From 1925eed0d761db85c661125208b2976ab2b1a75d Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Fri, 29 Oct 2021 14:05:53 -0500 Subject: [PATCH 01/25] Chrome seems to call cmd.exe all the time for reasons. Removing it from the list. --- .../ssa___prohibited_apps_spawning_cmdprompt.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index fda3e3841c..82aab5a6eb 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -18,11 +18,11 @@ search: '| from read_ssa_enriched_events() dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where process_name="cmd.exe" | rex field=parent_process "(?[^\\\\]+)$" - | where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe" - OR field0="visio.exe" OR field0="mspub.exe" OR field0="acrobat.exe" OR field0="acrord32.exe" - OR field0="chrome.exe" OR field0="iexplore.exe" OR field0="opera.exe" OR field0="firefox.exe" - OR field0="java.exe" OR field0="powershell.exe" + | where process_name="cmd.exe" | rex field=parent_process "(?[^\\\\]+)$" + | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe" OR ParentBaseFileName="powerpnt.exe" + OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe" OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" + OR ParentBaseFileName="iexplore.exe" OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" + OR ParentBaseFileName="java.exe" OR ParentBaseFileName="powershell.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, From 65afbd6ee7e50c8188143d5567ecc59804ab8988 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Fri, 29 Oct 2021 14:18:59 -0500 Subject: [PATCH 02/25] Added chrome back in, but filter out when the command line has chrome-extension in it --- .../ssa___prohibited_apps_spawning_cmdprompt.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 82aab5a6eb..30257a150e 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -14,16 +14,15 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", - null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), - dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) - + null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), + dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), + dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event,"event_id"), "string", null) | where process_name="cmd.exe" | rex field=parent_process "(?[^\\\\]+)$" | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe" OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe" OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe" OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" - OR ParentBaseFileName="java.exe" OR ParentBaseFileName="powershell.exe" - + OR ParentBaseFileName="java.exe" OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND cmd_line != "*chrome-extension*") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name", parent_process]) | into write_ssa_detected_events();' From 8ca27ad7e7f00fc5b1f3fb8507c6ff7e6f673d68 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Fri, 29 Oct 2021 14:50:12 -0500 Subject: [PATCH 03/25] Made the syntax more SPL2 friendly --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 30257a150e..8c8a527844 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -22,7 +22,8 @@ search: '| from read_ssa_enriched_events() | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe" OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe" OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe" OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" - OR ParentBaseFileName="java.exe" OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND cmd_line != "*chrome-extension*") + OR ParentBaseFileName="java.exe" OR ParentBaseFileName="powershell.exe" + OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT LIKE(cmd_line, "%chrome-extension*"))) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name", parent_process]) | into write_ssa_detected_events();' From 8d1b01d885ec15d4affa12c24bda9e523fce304e Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Fri, 29 Oct 2021 14:51:42 -0500 Subject: [PATCH 04/25] Forgot a lurking * in the LIKE statement --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 8c8a527844..4e6048b148 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -23,7 +23,7 @@ search: '| from read_ssa_enriched_events() OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe" OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe" OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR ParentBaseFileName="java.exe" OR ParentBaseFileName="powershell.exe" - OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT LIKE(cmd_line, "%chrome-extension*"))) + OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT LIKE(cmd_line, "%chrome-extension%"))) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name", parent_process]) | into write_ssa_detected_events();' From 2f8f267a6897e40bc1222b6b9a6b966c3f78aa5b Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Fri, 29 Oct 2021 15:14:36 -0500 Subject: [PATCH 05/25] Fixed more SPL2 errors --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 4e6048b148..4e20ce702f 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -23,7 +23,7 @@ search: '| from read_ssa_enriched_events() OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe" OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe" OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR ParentBaseFileName="java.exe" OR ParentBaseFileName="powershell.exe" - OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT LIKE(cmd_line, "%chrome-extension%"))) + OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%")))) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name", parent_process]) | into write_ssa_detected_events();' From 87c0f21453cd45eb85b935e380acbc86ca5f597c Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Fri, 29 Oct 2021 16:28:22 -0500 Subject: [PATCH 06/25] Added cmd_line to the body --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 4e20ce702f..ae325338d3 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -26,7 +26,7 @@ search: '| from read_ssa_enriched_events() OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%")))) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, - "parent_process_name", parent_process]) | into write_ssa_detected_events();' + "parent_process_name", parent_process, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. known_false_positives: There are circumstances where an application may legitimately From 3be3c37a50deb4161b0457563efc98d81ff769e8 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Fri, 29 Oct 2021 21:46:27 -0500 Subject: [PATCH 07/25] Added the data model --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index ae325338d3..b90400b50b 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -4,7 +4,8 @@ version: 1 date: 2020-7-13 author: Ignacio Bermudez Corrales, Splunk type: TTP -datamodel: [] +datamodel: + - Endpoint_Processes description: This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe` From 5117990730c94c512f507e18febdf3007499bf6f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 2 Nov 2021 16:30:49 -0700 Subject: [PATCH 08/25] Added a ba_detections.spec.json file for validation of the BA detections. Updated validate_schema to use a different shcema for BA detections vs non BA detections. --- bin/validate.py | 24 ++-- spec/ba_detections.spec.json | 213 +++++++++++++++++++++++++++++++++++ 2 files changed, 229 insertions(+), 8 deletions(-) create mode 100644 spec/ba_detections.spec.json diff --git a/bin/validate.py b/bin/validate.py index c26c3f65b5..871497ce04 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -17,12 +17,20 @@ from pathlib import Path from os import path, walk -def validate_schema(REPO_PATH, type, objects, verbose): +def validate_schema(REPO_PATH, detection_type, objects, verbose): + #Default regex does NOT match ssa___*.yml files: "^(?!ssa___).*\.yml$" + #The following search will match ssa___*.yml files: "^ssa___.*\.yml$" + if detection_type.startswith("ba_"): + filename_regex = "^ssa___.*\.yml$" + else: + filename_regex = "^(?!ssa___).*\.yml$" + + error = False errors = [] - schema_file = path.join(path.expanduser(REPO_PATH), 'spec/' + type + '.spec.json') + schema_file = path.join(path.expanduser(REPO_PATH), 'spec/' + detection_type + '.spec.json') try: schema = json.loads(open(schema_file, 'rb').read()) @@ -30,9 +38,9 @@ def validate_schema(REPO_PATH, type, objects, verbose): print("ERROR: reading schema file {0}".format(schema_file)) manifest_files = [] - for root, dirs, files in walk(REPO_PATH + "/" + type): + for root, dirs, files in walk(REPO_PATH + "/" + detection_type): for file in files: - if file.endswith(".yml"): + if re.search(filename_regex, file) is not None: manifest_files.append((path.join(root, file))) for manifest_file in manifest_files: @@ -54,12 +62,12 @@ def validate_schema(REPO_PATH, type, objects, verbose): errors.append("ERROR: {0} at:\n\t{1}".format(json.dumps(schema_error.message), manifest_file)) error = True - if type in objects: - objects[type].append(object) + if detection_type in objects: + objects[detection_type].append(object) else: arr = [] arr.append(object) - objects[type] = arr + objects[detection_type] = arr return objects, error, errors @@ -244,7 +252,7 @@ def validate_tests(REPO_PATH, object): def main(REPO_PATH, verbose): - validation_objects = ['macros','lookups','stories','detections','deployments', 'tests'] + validation_objects = ['macros','lookups','stories','detections', 'ba_detections','deployments', 'tests'] objects = {} schema_error = False diff --git a/spec/ba_detections.spec.json b/spec/ba_detections.spec.json new file mode 100644 index 0000000000..e50da0814f --- /dev/null +++ b/spec/ba_detections.spec.json @@ -0,0 +1,213 @@ +{ + "$id": "http://example.com/example.json", + "$schema": "http://json-schema.org/draft-07/schema", + "additionalProperties": true, + "description": "schema for detections", + "properties": { + "author": { + "$id": "#/properties/author", + "default": "", + "description": "Author of the detection", + "examples": [ + "Patrick Bareiss, Splunk" + ], + "type": "string" + }, + "date": { + "$id": "#/properties/date", + "default": "", + "description": "date of creation or modification, format yyyy-mm-dd", + "examples": [ + "2019-12-06" + ], + "type": "string" + }, + "description": { + "$id": "#/properties/description", + "default": "", + "description": "A detailed description of the detection", + "examples": [ + "dbgcore.dll is a specifc DLL for Windows core debugging. It is used to obtain a memory dump of a process. This search detects the usage of this DLL for creating a memory dump of LSASS process. Memory dumps of the LSASS process can be created with tools such as Windows Task Manager or procdump." + ], + "type": "string" + }, + "how_to_implement": { + "$id": "#/properties/how_to_implement", + "default": "", + "description": "information about how to implement. Only needed for non standard implementations.", + "examples": [ + "This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe." + ], + "type": "string" + }, + "id": { + "$id": "#/properties/id", + "default": "", + "description": "UUID as unique identifier", + "examples": [ + "fb4c31b0-13e8-4155-8aa5-24de4b8d6717" + ], + "type": "string" + }, + "known_false_positives": { + "$id": "#/properties/knwon_false_positives", + "default": "", + "description": "known false postives", + "examples": [ + "Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual." + ], + "type": "string" + }, + "name": { + "$id": "#/properties/name", + "default": "", + "examples": [ + "Access LSASS Memory for Dump Creation" + ], + "title": "Name of detection", + "type": "string" + }, + "references": { + "$id": "#/properties/references", + "additionalItems": true, + "default": [], + "description": "A list of references for this detection", + "examples": [ + [ + "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf" + ] + ], + "items": { + "$id": "#/properties/references/items", + "default": "", + "description": "An explanation about the purpose of this instance.", + "examples": [ + "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf" + ], + "title": "The Items Schema", + "type": "string" + }, + "type": "array" + }, + "search": { + "$id": "#/properties/search", + "default": "", + "description": "The Splunk search for the detection", + "examples": [ + "`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter`" + ], + "type": "string" + }, + "tags": { + "$id": "#/properties/tags", + "additionalProperties": true, + "default": {}, + "description": "An array of key value pairs for tagging", + "examples": [ + { + "analytic_story": "credential_dumping", + "kill_chain_phases": "Action on Objectives", + "mitre_attack_id": "T1078.004", + "cis20": "CIS 13", + "nist": "DE.DP", + "security domain": "network", + "asset_type": "AWS Instance", + "risk_object": "user", + "risk_object_type": "network_artifacts", + "risk score": "60", + "custom_key": "custom_value" + } + ], + "minItems": 1, + "type": "object", + "uniqueItems": true + }, + "type": { + "$id": "#/properties/type", + "default": "", + "description": "type of detection", + "examples": [ + "Anomaly" + ], + "items": { + "enum": [ + "TTP", + "Anomaly", + "Hunting", + "Baseline", + "Investigation", + "Correlation" + ], + "type": "string" + }, + "type": "string" + }, + "datamodel": { + "$id": "#/properties/datamodel", + "default": "", + "description": "datamodel used in the search", + "examples": [ + "Endpoint" + ], + "items": { + "enum": [ + "Alerts", + "Authentication", + "Authentication (V2)", + "Certificates", + "Certificates (v2)", + "Data Loss Prevention", + "Email", + "Email (V2)", + "Endpoint_AccountManagement", + "Endpoint_AccountManagement (V2)", + "Endpoint_Filesystem", + "Endpoint_Filesystem (V2)", + "Endpoint_Processes", + "Endpoint_Registry", + "Endpoint_Registry (V2)", + "Endpoint_ResourceAccess", + "Endpoint_ResourceAccess (V2)", + "Intrusion_Detection", + "Intrusion_Detection (V2)", + "Inventory_User", + "Malware_Attacks", + "Malware_Attacks(V2)", + "Network_Traffic", + "Network_Sessions", + "Network_Resolution (DNS)", + "Web", + "Web.Proxy", + "Web.Proxy (v2)" + ], + "type": "string" + }, + "type": "array" + }, + "version": { + "$id": "#/properties/version", + "default": 0, + "description": "version of detection, e.g. 1 or 2 ...", + "examples": [ + 2 + ], + "type": "integer" + } + }, + "required": [ + "name", + "id", + "version", + "date", + "datamodel", + "description", + "type", + "author", + "search", + "known_false_positives", + "tags" + ], + "title": "Detection Schema", + "type": "object" + } + \ No newline at end of file From f0f70928845bfb72b53b28b76c1a95af04212083 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 2 Nov 2021 16:51:11 -0700 Subject: [PATCH 09/25] Removed one line from json schema. This should fail, removal and check for failure checks that we fixed the underlying issue. --- spec/ba_detections.spec.json | 1 - 1 file changed, 1 deletion(-) diff --git a/spec/ba_detections.spec.json b/spec/ba_detections.spec.json index e50da0814f..c203469339 100644 --- a/spec/ba_detections.spec.json +++ b/spec/ba_detections.spec.json @@ -163,7 +163,6 @@ "Endpoint_AccountManagement (V2)", "Endpoint_Filesystem", "Endpoint_Filesystem (V2)", - "Endpoint_Processes", "Endpoint_Registry", "Endpoint_Registry (V2)", "Endpoint_ResourceAccess", From ac4bbd06a66bbf8b602432bb726101385a9dc3e0 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 2 Nov 2021 16:57:47 -0700 Subject: [PATCH 10/25] Just ba_detections to make parsing easier. --- bin/validate.py | 1 + spec/ba_detections.spec.json | 1 + 2 files changed, 2 insertions(+) diff --git a/bin/validate.py b/bin/validate.py index 871497ce04..1550668ef3 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -253,6 +253,7 @@ def validate_tests(REPO_PATH, object): def main(REPO_PATH, verbose): validation_objects = ['macros','lookups','stories','detections', 'ba_detections','deployments', 'tests'] + validation_objects = ['ba_detections'] objects = {} schema_error = False diff --git a/spec/ba_detections.spec.json b/spec/ba_detections.spec.json index c203469339..e50da0814f 100644 --- a/spec/ba_detections.spec.json +++ b/spec/ba_detections.spec.json @@ -163,6 +163,7 @@ "Endpoint_AccountManagement (V2)", "Endpoint_Filesystem", "Endpoint_Filesystem (V2)", + "Endpoint_Processes", "Endpoint_Registry", "Endpoint_Registry (V2)", "Endpoint_ResourceAccess", From 3d84051d800c7437d6d79b53cb21a833fa5f0def Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 2 Nov 2021 17:05:49 -0700 Subject: [PATCH 11/25] some print statements during validation to help with debugging --- bin/validate.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index 1550668ef3..2197a4ebbd 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -21,8 +21,10 @@ def validate_schema(REPO_PATH, detection_type, objects, verbose): #Default regex does NOT match ssa___*.yml files: "^(?!ssa___).*\.yml$" #The following search will match ssa___*.yml files: "^ssa___.*\.yml$" if detection_type.startswith("ba_"): + print("***SSA_REGEX_SET***") filename_regex = "^ssa___.*\.yml$" else: + print("***NO SSA_REGEX_SET***") filename_regex = "^(?!ssa___).*\.yml$" @@ -42,7 +44,7 @@ def validate_schema(REPO_PATH, detection_type, objects, verbose): for file in files: if re.search(filename_regex, file) is not None: manifest_files.append((path.join(root, file))) - + print(len(manifest_files)) for manifest_file in manifest_files: if verbose: print("processing manifest {0}".format(manifest_file)) @@ -68,7 +70,7 @@ def validate_schema(REPO_PATH, detection_type, objects, verbose): arr = [] arr.append(object) objects[detection_type] = arr - + print("***END OF VALIDATE SCHEMA ***") return objects, error, errors @@ -253,7 +255,7 @@ def validate_tests(REPO_PATH, object): def main(REPO_PATH, verbose): validation_objects = ['macros','lookups','stories','detections', 'ba_detections','deployments', 'tests'] - validation_objects = ['ba_detections'] + objects = {} schema_error = False From 26af696757d0b089d7f2619487c15a3ceb34e800 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 2 Nov 2021 17:15:02 -0700 Subject: [PATCH 12/25] fixed checking of the ssa filename, I think --- bin/validate.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/validate.py b/bin/validate.py index 2197a4ebbd..dcb4efc1dd 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -42,7 +42,7 @@ def validate_schema(REPO_PATH, detection_type, objects, verbose): manifest_files = [] for root, dirs, files in walk(REPO_PATH + "/" + detection_type): for file in files: - if re.search(filename_regex, file) is not None: + if re.search(filename_regex, path.basename(file)) is not None: manifest_files.append((path.join(root, file))) print(len(manifest_files)) for manifest_file in manifest_files: From 2009a6541c096e1d9e283573f7fb71fbde5cdd27 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 2 Nov 2021 17:22:03 -0700 Subject: [PATCH 13/25] more fixes to getting ssa detections --- bin/validate.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/bin/validate.py b/bin/validate.py index dcb4efc1dd..be18875e49 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -33,6 +33,10 @@ def validate_schema(REPO_PATH, detection_type, objects, verbose): errors = [] schema_file = path.join(path.expanduser(REPO_PATH), 'spec/' + detection_type + '.spec.json') + #remove the prefix if the detection type starts with ba_ so we can + #get the files from the proper folders and proceed correctly + if detection_type.startswith("ba_"): + detection_type = detection_type[3:] try: schema = json.loads(open(schema_file, 'rb').read()) From 80db3a4e86d8a18abac9fdeb90d704036cbf19b6 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 2 Nov 2021 17:29:55 -0700 Subject: [PATCH 14/25] Added Endpoint to ba_detections.spec.json --- spec/ba_detections.spec.json | 1 + 1 file changed, 1 insertion(+) diff --git a/spec/ba_detections.spec.json b/spec/ba_detections.spec.json index e50da0814f..6d7edd5197 100644 --- a/spec/ba_detections.spec.json +++ b/spec/ba_detections.spec.json @@ -159,6 +159,7 @@ "Data Loss Prevention", "Email", "Email (V2)", + "Endpoint", "Endpoint_AccountManagement", "Endpoint_AccountManagement (V2)", "Endpoint_Filesystem", From 244fad2f7ecc9ddfa279f28a12175b7dfbd8d6e3 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 2 Nov 2021 17:34:47 -0700 Subject: [PATCH 15/25] Removed Endpoint, it should be Endpoint_Process for relevant detections. --- spec/ba_detections.spec.json | 1 - 1 file changed, 1 deletion(-) diff --git a/spec/ba_detections.spec.json b/spec/ba_detections.spec.json index 6d7edd5197..e50da0814f 100644 --- a/spec/ba_detections.spec.json +++ b/spec/ba_detections.spec.json @@ -159,7 +159,6 @@ "Data Loss Prevention", "Email", "Email (V2)", - "Endpoint", "Endpoint_AccountManagement", "Endpoint_AccountManagement (V2)", "Endpoint_Filesystem", From dbc1e604b87fa2a812bf341f2f94db55d08317c5 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 2 Nov 2021 17:40:19 -0700 Subject: [PATCH 16/25] Changed datamodel from Endpoint to Endpoint_Process for a number of the ssa___ detection files. --- bin/validate.py | 3 --- detections/endpoint/ssa___attempt_to_delete_services.yml | 2 +- detections/endpoint/ssa___attempt_to_disable_services.yml | 2 +- detections/endpoint/ssa___delete_a_net_user.yml | 2 +- .../endpoint/ssa___deny_permission_using_cacls_utility.yml | 2 +- detections/endpoint/ssa___disable_net_user_account.yml | 2 +- .../endpoint/ssa___grant_permission_using_cacls_utility.yml | 2 +- .../ssa___modify_acls_permission_of_files_or_folders.yml | 2 +- detections/endpoint/ssa___resize_shadowstorage_volume.yml | 2 +- detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml | 2 +- detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml | 2 +- 11 files changed, 10 insertions(+), 13 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index be18875e49..554a1a5217 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -21,10 +21,8 @@ def validate_schema(REPO_PATH, detection_type, objects, verbose): #Default regex does NOT match ssa___*.yml files: "^(?!ssa___).*\.yml$" #The following search will match ssa___*.yml files: "^ssa___.*\.yml$" if detection_type.startswith("ba_"): - print("***SSA_REGEX_SET***") filename_regex = "^ssa___.*\.yml$" else: - print("***NO SSA_REGEX_SET***") filename_regex = "^(?!ssa___).*\.yml$" @@ -48,7 +46,6 @@ def validate_schema(REPO_PATH, detection_type, objects, verbose): for file in files: if re.search(filename_regex, path.basename(file)) is not None: manifest_files.append((path.join(root, file))) - print(len(manifest_files)) for manifest_file in manifest_files: if verbose: print("processing manifest {0}".format(manifest_file)) diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml index 2321bedfa3..fb82af51eb 100644 --- a/detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/detections/endpoint/ssa___attempt_to_delete_services.yml @@ -5,7 +5,7 @@ date: '2021-06-18' author: Teoderick Contreras, splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: This analytic identifies suspicious series of attempt to kill multiple services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml index 2afe31f0da..ef993ba4c0 100644 --- a/detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/detections/endpoint/ssa___attempt_to_disable_services.yml @@ -5,7 +5,7 @@ date: '2021-06-18' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: This analytic will identify suspicious series of command-line to disable several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml index 5024295db6..6b383229e0 100644 --- a/detections/endpoint/ssa___delete_a_net_user.yml +++ b/detections/endpoint/ssa___delete_a_net_user.yml @@ -5,7 +5,7 @@ date: '2021-06-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint_Processes description: This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index 676ad9ffaf..99f240479b 100644 --- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -5,7 +5,7 @@ date: '2021-06-14' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml index b3772d342d..7a086a97fc 100644 --- a/detections/endpoint/ssa___disable_net_user_account.yml +++ b/detections/endpoint/ssa___disable_net_user_account.yml @@ -5,7 +5,7 @@ date: '2021-06-21' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index 2fb386ce14..8356803542 100644 --- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -5,7 +5,7 @@ date: '2021-06-14' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft, ransomware and coinminer scripts to evade detections and restrict access diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 1c0ffacf41..a713754bc8 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -5,7 +5,7 @@ date: '2021-06-15' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint_Processes description: This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone or to a specific user. This technique may be used by the adversary to evade ACLs or protected files access. This changes diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml index df3b78a776..58faae2de6 100644 --- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -5,7 +5,7 @@ date: '2021-06-21' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index 0ff21233b6..bea1f7e5ca 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -5,7 +5,7 @@ date: '2021-06-15' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, or system event logs. diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index cd77f947a9..c91375191a 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -5,7 +5,7 @@ date: '2021-06-15' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections in compromised host. From 72b1fb7df4b98ff4b92a1f031f4c8ad1c5f1b8d6 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 3 Nov 2021 12:01:00 -0700 Subject: [PATCH 17/25] Added datamodels to most of the ssa___ detections. Still needs some more attention - there are likely some missing datamodels and some that are incorrect. --- ...g_stolen_credentials_via_mimikatz_modules.yml | 3 ++- ...tolen_credentials_via_powersploit_modules.yml | 3 ++- ...edential_strength_via_dsinternals_modules.yml | 5 +++-- ...credential_dump_from_registry_via_reg_exe.yml | 3 ++- ...extraction_dsinternals_conversion_modules.yml | 3 ++- ...credential_extraction_dsinternals_modules.yml | 3 ++- ...tial_extraction_fgdump_cachedump_s_option.yml | 3 ++- ...tial_extraction_fgdump_cachedump_v_option.yml | 3 ++- ...ntial_extraction_getaddbaccount_from_dump.yml | 3 ++- ...ential_extraction_lazagne_command_options.yml | 3 ++- ...___credential_extraction_mimikatz_modules.yml | 3 ++- ...ntial_extraction_ms_debuggers_kernel_peek.yml | 3 ++- ...edential_extraction_ms_debuggers_z_option.yml | 3 ++- ...credential_extraction_powersploit_modules.yml | 3 ++- ...___detect_dump_lsass_memory_using_comsvcs.yml | 3 ++- .../endpoint/ssa___detect_kerberoasting.yml | 3 ++- detections/endpoint/ssa___detect_pass_hash.yml | 3 ++- .../endpoint/ssa___first_time_seen_cmd_line.yml | 3 ++- ...cess_user_content_via_powersploit_modules.yml | 3 ++- ..._account_creation_via_powersploit_modules.yml | 3 ++- ...nt_enable_disable_via_dsinternals_modules.yml | 3 ++- ...illegal_log_deletion_via_mimikatz_modules.yml | 3 ++- ...ents_and_policies_via_dsinternals_modules.yml | 3 ++- ...s_and_AD_elements_via_powersploit_modules.yml | 3 ++- ...n_and_persistence_via_powersploit_modules.yml | 3 ++- ..._privilege_elevation_via_mimikatz_modules.yml | 3 ++- ..._and_process_control_via_mimikatz_modules.yml | 3 ++- ...d_process_control_via_powersploit_modules.yml | 3 ++- ...tolen_credentials_via_powersploit_modules.yml | 3 ++- .../ssa___ptt_pth_kerb_ntlm_dest_device.yml | 3 ++- .../ssa___ptt_pth_kerb_ntlm_origin_device.yml | 3 ++- ...__rare_parent_process_relationship_lolbas.yml | 3 ++- ...nce_opportunities_via_powersploit_modules.yml | 3 ++- ...s_groups_policies_via_powersploit_modules.yml | 3 ++- ..._use_accounts_groups_via_mimikatz_modules.yml | 3 ++- ...ry_infrastructure_via_powersploit_modules.yml | 3 ++- ...computers_domains_via_powersploit_modules.yml | 3 ++- ...on_and_use_computers_via_mimikatz_modules.yml | 3 ++- ...g_system_elements_via_powersploit_modules.yml | 3 ++- ...recon_and_use_shares_via_mimikatz_modules.yml | 3 ++- ...on_and_use_shares_via_powersploit_modules.yml | 3 ++- ...econ_connectivity_via_powersploit_modules.yml | 3 ++- ..._stores_and_services_via_mimikatz_modules.yml | 3 ++- ...n_defensive_tools_via_powersploit_modules.yml | 3 ++- ...ion_opportunities_via_powersploit_modules.yml | 3 ++- ...ss_service_hijacking_via_mimikatz_modules.yml | 3 ++- ...ocesses_and_services_via_mimikatz_modules.yml | 3 ++- ...tting_credentials_via_dsinternals_modules.yml | 3 ++- ..._setting_credentials_via_mimikatz_modules.yml | 3 ++- ...tting_credentials_via_powersploit_modules.yml | 3 ++- ...ystem_process_running_unexpected_location.yml | 3 ++- ...___unusual_lolbas_in_short_period_of_time.yml | 3 ++- .../ssa___unusually_long_command_line.yml | 3 ++- spec/ba_detections.spec.json | 16 +++------------- 54 files changed, 110 insertions(+), 67 deletions(-) diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index 83940d73f0..ad413af7d2 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token attack, Golden or Silver kerberos ticket attack, and Skeleton key attack. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index 5835d34f11..814dece7ee 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: Stolen credentials are applied by methods such as user impersonation, credential injection, spoofing of authentication processes or getting hold of critical accounts. This detection indicates such activities carried out by PowerSploit exploit diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index 9fb311d807..d6c3e8f36d 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -4,9 +4,10 @@ version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of DSInternals modules that verify password - strength, i.e., identify week accounts that would be easily compromised. + strength, i.e., identify weak accounts that would be easily compromised. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 66609e68dd..9b33304517 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -4,7 +4,8 @@ version: 1 date: 2020-6-04 author: Jose Hernandez, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index 5b5086bcea..8bdadd5f6a 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -5,7 +5,8 @@ version: 1 date: '2020-10-21' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. DSInternals diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index ebfa2cf9b0..2ba5dedaa7 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-10-21' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. DSInternals diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 97f3faaa8f..f5fb629e3f 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-10-18' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. FGdump is diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index cd0b392e95..a8bd8bd421 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-10-18' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. FGdump is diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index ee2e8d7e10..b7a1803fe3 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -5,7 +5,8 @@ version: 1 date: '2020-10-18' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. PowerSploit diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index de232ad83f..578c294d38 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-10-18' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. LaZagne is diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index bc0cc3c8a1..28e5ef51b8 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-10-21' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Mimikatz diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index 75a194325c..c7e307cdb0 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-10-18' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Native Microsoft diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index 3820b3a887..84de6fd615 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-10-18' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Native Microsoft diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index feca60030d..139002dd9b 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-10-21' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. PowerSploit diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index 9d797b74ee..256fce68a5 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-09-15' author: Jose Hernandez, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This search detects the memory of lsass.exe being dumped for offline credential theft attack. search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index 79d5759281..23a251726f 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -4,7 +4,8 @@ version: 2 date: '2020-10-21' author: Xiao Lin, Splunk type: TTP -datamodel: [] +datamodel: +- Certificates description: This search detects a potential kerberoasting attack via service principal name requests search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"), diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index 49ae7ca771..c14864ecab 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-10-21' author: Xiao Lin, Splunk type: TTP -datamodel: [] +datamodel: +- Authentication description: This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts using Pass-the-Hash technique. search: ' | from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 61fe4af67e..570422a521 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -4,7 +4,8 @@ version: 3 date: 2021-2-1 author: Ignacio Bermudez Corrales, Splunk type: Anomaly -datamodel: [] +datamodel: +- Endpoint_Processes description: This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. This is an implementation on SPL2 of the rule `First time seen command line argument` by @bpatel. diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index f2d3a42c59..9befd204a2 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies access to PowerSploit modules that enable illegaly access user content, such as key logging, audio recording, screenshots, tapping into http and RDP sessions, etc. diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 5706bc23ef..bcf6b5a219 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies access to PowerSploit modules that create accounts illegaly. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index 9a86a3de1c..055bdec4ea 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of DSInternals modules that enable or disable accounts illegaly. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index 34cbfa9e81..6841ed4c33 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies access to PowerSploit modules that delete event logs. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index b3d2019c91..8d198b5a65 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -5,7 +5,8 @@ version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of DSInternals modules for illegal management of Active Directoty elements and policies. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index ebebdf9258..34f71e1e74 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -5,7 +5,8 @@ version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies access to PowerSploit modules that enable illegal management of computers and Active Directory elements. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index 93ebd26c4e..f5a2d2d6bd 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies access to PowerSploit modules that illegaly elevate general privileges or ensure persistence, e.g., enable manipulation of registry, task scheduling, persistent WMI, access to OS objects under desired identities. diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index 43af6b051f..d89d0b0125 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of Mimikatz modules for illegal privilege elevation. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index 053e04b3ec..80437e3035 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of Mimikatz modules for illegal control over services and processes, including the authentication service. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index f1a19ab5ac..7bddc183f8 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies access to PowerSploit modules that enable illegal control of services and processes, such as installing or spoofing of malicious services, injecting malicious code in DLLs and EXEs, invoking shell code and WMI commands, diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index fc96b2948a..d56fefc09d 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-04' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of PowerSploit modules that facilitate access probing with admin credentials as well as probing access to system services. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml index f65c51a9d1..b511d1c3d2 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml @@ -4,7 +4,8 @@ version: 1 date: '2021-09-01' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Certificates description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index 1c6f185310..38a83a7c3a 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -4,7 +4,8 @@ version: 1 date: '2021-09-01' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Certificates description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml index 825ce7954e..4d135c38f7 100644 --- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml +++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml @@ -4,7 +4,8 @@ version: 1 date: '2021-05-20' author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk type: Anomaly -datamodel: [] +datamodel: +- Endpoint_Processes description: An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index 9098776ffb..1220488336 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-05' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of PowerSploit modules that discover opportunities for malicious access and persistence. Some examples include access to admin accounts, weak access control policies, landing paths for dropping malicious software or data diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index 151bdea120..955e2011b2 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-05' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies access to PowerSploit modules that discover accounts, groups and policies that can be accessed or taken over. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index 14322b2d3e..6ead00797b 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-05' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of Mimikatz modules for discovery of accounts and groups and access to them. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index 7248a1482a..7640624a38 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -5,7 +5,8 @@ version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies access to PowerSploit modules for reconnaissance and access to elements of Active Directory infrastructure, such as domain identifiers, AD sites and forests, and trust relations. diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index c22a323921..6a9ca39b93 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies access to PowerSploit modules that discover computers, servers and domains that can be accessed or taken over. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index 2a409ce088..b3ee75ead1 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of Mimikatz modules for discovery of computers and servers and access to them. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index a63cfbbb23..5003ff7b4a 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies access to PowerSploit modules that discover and access operating system elements, such as processes, services, registry locations, security packages and files. diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index 66d177f48b..e5e30ad1d0 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of Mimikatz modules for discovery and access to network shares. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index c98b38ae46..0bab24786a 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies access to PowerSploit modules that discover and access network and distributed file system shares. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index 8fe5b4980a..e809ea0f63 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies access to PowerSploit modules for reconnaissance of connectivity. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index 84eef9576b..0272d86045 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies reconnaissance of credential stores and use of CryptoAPI services by Mimikatz modules. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index 511a1cb7c0..c3006e4aa4 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-05' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of PowerSploit modules for assessment of presence of defensive tools. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index 1e8f9fded4..155c209444 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-05' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of PowerSploit modules for assessment of privilege escalation opportunities. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index d2598550e5..78869cc780 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-05' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of Mimikatz modules for discovery of process or service hijacking opportunities via Microsoft Detours compatibility. Microsoft Detours is an open source library for intercepting, monitoring and instrumenting diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index 0a785c034c..40a29f5cb9 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies use of Mimikatz modules for discovery and access to services and processes. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index 22d66571b9..b05cc1bf1d 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies illegal setting of credentials via DSInternals modules. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index 91267f2bfc..a3f6df665f 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies illegal setting of credentials via Mimikatz modules. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index 6870ae32f0..4ef963aecb 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint_Processes description: This detection identifies illegal setting of credentials via PowerSploit modules. search: '| from read_ssa_enriched_events() diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index dc69941b24..3d3f090355 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -4,7 +4,8 @@ version: 3 date: '2020-08-25' author: Ignacio Bermudez Corrales, Splunk type: Anomaly -datamodel: [] +datamodel: +- Endpoint_Processes description: An attacker tries might try to use different version of a system command without overriding original, or they might try to avoid some detection running the process from a different folder. This detection checks that a list of system processes diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml index 63ec825a35..2ff4dfa4cd 100644 --- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -4,7 +4,8 @@ version: 2 date: '2020-08-25' author: Ignacio Bermudez Corrales, Splunk type: Anomaly -datamodel: [] +datamodel: +- Endpoint_Processes description: Attacker activity may compromise executing several LOLBAS applications in conjunction to accomplish their objectives. We are looking for more than usual LOLBAS applications over a window of time, by building profiles per machine. diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml index 7f48539c86..526516edc2 100644 --- a/detections/endpoint/ssa___unusually_long_command_line.yml +++ b/detections/endpoint/ssa___unusually_long_command_line.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-10-06' author: Ignacio Bermudez Corrales, Splunk type: Anomaly -datamodel: [] +datamodel: +- Endpoint_Processes description: Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin to help identify command lines with lengths that are unusual for a given user. This diff --git a/spec/ba_detections.spec.json b/spec/ba_detections.spec.json index e50da0814f..884621de9f 100644 --- a/spec/ba_detections.spec.json +++ b/spec/ba_detections.spec.json @@ -147,38 +147,28 @@ "default": "", "description": "datamodel used in the search", "examples": [ - "Endpoint" + "Endpoint_Processes" ], "items": { "enum": [ "Alerts", "Authentication", - "Authentication (V2)", "Certificates", - "Certificates (v2)", "Data Loss Prevention", "Email", - "Email (V2)", "Endpoint_AccountManagement", - "Endpoint_AccountManagement (V2)", "Endpoint_Filesystem", - "Endpoint_Filesystem (V2)", "Endpoint_Processes", "Endpoint_Registry", - "Endpoint_Registry (V2)", "Endpoint_ResourceAccess", - "Endpoint_ResourceAccess (V2)", "Intrusion_Detection", - "Intrusion_Detection (V2)", "Inventory_User", "Malware_Attacks", - "Malware_Attacks(V2)", "Network_Traffic", "Network_Sessions", - "Network_Resolution (DNS)", + "Network_Resolution", "Web", - "Web.Proxy", - "Web.Proxy (v2)" + "Web.Proxy" ], "type": "string" }, From 5fdd83c214edc6d02f9b3c3141128cef1eff0668 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Wed, 10 Nov 2021 12:35:50 -0600 Subject: [PATCH 18/25] Data model changes for ptt searches, bumped version of prohibited apps --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 7 +++---- .../endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml | 2 +- .../endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml | 2 +- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index b90400b50b..07ee37a990 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -1,7 +1,7 @@ name: Detect Prohibited Applications Spawning cmd exe id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 -version: 1 -date: 2020-7-13 +version: 2 +date: 2020-11-10 author: Ignacio Bermudez Corrales, Splunk type: TTP datamodel: @@ -11,7 +11,6 @@ description: This search looks for executions of cmd.exe spawned by a process th a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe` by @bpatel. search: '| from read_ssa_enriched_events() - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", @@ -42,7 +41,7 @@ tags: - Sunburst Malware cis20: - CIS 8 - confidence: 80 + confidence: 50 context: - Source:AD - Source:Endpoint diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml index b511d1c3d2..3d0d712d29 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml @@ -5,7 +5,7 @@ date: '2021-09-01' author: Stanislav Miskovic, Splunk type: TTP datamodel: -- Certificates +- Authentication description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index 38a83a7c3a..83e947158f 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -5,7 +5,7 @@ date: '2021-09-01' author: Stanislav Miskovic, Splunk type: TTP datamodel: -- Certificates +- Authentication description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported From 694d08b49cbd5bf8134cac1c9f39a68dcd4edd56 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Wed, 10 Nov 2021 23:31:48 -0600 Subject: [PATCH 19/25] Added some filters for the data model into the SPL --- ...detect_dump_lsass_memory_using_comsvcs.yml | 22 +++++++------ .../endpoint/ssa___detect_kerberoasting.yml | 31 ++++++++++--------- ...a___prohibited_apps_spawning_cmdprompt.yml | 1 + .../ssa___ptt_pth_kerb_ntlm_dest_device.yml | 6 ++-- .../ssa___ptt_pth_kerb_ntlm_origin_device.yml | 5 ++- .../ssa___wevtutil_usage_to_clear_logs.yml | 29 +++++++++-------- .../ssa___wevtutil_usage_to_disable_logs.yml | 25 ++++++++------- 7 files changed, 68 insertions(+), 51 deletions(-) diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index 256fce68a5..8aa246b6b1 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -1,6 +1,6 @@ name: Detect Dump LSASS Memory using comsvcs id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e -version: 1 +version: 2 date: '2020-09-15' author: Jose Hernandez, Splunk type: TTP @@ -8,15 +8,17 @@ datamodel: - Endpoint_Processes description: This search detects the memory of lsass.exe being dumped for offline credential theft attack. -search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event, - "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), - "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", - null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, - /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = - timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id, - "process_name", process_name, "process", process]) | into write_ssa_detected_events();' +search: '| from read_ssa_enriched_events() + | where "Endpoint_Processes" IN(_datamodels) + | eval dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), + timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + process=lower(ucast(map_get(input_event, "process"), "string", null)), + event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true + | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id) + | eval body=create_map(["event_id", event_id, "process_name", process_name, "process", process]) + | into write_ssa_detected_events();' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index 23a251726f..b1f39df1b7 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -8,21 +8,24 @@ datamodel: - Certificates description: This search detects a potential kerberoasting attack via service principal name requests -search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"), - EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, - "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), - ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, - "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), - event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769" - AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event - input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] +search: ' | from read_ssa_enriched_events() + | eval _time=map_get(input_event, "_time"), + EventCode=map_get(input_event, "event_code"), + TicketOptions=map_get(input_event, "ticket_options"), + TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), + ServiceName=map_get(input_event, "service_name"), + ServiceID=map_get(input_event, "service_id"), + dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), + dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" + | first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID - | eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id, - "EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, - "TicketEncryptionType", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null))| select start_time, end_time, entities, body | into write_ssa_detected_events();' + | eval start_time=_time, end_time=_time + | eval body=create_map(["event_id", event_id, "EventCode", EventCode, "ServiceName", ServiceName, + "TicketOptions", TicketOptions, "TicketEncryptionType", TicketEncryptionType]), + entities = mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | select start_time, end_time, entities, body | into write_ssa_detected_events();' how_to_implement: The test data is converted from Windows Security Event logs generated from Attach Range simulation and used in SPL search and extended to SPL2 known_false_positives: Older systems that support kerberos RC4 by default NetApp may diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 7145f4a93d..93fd49f508 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -8,6 +8,7 @@ datamodel: type: Anomaly description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further.' search: '| from read_ssa_enriched_events() + | where "Endpoint_Processes" IN(_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml index eb63c82d8c..510598c50d 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml @@ -10,8 +10,10 @@ description: This detection identifies potential Pass the Token or Pass the Hash exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by a detination device. -search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, - "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), +search: '| from read_ssa_enriched_events() + | where "Authentication" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + dest_user=lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id= ucast(map_get(input_event, "dest_device_id"), "string", null), signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index 4f0b79a1e5..7edffc64c4 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -11,7 +11,10 @@ description: This detection identifies potential Pass the Token or Pass the Hash from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by an event-collecting device (i.e., a specific domain controller or an endpoint destination). -search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, +search: '| from read_ssa_enriched_events() + | where "Authentication" IN(_datamodels) + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", null), origin_device_id= ucast(map_get(input_event, "origin_device_id"), "string", diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index bea1f7e5ca..c024022d94 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -9,19 +9,22 @@ datamodel: description: The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, or system event logs. -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, - /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line, - /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, - /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) +search: '| from read_ssa_enriched_events() + | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), + process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") + AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line, + /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, + /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" + | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index c91375191a..9282b752ba 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -9,17 +9,20 @@ datamodel: description: This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections in compromised host. -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, - "%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, - entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, - "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", - cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, - "process_path", process_path]) | into write_ssa_detected_events();' +search: '| from read_ssa_enriched_events() + | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), + process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" + | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. From 292ce79c5d170309f5b65c6cbd50c225151e127c Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 12 Nov 2021 09:58:45 +0100 Subject: [PATCH 20/25] improved ssa testing --- bin/ssa-end-to-end-testing/modules/github_service.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/bin/ssa-end-to-end-testing/modules/github_service.py b/bin/ssa-end-to-end-testing/modules/github_service.py index a7cafc5fef..a095f8e56f 100644 --- a/bin/ssa-end-to-end-testing/modules/github_service.py +++ b/bin/ssa-end-to-end-testing/modules/github_service.py @@ -50,11 +50,12 @@ class GithubService: # changed detections if file_path.startswith('detections'): - if os.path.basename(file_path).startswith('ssa'): - file_path_base = os.path.splitext(file_path)[0].replace('detections', 'tests') + '.test' - file_path_new = file_path_base + '.yml' - if file_path_new not in changed_ssa_test_files: - changed_ssa_test_files.append(file_path_new) + if not 'deprecated' in file_path: + if os.path.basename(file_path).startswith('ssa'): + file_path_base = os.path.splitext(file_path)[0].replace('detections', 'tests') + '.test' + file_path_new = file_path_base + '.yml' + if file_path_new not in changed_ssa_test_files: + changed_ssa_test_files.append(file_path_new) # changed CI code if file_path == '.gitlab-ci.yml' or file_path.startswith('bin/ssa-end-to-end-testing'): From 265df55be40fc70a0f0e57df143cbe298e3a55b8 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 12 Nov 2021 12:00:54 +0100 Subject: [PATCH 21/25] improved ssa testing --- bin/ssa-end-to-end-testing/modules/github_service.py | 1 - 1 file changed, 1 deletion(-) diff --git a/bin/ssa-end-to-end-testing/modules/github_service.py b/bin/ssa-end-to-end-testing/modules/github_service.py index a095f8e56f..dec758191d 100644 --- a/bin/ssa-end-to-end-testing/modules/github_service.py +++ b/bin/ssa-end-to-end-testing/modules/github_service.py @@ -77,4 +77,3 @@ class GithubService: return changed_ssa_test_files, ci_changes - From d2cf7b8e140c3192f108140d435f4b47e2d474b7 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 12 Nov 2021 12:51:43 +0100 Subject: [PATCH 22/25] small change --- detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index c024022d94..f6bbea100e 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -82,3 +82,4 @@ tags: risk_score: 63 risk_severity: medium security_domain: endpoint + From fb0c44ac2f92f1fed702e3bb19419f103499efec Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 12 Nov 2021 14:35:35 +0100 Subject: [PATCH 23/25] small change --- ...ssa___applying_stolen_credentials_via_powersploit_modules.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index 814dece7ee..b13f629a0a 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -88,3 +88,4 @@ tags: risk_score: 90 risk_severity: high security_domain: endpoint + From 87f62f2177cc1e97fd1ef204e72e53d1f511efae Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Tue, 30 Nov 2021 22:23:31 -0600 Subject: [PATCH 24/25] Fixed data model --- .../endpoint/ssa___anomalous_usage_of_archive_tools.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index 01bbe7ab22..493a687f55 100644 --- a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -5,7 +5,7 @@ date: '2021-11-22' author: Patrick Bareiss, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint_Processes description: The following detection identifies the usage of archive tools from the command line. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), @@ -75,4 +75,4 @@ tags: - Processes.parent_process risk_score: 42 security_domain: endpoint - \ No newline at end of file + From 31342ab905b53a33fd1969fd6cfc0b727055a071 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Wed, 1 Dec 2021 13:15:39 -0600 Subject: [PATCH 25/25] Fixed data model --- detections/endpoint/ssa___sdelete_application_execution.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml index 032a4ca12f..93ed90441a 100644 --- a/detections/endpoint/ssa___sdelete_application_execution.yml +++ b/detections/endpoint/ssa___sdelete_application_execution.yml @@ -5,7 +5,7 @@ date: '2021-11-15' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint_Processes description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host. @@ -84,4 +84,4 @@ tags: role: - Child Process - \ No newline at end of file +