admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-12-01 12:16:15 -08:00
committed by GitHub
parent 4c9fc158cd cb053c1847
commit 9836dc85bd
69 changed files with 446 additions and 156 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/ssa-end-to-end-testing/modules/github_service.py
+6 -6
View File
@@ -50,11 +50,12 @@ class GithubService:
# changed detections
if file_path.startswith('detections'):
if os.path.basename(file_path).startswith('ssa'):
file_path_base = os.path.splitext(file_path)[0].replace('detections', 'tests') + '.test'
file_path_new = file_path_base + '.yml'
if file_path_new not in changed_ssa_test_files:
changed_ssa_test_files.append(file_path_new)
if not 'deprecated' in file_path:
if os.path.basename(file_path).startswith('ssa'):
file_path_base = os.path.splitext(file_path)[0].replace('detections', 'tests') + '.test'
file_path_new = file_path_base + '.yml'
if file_path_new not in changed_ssa_test_files:
changed_ssa_test_files.append(file_path_new)
# changed CI code
if file_path == '.gitlab-ci.yml' or file_path.startswith('bin/ssa-end-to-end-testing'):
@@ -76,4 +77,3 @@ class GithubService:
return changed_ssa_test_files, ci_changes
bin/validate.py
+22 -10
View File
@@ -17,12 +17,24 @@ from pathlib import Path
from os import path, walk
def validate_schema(REPO_PATH, type, objects, verbose):
def validate_schema(REPO_PATH, detection_type, objects, verbose):
#Default regex does NOT match ssa___*.yml files: "^(?!ssa___).*\.yml$"
#The following search will match ssa___*.yml files: "^ssa___.*\.yml$"
if detection_type.startswith("ba_"):
filename_regex = "^ssa___.*\.yml$"
else:
filename_regex = "^(?!ssa___).*\.yml$"
error = False
errors = []
schema_file = path.join(path.expanduser(REPO_PATH), 'spec/' + type + '.spec.json')
schema_file = path.join(path.expanduser(REPO_PATH), 'spec/' + detection_type + '.spec.json')
#remove the prefix if the detection type starts with ba_ so we can
#get the files from the proper folders and proceed correctly
if detection_type.startswith("ba_"):
detection_type = detection_type[3:]
try:
schema = json.loads(open(schema_file, 'rb').read())
@@ -30,11 +42,10 @@ def validate_schema(REPO_PATH, type, objects, verbose):
print("ERROR: reading schema file {0}".format(schema_file))
manifest_files = []
for root, dirs, files in walk(REPO_PATH + "/" + type):
for root, dirs, files in walk(REPO_PATH + "/" + detection_type):
for file in files:
if file.endswith(".yml"):
if re.search(filename_regex, path.basename(file)) is not None:
manifest_files.append((path.join(root, file)))
for manifest_file in manifest_files:
if verbose:
print("processing manifest {0}".format(manifest_file))
@@ -54,13 +65,13 @@ def validate_schema(REPO_PATH, type, objects, verbose):
errors.append("ERROR: {0} at:\n\t{1}".format(json.dumps(schema_error.message), manifest_file))
error = True
if type in objects:
objects[type].append(object)
if detection_type in objects:
objects[detection_type].append(object)
else:
arr = []
arr.append(object)
objects[type] = arr
objects[detection_type] = arr
print("***END OF VALIDATE SCHEMA ***")
return objects, error, errors
@@ -244,7 +255,8 @@ def validate_tests(REPO_PATH, object):
def main(REPO_PATH, verbose):
validation_objects = ['macros','lookups','stories','detections','deployments', 'tests']
validation_objects = ['macros','lookups','stories','detections', 'ba_detections','deployments', 'tests']
objects = {}
schema_error = False
detections/deprecated/ssa___detect_pass_hash.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-10-21'
author: Xiao Lin, Splunk
type: TTP
datamodel: []
datamodel:
- Authentication
description: This search looks for specific authentication events from the Windows
Security Event logs to detect potential attempts using Pass-the-Hash technique.
search: ' | from read_ssa_enriched_events()
detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-11-22'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel:
- Endpoint
- Endpoint_Processes
description: The following detection identifies the usage of archive tools from the command line.
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)),
@@ -75,4 +75,4 @@ tags:
- Processes.parent_process
risk_score: 42
security_domain: endpoint
detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-03'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token
attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
+3 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-03'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: Stolen credentials are applied by methods such as user impersonation,
credential injection, spoofing of authentication processes or getting hold of critical
accounts. This detection indicates such activities carried out by PowerSploit exploit
@@ -87,3 +88,4 @@ tags:
risk_score: 90
risk_severity: high
security_domain: endpoint
detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
+3 -2
View File
@@ -4,9 +4,10 @@ version: 1
date: '2020-11-03'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of DSInternals modules that verify password
strength, i.e., identify week accounts that would be easily compromised.
strength, i.e., identify weak accounts that would be easily compromised.
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
detections/endpoint/ssa___attempt_to_delete_services.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-11-30'
author: Teoderick Contreras, splunk
type: TTP
datamodel:
- Endpoint
- Endpoint_Processes
description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue
there objective and evade detections.'
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
@@ -81,4 +81,4 @@ tags:
- name: process_name
type: Process
role:
- Child Process
- Child Process
detections/endpoint/ssa___attempt_to_disable_services.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2021-11-30'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint_Processes
description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue
there objective and evade detections.'
search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: 2020-6-04
author: Jose Hernandez, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: Monitor for execution of reg.exe with parameters specifying an export
of keys that contain hashed credentials that attackers may try to crack offline.
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
+2 -1
View File
@@ -5,7 +5,8 @@ version: 1
date: '2020-10-21'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. DSInternals
detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-10-21'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. DSInternals
detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-10-18'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. FGdump is
detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-10-18'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. FGdump is
detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
+2 -1
View File
@@ -5,7 +5,8 @@ version: 1
date: '2020-10-18'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. PowerSploit
detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-10-18'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. LaZagne is
detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-10-21'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. Mimikatz
detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-10-18'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. Native Microsoft
detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-10-18'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. Native Microsoft
detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-10-21'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. PowerSploit
detections/endpoint/ssa___delete_a_net_user.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-11-30'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
- Endpoint_Processes
description: This analytic will detect a suspicious net.exe/net1.exe command-line
to delete a user on a system. This technique may be use by an administrator for
legitimate purposes, however this behavior has been used in the wild to impair some
@@ -86,4 +86,4 @@ tags:
- name: process_name
type: Process
role:
- Child Process
- Child Process
detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2021-06-14'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint_Processes
description: This analytic identifies a potential adversary that changes the security
permission of a specific file or directory. This technique is commonly seen in APT
tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection
detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+14 -11
View File
@@ -1,21 +1,24 @@
name: Detect Dump LSASS Memory using comsvcs
id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
version: 1
version: 2
date: '2020-09-15'
author: Jose Hernandez, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This search detects the memory of lsass.exe being dumped for offline
credential theft attack.
search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
"_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
"string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
/(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
"process_name", process_name, "process", process]) | into write_ssa_detected_events();'
search: '| from read_ssa_enriched_events()
| where "Endpoint_Processes" IN(_datamodels)
| eval dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
process=lower(ucast(map_get(input_event, "process"), "string", null)),
event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id)
| eval body=create_map(["event_id", event_id, "process_name", process_name, "process", process])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including Windows command line logging. You can see how we test this with [Event
Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
detections/endpoint/ssa___detect_kerberoasting.yml
+19 -15
View File
@@ -4,24 +4,28 @@ version: 2
date: '2020-10-21'
author: Xiao Lin, Splunk
type: TTP
datamodel: []
datamodel:
- Certificates
description: This search detects a potential kerberoasting attack via service principal
name requests
search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"),
EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
"ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
"service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769"
AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event
input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
search: ' | from read_ssa_enriched_events()
| eval _time=map_get(input_event, "_time"),
EventCode=map_get(input_event, "event_code"),
TicketOptions=map_get(input_event, "ticket_options"),
TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
ServiceName=map_get(input_event, "service_name"),
ServiceID=map_get(input_event, "service_id"),
dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
| first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
| eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id,
"EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions,
"TicketEncryptionType", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null))| select start_time, end_time, entities, body | into write_ssa_detected_events();'
| eval start_time=_time, end_time=_time
| eval body=create_map(["event_id", event_id, "EventCode", EventCode, "ServiceName", ServiceName,
"TicketOptions", TicketOptions, "TicketEncryptionType", TicketEncryptionType]),
entities = mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| select start_time, end_time, entities, body | into write_ssa_detected_events();'
how_to_implement: The test data is converted from Windows Security Event logs generated
from Attach Range simulation and used in SPL search and extended to SPL2
known_false_positives: Older systems that support kerberos RC4 by default NetApp may
detections/endpoint/ssa___disable_net_user_account.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2021-12-01'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint_Processes
description: This analytic will identify a suspicious command-line that disables a
user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used
by the adversaries to interrupt availability of accounts and continue the impact against the organization.
detections/endpoint/ssa___first_time_seen_cmd_line.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 3
date: 2021-2-1
author: Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel: []
datamodel:
- Endpoint_Processes
description: This search looks for command-line arguments that use a `/c` parameter
to execute a command that has not previously been seen. This is an implementation
on SPL2 of the rule `First time seen command line argument` by @bpatel.
detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2021-06-14'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint_Processes
description: This analytic identifies potential adversaries that modify the security
permission of a specific file or directory. This technique is commonly seen in APT
tradecraft, ransomware and coinminer scripts to evade detections and restrict access
detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-09'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies access to PowerSploit modules that enable illegaly
access user content, such as key logging, audio recording, screenshots, tapping
into http and RDP sessions, etc.
detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-09'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies access to PowerSploit modules that create accounts
illegaly.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-09'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of DSInternals modules that enable or disable
accounts illegaly.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-09'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies access to PowerSploit modules that delete event
logs.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
+2 -1
View File
@@ -5,7 +5,8 @@ version: 1
date: '2020-11-09'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of DSInternals modules for illegal management
of Active Directoty elements and policies.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
+2 -1
View File
@@ -5,7 +5,8 @@ version: 1
date: '2020-11-09'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies access to PowerSploit modules that enable illegal
management of computers and Active Directory elements.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-09'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies access to PowerSploit modules that illegaly
elevate general privileges or ensure persistence, e.g., enable manipulation of registry,
task scheduling, persistent WMI, access to OS objects under desired identities.
detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-09'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of Mimikatz modules for illegal privilege
elevation.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-09'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of Mimikatz modules for illegal control
over services and processes, including the authentication service.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-09'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies access to PowerSploit modules that enable illegal
control of services and processes, such as installing or spoofing of malicious services,
injecting malicious code in DLLs and EXEs, invoking shell code and WMI commands,
detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2021-06-15'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
- Endpoint_Processes
description: This analytic identifies suspicious modification of ACL permission to
a files or folder to make it available to everyone or to a specific user. This technique
may be used by the adversary to evade ACLs or protected files access. This changes
detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-04'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of PowerSploit modules that facilitate
access probing with admin credentials as well as probing access to system services.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+17 -17
View File
@@ -1,30 +1,30 @@
name: Detect Prohibited Applications Spawning cmd exe
id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
version: 2
date: '2021-11-10'
date: '2020-11-10'
author: Ignacio Bermudez Corrales, Splunk
datamodel:
- Endpoint_Processes
type: Anomaly
datamodel: []
description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk.
During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further.'
description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further.'
search: '| from read_ssa_enriched_events()
| where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
| eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null)
| where process_name="cmd.exe" | rex field=parent_process "(?<field0>[^\\\\]+)$"
| where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe"
OR field0="visio.exe" OR field0="mspub.exe" OR field0="acrobat.exe" OR field0="acrord32.exe"
OR field0="chrome.exe" OR field0="iexplore.exe" OR field0="opera.exe" OR field0="firefox.exe"
OR field0="java.exe" OR field0="powershell.exe"
null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)),
dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event,"event_id"), "string", null)
| where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
| where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe" OR ParentBaseFileName="powerpnt.exe"
OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe" OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe"
OR ParentBaseFileName="iexplore.exe" OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe"
OR ParentBaseFileName="java.exe" OR ParentBaseFileName="powershell.exe"
OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name,
"parent_process_name", parent_process]) | into write_ssa_detected_events();'
"parent_process_name", parent_process, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
known_false_positives: There are circumstances where an application may legitimately
@@ -76,4 +76,4 @@ tags:
- dest_user_id
risk_score: 35
risk_severity: low
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
+6 -3
View File
@@ -4,13 +4,16 @@ version: 2
date: '2021-11-05'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Authentication
description: This detection identifies potential Pass the Token or Pass the Hash credential
exploits. We detect the main side effect of these attacks, which is a transition
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
by a detination device.
search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event,
"_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
search: '| from read_ssa_enriched_events()
| where "Authentication" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
dest_user=lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
"string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id= ucast(map_get(input_event, "dest_device_id"), "string",
null), signature_id= lower(ucast(map_get(input_event, "signature_id"), "string",
detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
+6 -2
View File
@@ -4,13 +4,17 @@ version: 2
date: '2021-11-05'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Authentication
description: This detection identifies potential Pass the Token or Pass the Hash credential
exploits. We detect the main side effect of these attacks, which is a transition
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
by an event-collecting device (i.e., a specific domain controller or an endpoint
destination).
search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event,
search: '| from read_ssa_enriched_events()
| where "Authentication" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
"string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string",
null), origin_device_id= ucast(map_get(input_event, "origin_device_id"), "string",
detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2021-05-20'
author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel: []
datamodel:
- Endpoint_Processes
description: An attacker may use LOLBAS tools spawned from vulnerable applications
not typically used by system administrators. This search leverages the Splunk Streaming
ML DSP plugin to find rare parent/child relationships. The list of application has
detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-05'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of PowerSploit modules that discover opportunities
for malicious access and persistence. Some examples include access to admin accounts,
weak access control policies, landing paths for dropping malicious software or data
detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-05'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies access to PowerSploit modules that discover
accounts, groups and policies that can be accessed or taken over.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-05'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of Mimikatz modules for discovery of accounts
and groups and access to them.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
+2 -1
View File
@@ -5,7 +5,8 @@ version: 1
date: '2020-11-06'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies access to PowerSploit modules for reconnaissance
and access to elements of Active Directory infrastructure, such as domain identifiers,
AD sites and forests, and trust relations.
detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-06'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies access to PowerSploit modules that discover
computers, servers and domains that can be accessed or taken over.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-06'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of Mimikatz modules for discovery of computers
and servers and access to them.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-06'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies access to PowerSploit modules that discover
and access operating system elements, such as processes, services, registry locations,
security packages and files.
detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-06'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of Mimikatz modules for discovery and access
to network shares.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-06'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies access to PowerSploit modules that discover
and access network and distributed file system shares.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-06'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies access to PowerSploit modules for reconnaissance
of connectivity.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-03'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies reconnaissance of credential stores and use
of CryptoAPI services by Mimikatz modules.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-05'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of PowerSploit modules for assessment of
presence of defensive tools.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-05'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of PowerSploit modules for assessment of
privilege escalation opportunities.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-05'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of Mimikatz modules for discovery of process
or service hijacking opportunities via Microsoft Detours compatibility. Microsoft
Detours is an open source library for intercepting, monitoring and instrumenting
detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-06'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies use of Mimikatz modules for discovery and access
to services and processes.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___resize_shadowstorage_volume.yml
+7 -3
View File
@@ -5,9 +5,13 @@ date: '2021-06-21'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event
and a precursor to deleting the shadowstorage.
- Endpoint_Processes
description: The following analytics identifies the resizing of shadowstorage by ransomware
malware to avoid the shadow volumes being made again. this technique is an alternative
by ransomware attacker than deleting the shadowstorage which is known alert in defensive
team. one example of ransomware that use this technique is CLOP ransomware where
it drops a .bat file that will resize the shadowstorage to minimum size as much
as possible
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
detections/endpoint/ssa___sdelete_application_execution.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-11-15'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
- Endpoint_Processes
description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files
that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility
meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host.
@@ -84,4 +84,4 @@ tags:
role:
- Child Process
detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-03'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies illegal setting of credentials via DSInternals
modules.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-03'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies illegal setting of credentials via Mimikatz
modules.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-11-03'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint_Processes
description: This detection identifies illegal setting of credentials via PowerSploit
modules.
search: '| from read_ssa_enriched_events()
detections/endpoint/ssa___system_process_running_unexpected_location.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 3
date: '2020-08-25'
author: Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel: []
datamodel:
- Endpoint_Processes
description: An attacker tries might try to use different version of a system command
without overriding original, or they might try to avoid some detection running the
process from a different folder. This detection checks that a list of system processes
detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 2
date: '2020-08-25'
author: Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel: []
datamodel:
- Endpoint_Processes
description: Attacker activity may compromise executing several LOLBAS applications
in conjunction to accomplish their objectives. We are looking for more than usual
LOLBAS applications over a window of time, by building profiles per machine.
detections/endpoint/ssa___unusually_long_command_line.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 1
date: '2020-10-06'
author: Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel: []
datamodel:
- Endpoint_Processes
description: Command lines that are extremely long may be indicative of malicious
activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin
to help identify command lines with lengths that are unusual for a given user. This
detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+18 -14
View File
@@ -5,23 +5,26 @@ date: '2021-06-15'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint_Processes
description: The wevtutil.exe application is the windows event log utility. This searches
for wevtutil.exe with parameters for clearing the application, security, setup,
powershell, sysmon, or system event logs.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line,
/(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,
/(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,
/(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
search: '| from read_ssa_enriched_events()
| where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null),
process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "% cl %")
AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,
/(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,
/(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe"
| eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -79,3 +82,4 @@ tags:
risk_score: 63
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+15 -12
View File
@@ -5,21 +5,24 @@ date: '2021-06-15'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint_Processes
description: This search is to detect execution of wevtutil.exe to disable logs. This
technique was seen in several ransomware to disable the event logs to evade alerts
and detections in compromised host.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line,
"%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
search: '| from read_ssa_enriched_events()
| where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null),
process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe"
| eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
spec/ba_detections.spec.json
+203
View File
@@ -0,0 +1,203 @@
{
"$id": "http://example.com/example.json",
"$schema": "http://json-schema.org/draft-07/schema",
"additionalProperties": true,
"description": "schema for detections",
"properties": {
"author": {
"$id": "#/properties/author",
"default": "",
"description": "Author of the detection",
"examples": [
"Patrick Bareiss, Splunk"
],
"type": "string"
},
"date": {
"$id": "#/properties/date",
"default": "",
"description": "date of creation or modification, format yyyy-mm-dd",
"examples": [
"2019-12-06"
],
"type": "string"
},
"description": {
"$id": "#/properties/description",
"default": "",
"description": "A detailed description of the detection",
"examples": [
"dbgcore.dll is a specifc DLL for Windows core debugging. It is used to obtain a memory dump of a process. This search detects the usage of this DLL for creating a memory dump of LSASS process. Memory dumps of the LSASS process can be created with tools such as Windows Task Manager or procdump."
],
"type": "string"
},
"how_to_implement": {
"$id": "#/properties/how_to_implement",
"default": "",
"description": "information about how to implement. Only needed for non standard implementations.",
"examples": [
"This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
],
"type": "string"
},
"id": {
"$id": "#/properties/id",
"default": "",
"description": "UUID as unique identifier",
"examples": [
"fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
],
"type": "string"
},
"known_false_positives": {
"$id": "#/properties/knwon_false_positives",
"default": "",
"description": "known false postives",
"examples": [
"Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual."
],
"type": "string"
},
"name": {
"$id": "#/properties/name",
"default": "",
"examples": [
"Access LSASS Memory for Dump Creation"
],
"title": "Name of detection",
"type": "string"
},
"references": {
"$id": "#/properties/references",
"additionalItems": true,
"default": [],
"description": "A list of references for this detection",
"examples": [
[
"https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf"
]
],
"items": {
"$id": "#/properties/references/items",
"default": "",
"description": "An explanation about the purpose of this instance.",
"examples": [
"https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf"
],
"title": "The Items Schema",
"type": "string"
},
"type": "array"
},
"search": {
"$id": "#/properties/search",
"default": "",
"description": "The Splunk search for the detection",
"examples": [
"`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter`"
],
"type": "string"
},
"tags": {
"$id": "#/properties/tags",
"additionalProperties": true,
"default": {},
"description": "An array of key value pairs for tagging",
"examples": [
{
"analytic_story": "credential_dumping",
"kill_chain_phases": "Action on Objectives",
"mitre_attack_id": "T1078.004",
"cis20": "CIS 13",
"nist": "DE.DP",
"security domain": "network",
"asset_type": "AWS Instance",
"risk_object": "user",
"risk_object_type": "network_artifacts",
"risk score": "60",
"custom_key": "custom_value"
}
],
"minItems": 1,
"type": "object",
"uniqueItems": true
},
"type": {
"$id": "#/properties/type",
"default": "",
"description": "type of detection",
"examples": [
"Anomaly"
],
"items": {
"enum": [
"TTP",
"Anomaly",
"Hunting",
"Baseline",
"Investigation",
"Correlation"
],
"type": "string"
},
"type": "string"
},
"datamodel": {
"$id": "#/properties/datamodel",
"default": "",
"description": "datamodel used in the search",
"examples": [
"Endpoint_Processes"
],
"items": {
"enum": [
"Alerts",
"Authentication",
"Certificates",
"Data Loss Prevention",
"Email",
"Endpoint_AccountManagement",
"Endpoint_Filesystem",
"Endpoint_Processes",
"Endpoint_Registry",
"Endpoint_ResourceAccess",
"Intrusion_Detection",
"Inventory_User",
"Malware_Attacks",
"Network_Traffic",
"Network_Sessions",
"Network_Resolution",
"Web",
"Web.Proxy"
],
"type": "string"
},
"type": "array"
},
"version": {
"$id": "#/properties/version",
"default": 0,
"description": "version of detection, e.g. 1 or 2 ...",
"examples": [
2
],
"type": "integer"
}
},
"required": [
"name",
"id",
"version",
"date",
"datamodel",
"description",
"type",
"author",
"search",
"known_false_positives",
"tags"
],
"title": "Detection Schema",
"type": "object"
}