From 95ff817a804459e30c201caeebb8a6c1718010c3 Mon Sep 17 00:00:00 2001 From: Ignacio Bermudez Corrales Date: Tue, 6 Oct 2020 11:21:36 -0700 Subject: [PATCH] formatting --- .../detect_dump_lsass_memory_using_comsvcs___ssa.yml | 6 ++---- detections/detect_phishing_content___ssa.yml | 7 +++---- detections/first_time_seen_cmd_line___ssa.yml | 6 ++---- detections/prohibited_apps_spawning_cmdprompt___ssa.yml | 6 ++---- .../rare_parent_process_relationship_lolbas___ssa.yaml | 3 +-- detections/unusually_long_command_line___ssa.yml | 3 +-- 6 files changed, 11 insertions(+), 20 deletions(-) diff --git a/detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml b/detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml index 96c1eddbab..bf7333ff06 100644 --- a/detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml +++ b/detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml @@ -8,8 +8,7 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi type: SSA references: ['https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf'] author: Jose Hernandez, Splunk -search: ' -| from read_ssa_enriched_events() +search: '| from read_ssa_enriched_events() | select from_json_object(value) as input_event | eval tenant=ucast(map_get(input_event, "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), "string", null), @@ -22,8 +21,7 @@ AND match_regex(process, /(?i)comsvcs.dll MiniDump/)=true end_time = timestamp, entities = mvappend(machine), body = "TBD" -| into write_ssa_detected_events(); -' +| into write_ssa_detected_events();' known_false_positives: None identified. tags: analytics_story: diff --git a/detections/detect_phishing_content___ssa.yml b/detections/detect_phishing_content___ssa.yml index 9b3372c054..6dbebc14eb 100644 --- a/detections/detect_phishing_content___ssa.yml +++ b/detections/detect_phishing_content___ssa.yml @@ -19,8 +19,7 @@ how_to_implement: Events are fed to DSP contains at least email's sender, subjec references: [ ] type: SSA author: Xiao Lin, Splunk -search: ' -| from read_ssa_enriched_events() +search: '| from read_ssa_enriched_events() | source_type="email" | eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), eventLine=concat(ucast(map_get(jsonMap, "From"), "string", null), " ", ucast(map_get(jsonMap, "Subject"), "string", null), " ", ucast(map_get(jsonMap, "Content"), "string", null), " ") @@ -30,8 +29,8 @@ mapC = {" ":32,"!":33,"\"":34,"#":35,"$":36,"%":37,"&":38,"`":39,"(":40,")":41," | apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v2" path="s3://smle-experiments/models/phishing_email" | where mvindex(`dense/Sigmoid:0`, 0) > 0.5 | select body, host, timestamp, source_type, source, cast(mvindex(`dense/Sigmoid:0`, 0), "float") AS probability -| into write_ssa_detected_events(); -' +| eval entities = mvappend(host) +| into write_ssa_detected_events();' known_false_positives: Because of imbalance of anomaly data in training, the model will less likely report false positive. Instead, the model is more prone to false negative. Current best recall score is ~85% tags: diff --git a/detections/first_time_seen_cmd_line___ssa.yml b/detections/first_time_seen_cmd_line___ssa.yml index a4b07b367f..3cbdcd6724 100644 --- a/detections/first_time_seen_cmd_line___ssa.yml +++ b/detections/first_time_seen_cmd_line___ssa.yml @@ -9,8 +9,7 @@ how_to_implement: "You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP." author: Ignacio Bermudez Corrales, Splunk type: SSA -search: ' -| from read_ssa_enriched_events() +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), @@ -24,8 +23,7 @@ search: ' end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" -| into write_ssa_detected_events(); -' +| into write_ssa_detected_events();' eli5: "The subsearch returns all events where `cmd.exe` was used with a `/c` parameter in the command-line arguments to execute other commands/programs. It appends the historical data to those results in the lookup file. Next, it recalculates the `firstTime` diff --git a/detections/prohibited_apps_spawning_cmdprompt___ssa.yml b/detections/prohibited_apps_spawning_cmdprompt___ssa.yml index f531c33d4f..b9f2732c36 100644 --- a/detections/prohibited_apps_spawning_cmdprompt___ssa.yml +++ b/detections/prohibited_apps_spawning_cmdprompt___ssa.yml @@ -9,8 +9,7 @@ how_to_implement: "You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP." author: Ignacio Bermudez Corrales, Splunk type: SSA -search: ' -| from read_ssa_enriched_events() +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), @@ -39,8 +38,7 @@ dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body="TBD" -| into write_ssa_detected_events(); -' +| into write_ssa_detected_events();' eli5: "Obtaining access to the Command-Line Interface (CLI) is typically a primary attacker goal. Once an attacker has obtained the ability to execute code on a target system, they will often further manipulate the system via commands passed to the diff --git a/detections/rare_parent_process_relationship_lolbas___ssa.yaml b/detections/rare_parent_process_relationship_lolbas___ssa.yaml index 1135c857d0..333d0e0938 100644 --- a/detections/rare_parent_process_relationship_lolbas___ssa.yaml +++ b/detections/rare_parent_process_relationship_lolbas___ssa.yaml @@ -11,8 +11,7 @@ how_to_implement: Collect endpoint data such as sysmon or 4688 events. references: [] type: SSA author: Ignacio Bermudez Corrales, Splunk -search: ' -| from read_ssa_enriched_events() +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), diff --git a/detections/unusually_long_command_line___ssa.yml b/detections/unusually_long_command_line___ssa.yml index 3a0cb2329e..4e9e47c2d0 100644 --- a/detections/unusually_long_command_line___ssa.yml +++ b/detections/unusually_long_command_line___ssa.yml @@ -23,8 +23,7 @@ dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" -| into write_ssa_detected_events(); -' +| into write_ssa_detected_events();' known_false_positives: Some legitimate applications use long command lines for installs or updates. You should review identified command lines for legitimacy. At the beginning of this search `adaptive_threshold` needs time to learn the baseline.