920defe68 --- /dev/null +++ b/tests/endpoint/password_policy_discovery_with_net.test.yml @@ -0,0 +1,12 @@ +name: Password Policy Discovery with Net Unit Test +tests: +- name: Password Policy Discovery with Net + file: endpoint/password_policy_discovery_with_net.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From bc999c36d84d0159a918b8247725b6bcf5c16b13 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 27 Aug 2021 12:24:00 +0200 Subject: [PATCH 17/49] Delete gsuite_email_suspicious_subject_with_attachment.yml --- ...ail_suspicious_subject_with_attachment.yml | 64 ------------------- 1 file changed, 64 deletions(-) delete mode 100644 detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml deleted file mode 100644 index cba0a58be3..0000000000 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Gsuite Email Suspicious Subject With Attachment -id: 8ef3971e-00f2-11ec-b54f-acde48001122 -version: 1 -date: '2021-08-19' -author: Teoderick Contreras, Splunk -type: Anomaly -datamodel: [] -description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. - This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment - send from external email account because of the effective social engineering of subject related to delivery, bank and so on. - On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. - avoid click link or opening the attachment if you are not expecting this type of e-mail. -search: '`gsuite_gmail` num_message_attachments > 0 - subject IN ("*dhl*", "* ups *”, “*delivery*”, “*parcel*”, “*label*”, “*invoice*”, “*postal*”, “* fedex *”, “* usps *”, “* express *”, “*shipment*”, “*Banking/Tax*”,”*shipment*”, “*new order*”) - attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar”, “html”,”htm”,”hta”) - | rex field=source.from_header_address "[^@]+@(?[^@]+)" - | rex field=destination{}.address "[^@]+@(?[^@]+)" - | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" - | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by - destination{}.service num_message_attachments subject destination{}.address source.address - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `gsuite_email_suspicious_subject_with_attachment_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. -known_false_positives: normal user or normal transaction may contain the subject and file type attachment that - this detection try to search. -references: -- https://www.redhat.com/en/topics/devops/what-is-devsecops -- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf -tags: - analytic_story: - - DevSecOps - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1566.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - security_domain: endpoint - impact: 50 - confidence: 50 - # (impact * confidence)/100 - risk_score: 25 - context: - - Source:Endpoint - - Stage:Reconnaissance - message: suspicious email from $source.address$ to $destination{}.address$ - observable: - - name: source.address - type: User - role: - - attacker - - name: destination{}.address - type: User - role: - - Victim \ No newline at end of file From c816c9c98218cfaae3f45c38004cddd1d2f95ada Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 27 Aug 2021 12:24:09 +0200 Subject: [PATCH 18/49] Delete gsuite_email_with_known_abuse_web_service_link.yml --- ...mail_with_known_abuse_web_service_link.yml | 57 ------------------- 1 file changed, 57 deletions(-) delete mode 100644 detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml deleted file mode 100644 index cf0bf78c3a..0000000000 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Gsuite Email With Known Abuse Web Service Link -id: 8630aa22-042b-11ec-af39-acde48001122 -version: 1 -date: '2021-08-23' -author: Teoderick Contreras, Splunk -type: Anomaly -datamodel: [] -description: This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. - This event can encounter some normal email traffic within organization and external email that normally using this application and services. -search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") -| rex field=source.from_header_address "[^@]+@(?[^@]+)" - | rex field=destination{}.address "[^@]+@(?[^@]+)" - | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" - |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `gsuite_email_with_known_abuse_web_service_link_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. -known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection. -references: -- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/ -tags: - analytic_story: - - DevSecOps - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1566.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - security_domain: endpoint - impact: 50 - confidence: 50 - # (impact * confidence)/100 - risk_score: 25 - context: - - Source:Endpoint - - Stage:Reconnaissance - message: suspicious email from $source.address$ to $destination{}.address$ - observable: - - name: source.address - type: User - role: - - attacker - - name: destination{}.address - type: User - role: - - Victim - \ No newline at end of file From 011092eae917a1fbe2c385bee487ab3056f46c22 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 27 Aug 2021 12:24:22 +0200 Subject: [PATCH 19/49] Delete gsuite_suspicious_shared_file_name.yml --- .../gsuite_suspicious_shared_file_name.yml | 67 ------------------- 1 file changed, 67 deletions(-) delete mode 100644 detections/cloud/gsuite_suspicious_shared_file_name.yml diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml deleted file mode 100644 index 9b7bd30b24..0000000000 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Gsuite Suspicious Shared File Name -id: 07eed200-03f5-11ec-98fb-acde48001122 -version: 1 -date: '2021-08-23' -author: Teoderick Contreras, Splunk -type: Anomaly -datamodel: [] -description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. - This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. - This detection can also catch some normal email communication between organization and its external customer. -search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") - | rex field=parameters.owner "[^@]+@(?[^@]+)" - | rex field=parameters.target_user "[^@]+@(?[^@]+)" - | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" - | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `gsuite_suspicious_shared_file_name_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. -known_false_positives: normal user or normal transaction may contain the subject and file type attachment that - this detection try to search -references: -- https://www.redhat.com/en/topics/devops/what-is-devsecops -- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf -tags: - analytic_story: - - DevSecOps - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1566.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - parameters.doc_title - - src_domain - - dest_domain - - email - - parameters.visibility - - parameters.owner - - parameters.doc_type - security_domain: endpoint - impact: 30 - confidence: 30 - # (impact * confidence)/100 - risk_score: 9 - context: - - Source:Endpoint - - Stage:Reconnaissance - message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ - observable: - - name: parameters.owner - type: User - role: - - attacker - - name: email - type: User - role: - - Victim - \ No newline at end of file From 41556fc90866eb9e8fda21cad66157ce6f0ff2ae Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 27 Aug 2021 12:24:47 +0200 Subject: [PATCH 20/49] Delete gsuite_suspicious_shared_file_name.test.yml --- .../gsuite_suspicious_shared_file_name.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/cloud/gsuite_suspicious_shared_file_name.test.yml diff --git a/tests/cloud/gsuite_suspicious_shared_file_name.test.yml b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml deleted file mode 100644 index 70297baf7d..0000000000 --- a/tests/cloud/gsuite_suspicious_shared_file_name.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Gsuite Suspicious Shared File Name Unit Test -tests: -- name: Gsuite Suspicious Shared File Name - file: cloud/gsuite_suspicious_shared_file_name.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: gdrive_susp_attach.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log - source: http:gsuite - sourcetype: gsuite:drive:json \ No newline at end of file From a3267549a9f78c7ddc2eb0b82b2453f29ab5f59d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 27 Aug 2021 12:24:59 +0200 Subject: [PATCH 21/49] Delete gsuite_email_with_known_abuse_web_service_link.test.yml --- ..._email_with_known_abuse_web_service_link.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml diff --git a/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml b/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml deleted file mode 100644 index d8161f3f21..0000000000 --- a/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Gsuite Email With Known Abuse Web Service Link Unit Test -tests: -- name: Gsuite Email With Known Abuse Web Service Link - file: cloud/gsuite_email_with_known_abuse_web_service_link.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: gsuite_susp_url.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log - source: http:gsuite - sourcetype: gsuite:gmail:bigquery \ No newline at end of file From 2047227048ef9d8662086fe6895705fd558fb8ef Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 27 Aug 2021 12:25:10 +0200 Subject: [PATCH 22/49] Delete gsuite_email_suspicious_subject_with_attachment.test.yml --- ...email_suspicious_subject_with_attachment.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml diff --git a/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml deleted file mode 100644 index bd6e1a260c..0000000000 --- a/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Gsuite Email Suspicious Subject With Attachment Unit Test -tests: -- name: Gsuite Email Suspicious Subject With Attachment - file: cloud/gsuite_email_suspicious_subject_with_attachment.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: gsuite_susp_subj_attach.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log - source: http:gsuite - sourcetype: gsuite:gmail:bigquery \ No newline at end of file From 7fac82a45ea829b17abcd1912c000015d444439c Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 27 Aug 2021 12:29:15 +0200 Subject: [PATCH 23/49] AD_Discovery_TR-789_4 --- .../get_domainpolicy_with_powershell_script_block.yml | 2 +- ...et_aduserresultantpasswordpolicy_with_powershell_.test.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml index c80f8356f4..8ae7a3c61f 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml @@ -3,7 +3,7 @@ id: a360d2b2-065a-11ec-b0bf-acde48001122 version: 1 date: '2021-08-26' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a possible execution of powerview pentesting tool for domain controller recon. diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml index 036c1f0f45..ff17167b4d 100644 --- a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml +++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml @@ -1,7 +1,7 @@ -name: Get ADUserResultantPasswordPolicy with Powershell Unit Test +name: Get ADUserResultantPasswordPolicy with Powershell Unit Test tests: - name: Get ADUserResultantPasswordPolicy with Powershell - file: endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml + file: endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 4fe608cd8ea6635ac508c1bab1fab948c4cb53bb Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 27 Aug 2021 12:36:57 +0200 Subject: [PATCH 24/49] AD_Discovery_TR-789_4 --- ... => get_aduserresultantpasswordpolicy_with_powershell.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{get_aduserresultantpasswordpolicy_with_powershell_.yml => get_aduserresultantpasswordpolicy_with_powershell.yml} (95%) diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml similarity index 95% rename from detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml rename to detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml index cf5049d951..3126b2a12b 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml @@ -1,4 +1,4 @@ -name: Get ADUserResultantPasswordPolicy with Powershell +name: Get ADUserResultantPasswordPolicy with Powershell id: 8b5ef342-065a-11ec-b0fc-acde48001122 version: 1 date: '2021-08-26' @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `get_aduserresultantpasswordpolicy_with_powershell__filter`' + | `get_aduserresultantpasswordpolicy_with_powershell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From c031c62510b4f1438b3c39b2c09369cd0c3fe644 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 08:27:33 +0000 Subject: [PATCH 25/49] Added detection testing service results inAdsiSearcher Account Discovery --- .../adsisearcher_account_discovery.yml | 33 ++++++++++--------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index 3ce89c3cd2..fccf6eb36a 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -6,18 +6,20 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a powershell command adsisearcher to do user enumeration to the active directory. - This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or - specific information that admin may look upon this is still a good TTP to alert some malicious activities. -search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*" Message = "*.findAll()*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `adsisearcher_account_discovery_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. - Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, - or PowerShell Script Block Logging. -known_false_positives: not commonly seen as a normal command from network admin but possible noise may exist. +description: This search is to detect a powershell command adsisearcher to do user + enumeration to the active directory. This command can be a normal query of a network + admin but since the output of this is not so much structure and cannot give a concrete + or specific information that admin may look upon this is still a good TTP to alert + some malicious activities. +search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*" + Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime + by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `adsisearcher_account_discovery_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: not commonly seen as a normal command from network admin but + possible noise may exist. references: - https://www.blackhillsinfosec.com/red-blue-purple/ tags: @@ -36,13 +38,12 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName + - Message + - ComputerName - User security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - source:endpoint @@ -57,4 +58,4 @@ tags: type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 12528c9dd3388d59d9d29c7d744e976ded58d227 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 08:31:02 +0000 Subject: [PATCH 26/49] Added detection testing service results inDomain Account Discovery with Dsquery --- .../domain_account_discovery_with_dsquery.yml | 42 +++++++++---------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml index 50740f59d8..f6cb42ade4 100644 --- a/detections/endpoint/domain_account_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -6,21 +6,22 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This search is to detect a suspicious process commandline of dsquery for enumerating users. - This technique is commonly in attacker and red team to recon on users in targetted machine. - This command can also be used by network administrator but not by a normal user. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name="dsquery.exe" AND Processes.process = "*user*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `domain_account_discovery_with_dsquery_filter`' +description: This search is to detect a suspicious process commandline of dsquery + for enumerating users. This technique is commonly in attacker and red team to recon + on users in targetted machine. This command can also be used by network administrator + but not by a normal user. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="dsquery.exe" + AND Processes.process = "*user*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `domain_account_discovery_with_dsquery_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: network administrator may use this command but not commonly seen used by a user. + Sysmon TA. +known_false_positives: network administrator may use this command but not commonly + seen used by a user. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm tags: @@ -38,18 +39,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 context: - Source:Endpoint @@ -68,4 +68,4 @@ tags: type: Parent Process role: - Parent Process - \ No newline at end of file + automated_detection_testing: passed From 2dfe045c03ea9a427c2657142ab8f4fc0c3bef71 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 08:47:33 +0000 Subject: [PATCH 27/49] Added detection testing service results inDomain Account Discovery With Net App --- .../domain_account_discovery_with_net_app.yml | 38 ++++++++++--------- 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml index 8cc9121553..957e770258 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -6,19 +6,21 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a process command line for AD discovery. This techique is using the windows built in net.exe application - to query AD users in the targetted machine. This techique was seen in several malware as part of there recon and can be a good pivot of analysis. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") AND Processes.process = "* user*" AND Processes.process = "*/do*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a process command line for AD discovery. This + techique is using the windows built in net.exe application to query AD users in + the targetted machine. This techique was seen in several malware as part of there + recon and can be a good pivot of analysis. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" + OR Processes.process_name="net1.exe") AND Processes.process = "* user*" AND Processes.process + = "*/do*" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_net_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: network operator can execute this command references: - https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance @@ -37,18 +39,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 context: - Source:Endpoint @@ -66,4 +67,5 @@ tags: - name: parent_process_name type: Parent Process role: - - Parent Process \ No newline at end of file + - Parent Process + automated_detection_testing: passed From b74cb7d1a8545dda76f9c3921b5972057221380f Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 09:14:19 +0000 Subject: [PATCH 28/49] Added detection testing service results inGet ADUser with PowerShell Script Block --- ...et_aduser_with_powershell_script_block.yml | 32 ++++++++++--------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index 995401212c..bec9395557 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -6,18 +6,20 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This search is to detect a powershell command get-aduser function to do user enumeration to the active directory. - This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or - specific information that admin may look upon this is still a good TTP to alert some malicious activities. +description: This search is to detect a powershell command get-aduser function to + do user enumeration to the active directory. This command can be a normal query + of a network admin but since the output of this is not so much structure and cannot + give a concrete or specific information that admin may look upon this is still a + good TTP to alert some malicious activities. search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `get_aduser_with_powershell_script_block_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. - Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, - or PowerShell Script Block Logging. -known_false_positives: network admin may use this command and other IT operator to check AD users. + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_aduser_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: network admin may use this command and other IT operator to + check AD users. references: - https://www.blackhillsinfosec.com/red-blue-purple/ tags: @@ -36,13 +38,12 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName + - Message + - ComputerName - User security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - source:endpoint @@ -56,4 +57,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From a0286d1a9d280741538c9bb3ff7eae7fe6fcfa55 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 09:44:45 +0000 Subject: [PATCH 29/49] Added detection testing service results inGet ADUser with PowerShell --- .../endpoint/get_aduser_with_powershell.yml | 41 ++++++++++--------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index 5dd526e6be..ee1a676957 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -6,20 +6,22 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This search is to detect a suspicious commandline that commonly uses for enumerating users in active directory. - This technique can be a good indicator to hunt further TTPs to the machine to check further anomalies. Since this is a hunt query expect - some noise from administrator or some IT within the network that may use this command. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUser*" AND Processes.process = "*-filter*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `get_aduser_with_powershell_filter`' +description: This search is to detect a suspicious commandline that commonly uses + for enumerating users in active directory. This technique can be a good indicator + to hunt further TTPs to the machine to check further anomalies. Since this is a + hunt query expect some noise from administrator or some IT within the network that + may use this command. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUser*" + AND Processes.process = "*-filter*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: network admin may use this command. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm @@ -38,18 +40,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 context: - Source:Endpoint @@ -68,4 +69,4 @@ tags: type: Parent Process role: - Parent Process - \ No newline at end of file + automated_detection_testing: passed From 4c1c4a077a1b2c60fe9af9109f4149541abfb489 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 10:23:58 +0000 Subject: [PATCH 30/49] Added detection testing service results inDomain Account Discovery with Wmic --- .../domain_account_discovery_with_wmic.yml | 39 ++++++++++--------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml index 9c62578cd5..bc8df65b34 100644 --- a/detections/endpoint/domain_account_discovery_with_wmic.yml +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -6,20 +6,22 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a wmic command for enumerating user in active directory. - This technique was commonly used in pentesting, red-team and also by some attacker to map all user in the targetted host. - This search may also catch this type of query made by network admin but not common in all the user in the network. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name="wmic.exe" AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process = "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a wmic command for enumerating user in active + directory. This technique was commonly used in pentesting, red-team and also by + some attacker to map all user in the targetted host. This search may also catch + this type of query made by network admin but not common in all the user in the network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" + AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process + = "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_wmic_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: network admin may execute this command for listing users. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm @@ -38,18 +40,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 context: - Source:Endpoint @@ -68,4 +69,4 @@ tags: type: Parent Process role: - Parent Process - \ No newline at end of file + automated_detection_testing: passed From 539783600dbc43eb7a7f60e534290020b58019b3 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 10:38:03 +0000 Subject: [PATCH 31/49] Added detection testing service results inDomain Account Discovery with Wmic --- .../domain_account_discovery_with_wmic.yml | 39 ++++++++++--------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml index 9c62578cd5..bc8df65b34 100644 --- a/detections/endpoint/domain_account_discovery_with_wmic.yml +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -6,20 +6,22 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a wmic command for enumerating user in active directory. - This technique was commonly used in pentesting, red-team and also by some attacker to map all user in the targetted host. - This search may also catch this type of query made by network admin but not common in all the user in the network. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name="wmic.exe" AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process = "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a wmic command for enumerating user in active + directory. This technique was commonly used in pentesting, red-team and also by + some attacker to map all user in the targetted host. This search may also catch + this type of query made by network admin but not common in all the user in the network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" + AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process + = "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_wmic_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: network admin may execute this command for listing users. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm @@ -38,18 +40,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 context: - Source:Endpoint @@ -68,4 +69,4 @@ tags: type: Parent Process role: - Parent Process - \ No newline at end of file + automated_detection_testing: passed From 8aab471d30648889bdccee70410b6f6fb0735e5e Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 11:38:56 +0000 Subject: [PATCH 32/49] Added detection testing service results inGet DomainUser with PowerShell --- .../get_domainuser_with_powershell.yml | 37 ++++++++++--------- 1 file changed, 19 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index 531a62f336..d6f9432887 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -6,19 +6,20 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a cmdlet Get-DomainUser that are common on powerview or powersploit tool. - This cmdlet is used to recon on the targetted machine to enumerate all users in active directory. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainUser*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a cmdlet Get-DomainUser that are common on powerview + or powersploit tool. This cmdlet is used to recon on the targetted machine to enumerate + all users in active directory. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainUser*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ @@ -37,18 +38,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 context: - Source:Endpoint @@ -66,4 +66,5 @@ tags: - name: parent_process_name type: Parent Process role: - - Parent Process \ No newline at end of file + - Parent Process + automated_detection_testing: passed From 05e85ad5bf87f169ee6f4de385fb5f4b378ee4fa Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 30 Aug 2021 14:44:14 +0200 Subject: [PATCH 33/49] AD_Discovery_TR-789_2 --- .../get_domainuser_with_powershell_script_block.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index 5ec13cf5c8..fb18ca66c4 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -11,10 +11,10 @@ description: his search is to detect a powershell command Get-DomainUser to do u This is a good TTP for alerting SOC if there is a pentest or recon happening on the system. try to look for lateral movement technique or credential dumping techniques in the system. search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `get_domainuser_with_powershell_script_block_filter`' + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `get_domainuser_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. From 74e241a92e2350ffede91f6791f7d3c90041379b Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 30 Aug 2021 15:38:27 +0200 Subject: [PATCH 34/49] AD_Discovery_TR-789_2 --- .../get_domainuser_with_powershell_script_block.test.yml | 2 +- .../getwmiobject_ds_user_with_powershell_script_block.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml index 1b74cec450..bae14d79d5 100644 --- a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml @@ -2,7 +2,7 @@ name: Get DomainUser with PowerShell Script Block Unit Test tests: - name: Get DomainUser with PowerShell Script Block file: endpoint/get_domainuser_with_powershell_script_block.yml - pass_condition: '| stats count | where count > 0' + pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: diff --git a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml index 89c7c1a25e..ee1809782e 100644 --- a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml +++ b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml @@ -2,7 +2,7 @@ name: GetWmiObject DS User with PowerShell Script Block Unit Test tests: - name: GetWmiObject DS User with PowerShell Script Block file: endpoint/getwmiobject_ds_user_with_powershell_script_block.yml - pass_condition: '| stats count | where count > 0' + pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: From 0129d12a324b8cb88fbae0d16d0595f9ead594b8 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 13:55:39 +0000 Subject: [PATCH 35/49] Added detection testing service results inGetWmiObject DS User with PowerShell Script Block --- ...t_ds_user_with_powershell_script_block.yml | 33 ++++++++++--------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml index c344da01df..26b31ee511 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -6,18 +6,20 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a powershell command get-wmiobject function to do user enumeration to the active directory. - This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or - specific information that admin may look upon this is still a good TTP to alert some malicious activities. -search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" Message = "*-namespace*" Message = "*root\\directory\\ldap*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `getwmiobject_ds_user_with_powershell_script_block_filter`' -how_to_implement: he following Hunting analytic requires PowerShell operational logs to be imported. - Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, - or PowerShell Script Block Logging. -known_false_positives: not commonly seen as a normal command from network admin but possible noise may exist. +description: This search is to detect a powershell command get-wmiobject function + to do user enumeration to the active directory. This command can be a normal query + of a network admin but since the output of this is not so much structure and cannot + give a concrete or specific information that admin may look upon this is still a + good TTP to alert some malicious activities. +search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" + Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`' +how_to_implement: he following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: not commonly seen as a normal command from network admin but + possible noise may exist. references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace @@ -37,13 +39,12 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName + - Message + - ComputerName - User security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - source:endpoint @@ -58,4 +59,4 @@ tags: type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 2d4e4d11d1064fb85d99ef6751fa937de9b3174e Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 13:55:51 +0000 Subject: [PATCH 36/49] Added detection testing service results inGetWmiObject DS User with PowerShell --- .../getwmiobject_ds_user_with_powershell.yml | 41 ++++++++++--------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml index 638591a31b..7664fa83e3 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -6,20 +6,22 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious execution wmi process that enumerate user in active directory. - This technique can be used by attacker and pentester to mapped all the users as part of its recon to the targetted host. - Network Admin may seen executing this command but not often and also not common to see in user events. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*get-wmiobject*" AND Processes.process = "*ds_user*" AND Processes.process = "*root\\directory\\ldap*" AND Processes.process = "*-namespace*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `getwmiobject_ds_user_with_powershell_filter`' +description: This search is to detect a suspicious execution wmi process that enumerate + user in active directory. This technique can be used by attacker and pentester to + mapped all the users as part of its recon to the targetted host. Network Admin may + seen executing this command but not often and also not common to see in user events. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*get-wmiobject*" + AND Processes.process = "*ds_user*" AND Processes.process = "*root\\directory\\ldap*" + AND Processes.process = "*-namespace*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: network admin may execute this command. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm @@ -38,18 +40,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 context: - Source:Endpoint @@ -68,4 +69,4 @@ tags: type: Parent Process role: - Parent Process - \ No newline at end of file + automated_detection_testing: passed From f7db3ebe94494e3103291424febe7c0b38123d19 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 15:04:32 +0000 Subject: [PATCH 37/49] Added detection testing service results inGet DomainUser with PowerShell Script Block --- ...omainuser_with_powershell_script_block.yml | 29 +++++++++---------- 1 file changed, 14 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index fb18ca66c4..7dced17095 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: his search is to detect a powershell command Get-DomainUser to do user enumeration to the active directory. - This command is function seen in powerspoit and powerview tool that are designed to pentest active directory or domain controller for possible attack. - This is a good TTP for alerting SOC if there is a pentest or recon happening on the system. try to look for lateral movement technique or credential +description: his search is to detect a powershell command Get-DomainUser to do user + enumeration to the active directory. This command is function seen in powerspoit + and powerview tool that are designed to pentest active directory or domain controller + for possible attack. This is a good TTP for alerting SOC if there is a pentest or + recon happening on the system. try to look for lateral movement technique or credential dumping techniques in the system. -search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `get_domainuser_with_powershell_script_block_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. - Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, - or PowerShell Script Block Logging. +search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: unknown references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ @@ -37,13 +37,12 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName + - Message + - ComputerName - User security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - source:endpoint @@ -58,4 +57,4 @@ tags: type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 62b08792c9694cae0469c338e7507636561f51fc Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 15:07:40 +0000 Subject: [PATCH 38/49] Added detection testing service results inGetWmiObject DS User with PowerShell From ca0e6f21f78b2a1e26c31ec765ac4be89b96cdca Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 31 Aug 2021 10:31:08 +0200 Subject: [PATCH 39/49] AD_Discovery_TR-789_4 --- .../get_addefaultdomainpasswordpolicy_with_powershell.test.yml | 2 +- ...ltdomainpasswordpolicy_with_powershell_script_block.test.yml | 2 +- .../get_aduserresultantpasswordpolicy_with_powershell_.test.yml | 2 +- ...esultantpasswordpolicy_with_powershell_script_block.test.yml | 2 +- tests/endpoint/get_domainpolicy_with_powershell.test.yml | 2 +- .../get_domainpolicy_with_powershell_script_block.test.yml | 2 +- tests/endpoint/password_policy_discovery_with_net.test.yml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml index b755e420a1..40479d3a9a 100644 --- a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml +++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml @@ -2,7 +2,7 @@ name: Get ADDefaultDomainPasswordPolicy with Powershell Unit Test tests: - name: Get ADDefaultDomainPasswordPolicy with Powershell file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml - pass_condition: '| stats count | where count > 0' + pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml index 10993c4630..15b4775f0f 100644 --- a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml @@ -2,7 +2,7 @@ name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block Unit Test tests: - name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml - pass_condition: '| stats count | where count > 0' + pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml index ff17167b4d..ace51f6c21 100644 --- a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml +++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml @@ -2,7 +2,7 @@ name: Get ADUserResultantPasswordPolicy with Powershell Unit Test tests: - name: Get ADUserResultantPasswordPolicy with Powershell file: endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml - pass_condition: '| stats count | where count > 0' + pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml index f7bd7768d9..1e9fd7eb85 100644 --- a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml @@ -2,7 +2,7 @@ name: Get ADUserResultantPasswordPolicy with Powershell Script Block Unit Test tests: - name: Get ADUserResultantPasswordPolicy with Powershell Script Block file: endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml - pass_condition: '| stats count | where count > 0' + pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: diff --git a/tests/endpoint/get_domainpolicy_with_powershell.test.yml b/tests/endpoint/get_domainpolicy_with_powershell.test.yml index ed86135bf1..f484567632 100644 --- a/tests/endpoint/get_domainpolicy_with_powershell.test.yml +++ b/tests/endpoint/get_domainpolicy_with_powershell.test.yml @@ -2,7 +2,7 @@ name: Get DomainPolicy with Powershell Unit Test tests: - name: Get DomainPolicy with Powershell file: endpoint/get_domainpolicy_with_powershell.yml - pass_condition: '| stats count | where count > 0' + pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: diff --git a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml index 46622ed27d..705eb31b67 100644 --- a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml @@ -2,7 +2,7 @@ name: Get DomainPolicy with Powershell Script Block Unit Test tests: - name: Get DomainPolicy with Powershell Script Block file: endpoint/get_domainpolicy_with_powershell_script_block.yml - pass_condition: '| stats count | where count > 0' + pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: diff --git a/tests/endpoint/password_policy_discovery_with_net.test.yml b/tests/endpoint/password_policy_discovery_with_net.test.yml index 5920defe68..7513d219d9 100644 --- a/tests/endpoint/password_policy_discovery_with_net.test.yml +++ b/tests/endpoint/password_policy_discovery_with_net.test.yml @@ -2,7 +2,7 @@ name: Password Policy Discovery with Net Unit Test tests: - name: Password Policy Discovery with Net file: endpoint/password_policy_discovery_with_net.yml - pass_condition: '| stats count | where count > 0' + pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: From 76a46e2b83a0c941c15b432571e86e29214ab99e Mon Sep 17 00:00:00 2001 From: root Date: Tue, 31 Aug 2021 08:49:23 +0000 Subject: [PATCH 40/49] Added detection testing service results inGet ADDefaultDomainPasswordPolicy with Powershell --- ...ltdomainpasswordpolicy_with_powershell.yml | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index d20834c34c..df5a3c6571 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. - This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially - in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or - credential dumping as post attack. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_addefaultdomainpasswordpolicy_with_powershell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -39,18 +40,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint impact: 30 - confidence: 30 - # (impact * confidence)/100 + confidence: 30 risk_score: 9 context: - Source:Endpoint @@ -69,4 +69,4 @@ tags: type: Parent Process role: - Parent Process - \ No newline at end of file + automated_detection_testing: passed From 048d9e6e1d8581df8b10670f1a639fc2826b281b Mon Sep 17 00:00:00 2001 From: root Date: Tue, 31 Aug 2021 09:12:42 +0000 Subject: [PATCH 41/49] Added detection testing service results inGet ADDefaultDomainPasswordPolicy with Powershell Script Block --- ...ordpolicy_with_powershell_script_block.yml | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml index 92210f835c..4493f83d9e 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml @@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. - This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially - in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or - credential dumping as post attack. -search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. - Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, - or PowerShell Script Block Logging. +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: network operator may use this command references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet @@ -37,18 +37,18 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName + - Message + - ComputerName - User security_domain: endpoint impact: 30 confidence: 30 - # (impact * confidence)/100 risk_score: 9 context: - source:endpoint - stage:Reconnaissance - message: powershell process having commandline $Message$ to query domain password policy + message: powershell process having commandline $Message$ to query domain password + policy observable: - name: ComputerName type: Hostname @@ -58,4 +58,4 @@ tags: type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed From c1b5706e220e14a2f355a5d490a6bda99b4309df Mon Sep 17 00:00:00 2001 From: root Date: Tue, 31 Aug 2021 09:38:54 +0000 Subject: [PATCH 42/49] Added detection testing service results inGet ADUserResultantPasswordPolicy with Powershell --- ...esultantpasswordpolicy_with_powershell.yml | 39 ++++++++++--------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml index 3126b2a12b..ad490becb3 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml @@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. - This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially - in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or - credential dumping as post attack. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduserresultantpasswordpolicy_with_powershell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -39,18 +40,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 context: - Source:Endpoint @@ -68,4 +68,5 @@ tags: - name: parent_process_name type: Parent Process role: - - Parent Process \ No newline at end of file + - Parent Process + automated_detection_testing: passed From 4d91dcbe0fd81497c9853e4f9e67fc47cc31effd Mon Sep 17 00:00:00 2001 From: root Date: Tue, 31 Aug 2021 10:15:36 +0000 Subject: [PATCH 43/49] Added detection testing service results inGet ADUserResultantPasswordPolicy with Powershell Script Block --- ...ordpolicy_with_powershell_script_block.yml | 33 ++++++++++--------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml index 216df909e3..6dd5fd9fbb 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml @@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. - This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially - in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or - credential dumping as post attack. -search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. - Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, - or PowerShell Script Block Logging. +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: network operator may use this command references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet @@ -37,18 +37,18 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName + - Message + - ComputerName - User security_domain: endpoint impact: 30 confidence: 30 - # (impact * confidence)/100 risk_score: 9 context: - source:endpoint - stage:Reconnaissance - message: powershell process having commandline $Message$ to query domain user password policy. + message: powershell process having commandline $Message$ to query domain user password + policy. observable: - name: ComputerName type: Hostname @@ -57,4 +57,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 4d4ed72a51a223cbb9f2ef7bd159d27cb82c1d13 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 31 Aug 2021 10:37:41 +0000 Subject: [PATCH 44/49] Added detection testing service results inGet DomainPolicy with Powershell --- .../get_domainpolicy_with_powershell.yml | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index b29d0088cd..133acaf599 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -6,15 +6,16 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a possible execution of powerview pentesting tool for domain controller recon. - This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. - This TTP may be a good pivot to look for credential dumping technique or lateral movement. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a possible execution of powerview pentesting + tool for domain controller recon. This search look for function Get-DomainPolicy + to parse the domain policy of the targeted host. This TTP may be a good pivot to + look for credential dumping technique or lateral movement. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -38,18 +39,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint impact: 50 - confidence: 60 - # (impact * confidence)/100 + confidence: 60 risk_score: 30 context: - Source:Endpoint @@ -68,4 +68,4 @@ tags: type: Parent Process role: - Parent Process - \ No newline at end of file + automated_detection_testing: passed From 4ecb10aff70afb67cf762cbc77dcdf5da1a173e8 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 31 Aug 2021 11:43:10 +0000 Subject: [PATCH 45/49] Added detection testing service results inGet DomainPolicy with Powershell Script Block --- ...ainpolicy_with_powershell_script_block.yml | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml index 8ae7a3c61f..f0f5889b81 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a possible execution of powerview pentesting tool for domain controller recon. - This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. - This TTP may be a good pivot to look for credential dumping technique or lateral movement. -search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` +description: This search is to detect a possible execution of powerview pentesting + tool for domain controller recon. This search look for function Get-DomainPolicy + to parse the domain policy of the targeted host. This TTP may be a good pivot to + look for credential dumping technique or lateral movement. +search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. - Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, - or PowerShell Script Block Logging. +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: unknown references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet @@ -35,13 +35,12 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName + - Message + - ComputerName - User security_domain: endpoint impact: 50 confidence: 60 - # (impact * confidence)/100 risk_score: 30 context: - source:endpoint @@ -55,4 +54,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 84bf0e3ec2a19e5c78e2c4c1700d705f886609a8 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 31 Aug 2021 13:48:54 +0000 Subject: [PATCH 46/49] Added detection testing service results inPassword Policy Discovery with Net --- .../password_policy_discovery_with_net.yml | 37 ++++++++++--------- 1 file changed, 19 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml index 88653cc896..0ba6d0f025 100644 --- a/detections/endpoint/password_policy_discovery_with_net.yml +++ b/detections/endpoint/password_policy_discovery_with_net.yml @@ -6,15 +6,17 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This search is to detect a net application command to discover password policy. - This commandline can be used by IT and admin to list all account domain policy but also can be use by attacker as part of recon. - this hunting query can be a good pivot to locate credential dumping or lateral movement as part of post attack. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process = "*/domain*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a net application command to discover password + policy. This commandline can be used by IT and admin to list all account domain + policy but also can be use by attacker as part of recon. this hunting query can + be a good pivot to locate credential dumping or lateral movement as part of post + attack. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" + OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process + = "*/domain*" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `password_policy_discovery_with_net_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -38,18 +40,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint impact: 30 - confidence: 30 - # (impact * confidence)/100 + confidence: 30 risk_score: 9 context: - Source:Endpoint @@ -68,4 +69,4 @@ tags: type: Parent Process role: - Parent Process - \ No newline at end of file + automated_detection_testing: passed From 322c804d876c7e9c2b64206af37b575d036ce4f4 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 31 Aug 2021 11:53:30 -0700 Subject: [PATCH 47/49] Update adsisearcher_account_discovery.yml --- detections/endpoint/adsisearcher_account_discovery.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index fccf6eb36a..ba6b634aa0 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -59,3 +59,4 @@ tags: role: - Victim automated_detection_testing: passed + From d7759b6dfcc53a84ea2bbc130e3d09526a3c5339 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 2 Sep 2021 16:56:29 -0700 Subject: [PATCH 48/49] Update get_addefaultdomainpasswordpolicy_with_powershell.yml --- .../get_addefaultdomainpasswordpolicy_with_powershell.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index df5a3c6571..3c7fd85f4c 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -70,3 +70,4 @@ tags: role: - Parent Process automated_detection_testing: passed + From 6cdc9a480979a9fcae53377aeaea583afffb0bda Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 6 Sep 2021 13:02:28 +0200 Subject: [PATCH 49/49] Update adsisearcher_account_discovery.yml --- detections/endpoint/adsisearcher_account_discovery.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index ba6b634aa0..fccf6eb36a 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -59,4 +59,3 @@ tags: role: - Victim automated_detection_testing: passed -