mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge branch 'develop' into first_time_seen_cmd_updates
This commit is contained in:
Bhavin Patel
+16
-1
@@ -100,7 +100,12 @@ jobs:
|
||||
- run:
|
||||
name: checkout repo
|
||||
command: |
|
||||
if [ "${CIRCLE_BRANCH}" == "" ]; then
|
||||
if [[ ! -z "${CIRCLE_PULL_REQUEST}" && ! -z "${CIRCLE_PR_NUMBER}" ]]; then
|
||||
git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
|
||||
cd security-content
|
||||
git fetch origin pull/${CIRCLE_PR_NUMBER}/head:${CIRCLE_BRANCH}
|
||||
git checkout ${CIRCLE_BRANCH}
|
||||
elif [ "${CIRCLE_BRANCH}" == "" ]; then
|
||||
git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
|
||||
else
|
||||
git clone --branch ${CIRCLE_BRANCH} https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
|
||||
@@ -122,6 +127,16 @@ jobs:
|
||||
python bin/generate.py --path . --output package -v
|
||||
# make a copy of use_case_lib in order to have ES work :-(
|
||||
cp package/default/use_case_library.conf package/default/analyticstories.conf
|
||||
- run:
|
||||
name: copy lookups .csv files
|
||||
command: |
|
||||
cd security-content
|
||||
# clean up current lookups
|
||||
rm -rf package/lookups
|
||||
mkdir package/lookups
|
||||
# copy over lookups
|
||||
cd lookups
|
||||
cp -rv *.csv ../package/lookups
|
||||
- run:
|
||||
name: update version and build number
|
||||
command: |
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
version: 1
|
||||
update_configs:
|
||||
# Keep python requirements up to date as soon as
|
||||
# new versions are published to pip
|
||||
- package_manager: "python"
|
||||
directory: "/"
|
||||
update_schedule: "live"
|
||||
automerged_updates:
|
||||
- match:
|
||||
dependency_type: "development"
|
||||
# Supported dependency types:
|
||||
# - "development"
|
||||
# - "production"
|
||||
# - "all"
|
||||
update_type: "all"
|
||||
# Supported updates to automerge:
|
||||
# - "security:patch"
|
||||
# SemVer patch update that fixes a known security vulnerability
|
||||
# - "semver:patch"
|
||||
# SemVer patch update, e.g. > 1.x && 1.0.1 to 1.0.3
|
||||
# - "semver:minor"
|
||||
# SemVer minor update, e.g. > 1.x && 2.1.4 to 2.3.1
|
||||
# - "in_range"
|
||||
# matching the version requirement in your package manifest
|
||||
# - "all"
|
||||
- match:
|
||||
dependency_type: "production"
|
||||
update_type: "all"
|
||||
@@ -0,0 +1,11 @@
|
||||
name: Auto approve
|
||||
on: pull_request
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: hmarr/auto-approve-action@v2.0.0
|
||||
if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]'
|
||||
with:
|
||||
github-token: "${{ secrets.GITHUB_TOKEN }}"
|
||||
@@ -64,6 +64,7 @@ def generate_savedsearches_conf(detections, investigations, baselines):
|
||||
output_path = OUTPUT_PATH + "/default/savedsearches.conf"
|
||||
output = template.render(detections=detections, investigations=investigations, baselines=baselines, time=utc_time)
|
||||
with open(output_path, 'w') as f:
|
||||
output = output.encode('ascii', 'ignore').decode('ascii')
|
||||
f.write(output)
|
||||
|
||||
return output_path
|
||||
|
||||
@@ -32,13 +32,15 @@ detect:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail earliest=-1h StartInstances | stats earliest(_time)
|
||||
as earliest latest(_time) as latest by awsRegion| inputlookup append=t previously_seen_aws_regions.csv
|
||||
| stats min(earliest) as earliest max(latest) as latest by awsRegion | outputlookup
|
||||
previously_seen_aws_regions.csv | eval regionStatus=if(earliest >= relative_time(now(),
|
||||
"-1d@d"), "Instance Started in a New Region","Previously Seen Region") | convert
|
||||
security_content_ctime(earliest) security_content_ctime(latest) | where regionStatus="Instance Started in a
|
||||
New Region"
|
||||
search: sourcetype=aws:cloudtrail earliest=-1h StartInstances
|
||||
| stats earliest(_time) as earliest latest(_time) as latest by awsRegion
|
||||
| inputlookup append=t previously_seen_aws_regions.csv
|
||||
| stats min(earliest) as earliest max(latest) as latest by awsRegion
|
||||
| outputlookup previously_seen_aws_regions.csv
|
||||
| eval regionStatus=if(earliest >= relative_time(now(),"-1d@d"), "Instance Started in a New Region","Previously Seen Region")
|
||||
| `security_content_ctime(earliest)`
|
||||
| `security_content_ctime(latest)`
|
||||
| where regionStatus="Instance Started in a New Region"
|
||||
suppress:
|
||||
suppress_fields: awsRegion
|
||||
suppress_period: 14400s
|
||||
|
||||
@@ -29,9 +29,9 @@ detect:
|
||||
- system
|
||||
risk_score: 50
|
||||
macros:
|
||||
- system32_executables
|
||||
- is_windows_system_file
|
||||
lookups:
|
||||
- system32_executables
|
||||
- is_windows_system_file
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
@@ -39,14 +39,14 @@ detect:
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as
|
||||
lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*"
|
||||
Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest
|
||||
Processes.process_name Processes.process_path Processes.process_id | `drop_dm_object_name("Processes")`
|
||||
Processes.process_name Processes.process_id Processes.process_path Processes.parent_process_name Processes.process_hash| `drop_dm_object_name("Processes")`
|
||||
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file`'
|
||||
suppress:
|
||||
suppress_fields: dest,process_name
|
||||
suppress_period: 86400s
|
||||
eli5: This search returns all the processes that are not executing out of the C:\Windows\System32
|
||||
or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up
|
||||
in a table of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64
|
||||
in a table `is_windows_system_file` of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64
|
||||
directory. Any matches are then returned.
|
||||
entities:
|
||||
- dest
|
||||
@@ -98,7 +98,7 @@ mappings:
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
modification_date: '2020-01-21'
|
||||
modification_date: '2020-02-04'
|
||||
name: System Processes Run From Unexpected Locations
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
@@ -108,4 +108,4 @@ references: []
|
||||
security_domain: endpoint
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '4.0'
|
||||
version: '5.0'
|
||||
|
||||
@@ -2008,9 +2008,9 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e
|
||||
|
||||
creation_date = 2017-07-24
|
||||
|
||||
modification_date = 2017-09-10
|
||||
modification_date = 2020-02-04
|
||||
|
||||
version = 1.0
|
||||
version = 1.1
|
||||
|
||||
</div>
|
||||
</div>
|
||||
@@ -2131,9 +2131,9 @@ In the event an unusual process is identified, it is imperative to better unders
|
||||
|
||||
creation_date = 2016-08-09
|
||||
|
||||
modification_date = 2018-11-20
|
||||
modification_date = 2020-02-04
|
||||
|
||||
version = 2.0
|
||||
version = 2.1
|
||||
|
||||
</div>
|
||||
</div>
|
||||
@@ -2962,9 +2962,9 @@ The ability to execute arbitrary commands via the Windows CLI is a primary goal
|
||||
|
||||
creation_date = 2017-10-09
|
||||
|
||||
modification_date = 2017-10-23
|
||||
modification_date = 2020-02-04
|
||||
|
||||
version = 2.0
|
||||
version = 2.1
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -2211,8 +2211,8 @@ Endpoint
|
||||
### Ransomware
|
||||
* id = `cf309d0d-d4aa-4fbb-963d-1e79febd3756`
|
||||
* creation_date = 2017-07-24
|
||||
* modification_date = 2017-09-10
|
||||
* version = 1.0
|
||||
* modification_date = 2020-02-04
|
||||
* version = 1.1
|
||||
* spec_version = 2
|
||||
|
||||
##### Description
|
||||
@@ -2370,8 +2370,8 @@ Network_Traffic
|
||||
### Unusual Processes
|
||||
* id = `f4368e3f-d59f-4192-84f6-748ac5a3ddb6`
|
||||
* creation_date = 2016-08-09
|
||||
* modification_date = 2018-11-20
|
||||
* version = 2.0
|
||||
* modification_date = 2020-02-04
|
||||
* version = 2.1
|
||||
* spec_version = 2
|
||||
|
||||
##### Description
|
||||
@@ -3332,8 +3332,8 @@ Web
|
||||
### Suspicious Command-Line Executions
|
||||
* id = `f4368ddf-d59f-4192-84f6-778ac5a3ffc7`
|
||||
* creation_date = 2017-10-09
|
||||
* modification_date = 2017-10-23
|
||||
* version = 2.0
|
||||
* modification_date = 2020-02-04
|
||||
* version = 2.1
|
||||
* spec_version = 2
|
||||
|
||||
##### Description
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
description: A list of suspicious extensions for email attachments
|
||||
filename: suspicious_email_attachments.csv
|
||||
filename: is_suspicious_file_extension_lookup.csv
|
||||
match_type: WILDCARD(file_name)
|
||||
name: is_suspicious_file_extension_lookup
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
default_match: 'false'
|
||||
description: A list of executable files in Windows\System32
|
||||
filename: system32_executables.csv
|
||||
filename: is_windows_system_file.csv
|
||||
min_matches: 1
|
||||
name: system32_executables
|
||||
name: is_windows_system_file
|
||||
@@ -1,5 +1,5 @@
|
||||
definition: lookup update=true system32_executables filename as process_name
|
||||
definition: lookup update=true is_windows_system_file filename as process_name
|
||||
OUTPUT systemFile | search systemFile=true
|
||||
description: This macro limits the output to process names that are in the Windows
|
||||
System directory
|
||||
name: system32_executables
|
||||
name: is_windows_system_file
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
"id": {
|
||||
"group": null,
|
||||
"name": "DA-ESS-ContentUpdate",
|
||||
"version": "1.0.49"
|
||||
"version": "1.0.50"
|
||||
},
|
||||
"author": [
|
||||
{
|
||||
|
||||
@@ -169,6 +169,7 @@ h3 {
|
||||
|
||||
.kill_chain_tag {
|
||||
background-color: #ed8440;
|
||||
color: #303841;
|
||||
}
|
||||
|
||||
.attack_tag {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security-content
|
||||
# On Date: 2020-01-23T21:55:09 UTC
|
||||
# On Date: 2020-02-06T22:44:25 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -691,9 +691,9 @@ narrative = A traditional security best practice is to control the ports, protoc
|
||||
[Ransomware]
|
||||
category = Malware
|
||||
creation_date = 2017-07-24
|
||||
modification_date = 2017-09-10
|
||||
modification_date = 2020-02-04
|
||||
id = cf309d0d-d4aa-4fbb-963d-1e79febd3756
|
||||
version = 1.0
|
||||
version = 1.1
|
||||
reference = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware", "https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
|
||||
detection_searches = ["ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Windows Event Log Cleared - Rule"]
|
||||
mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["AppInit DLLs", "Authentication Package", "Command and Control", "Commonly Used Port", "Defense Evasion", "Execution", "Exfiltration", "Exfiltration Over Alternative Protocol", "Indicator Removal on Host", "Lateral Movement", "Masquerading", "Persistence", "Registry Run Keys / Start Folder", "Scheduled Task", "Windows Management Instrumentation"], "mitre_technique_id": [], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
|
||||
@@ -891,9 +891,9 @@ The searches in this Analytic Story will monitor your AWS network traffic for ev
|
||||
[Suspicious Command-Line Executions]
|
||||
category = Adversary Tactics
|
||||
creation_date = 2017-10-09
|
||||
modification_date = 2017-10-23
|
||||
modification_date = 2020-02-04
|
||||
id = f4368ddf-d59f-4192-84f6-778ac5a3ffc7
|
||||
version = 2.0
|
||||
version = 2.1
|
||||
reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
|
||||
detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
|
||||
mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["Command-Line Interface", "Defense Evasion", "Execution", "Masquerading", "Persistence", "Scripting"], "mitre_technique_id": [], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
|
||||
@@ -1014,9 +1014,9 @@ narrative = A common attack technique is to infiltrate a cloud instance and make
|
||||
[Unusual Processes]
|
||||
category = Malware
|
||||
creation_date = 2016-08-09
|
||||
modification_date = 2018-11-20
|
||||
modification_date = 2020-02-04
|
||||
id = f4368e3f-d59f-4192-84f6-748ac5a3ddb6
|
||||
version = 2.0
|
||||
version = 2.1
|
||||
reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
|
||||
detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
|
||||
mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["Accessibility Features", "Defense Evasion", "Execution", "Masquerading", "Rundll32"], "mitre_technique_id": [], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security-content
|
||||
# On Date: 2020-01-23T21:55:09 UTC
|
||||
# On Date: 2020-02-06T22:44:25 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -515,8 +515,8 @@ narrative = A traditional security best practice is to control the ports, protoc
|
||||
|
||||
[analytic_story://Ransomware]
|
||||
category = Malware
|
||||
last_updated = 2017-09-10
|
||||
version = 1.0
|
||||
last_updated = 2020-02-04
|
||||
version = 1.1
|
||||
references = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware", "https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
|
||||
maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
|
||||
spec_version = 2
|
||||
@@ -660,8 +660,8 @@ The searches in this Analytic Story will monitor your AWS network traffic for ev
|
||||
|
||||
[analytic_story://Suspicious Command-Line Executions]
|
||||
category = Adversary Tactics
|
||||
last_updated = 2017-10-23
|
||||
version = 2.0
|
||||
last_updated = 2020-02-04
|
||||
version = 2.1
|
||||
references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
|
||||
maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
|
||||
spec_version = 2
|
||||
@@ -748,8 +748,8 @@ narrative = A common attack technique is to infiltrate a cloud instance and make
|
||||
|
||||
[analytic_story://Unusual Processes]
|
||||
category = Malware
|
||||
last_updated = 2018-11-20
|
||||
version = 2.0
|
||||
last_updated = 2020-02-04
|
||||
version = 2.1
|
||||
references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
|
||||
maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
|
||||
spec_version = 2
|
||||
@@ -2585,7 +2585,7 @@ providing_technologies = ["Sysmon"]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
|
||||
explanation = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table `is_windows_system_file` of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
|
||||
how_to_implement = To successfully implement this search you need to ingest details about process execution from your hosts. Specifically, this search requires the process name and the full path to the process executable.
|
||||
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["Defense Evasion", "Masquerading"], "nist": ["PR.PT", "DE.CM"]}
|
||||
known_false_positives = None identified
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
is_configured = false
|
||||
state = enabled
|
||||
state_change_requires_restart = false
|
||||
build = 4127
|
||||
build = 4323
|
||||
|
||||
[triggers]
|
||||
reload.analytic_stories = simple
|
||||
@@ -20,7 +20,7 @@ reload.content-version = simple
|
||||
|
||||
[launcher]
|
||||
author = Splunk
|
||||
version = 1.0.49
|
||||
version = 1.0.50
|
||||
description = Explore the Analytic Stories included with ES Content Updates.
|
||||
|
||||
[ui]
|
||||
|
||||
@@ -1,2 +1,2 @@
|
||||
[content-version]
|
||||
version = 1.0.49
|
||||
version = 1.0.50
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security-content
|
||||
# On Date: 2020-01-23T21:55:09 UTC
|
||||
# On Date: 2020-02-06T22:44:25 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -126,6 +126,10 @@ description = This limits the query fields to domains that are associated with e
|
||||
definition = lookup update=true lookup_rare_process_whitelist_default process as process OUTPUTNEW whitelist | where whitelist="false" | lookup update=true lookup_rare_process_whitelist_local process as process OUTPUT whitelist | where whitelist="false"
|
||||
description = This macro is intended to whitelist processes that have been definied as rare
|
||||
|
||||
[is_windows_system_file]
|
||||
definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
|
||||
description = This macro limits the output to process names that are in the Windows System directory
|
||||
|
||||
[malicious_powershell_process_obfuscation_techniques_output_filter]
|
||||
definition = search *
|
||||
description = Use this macro to add output filters for Malicious PowerShell Process With Obfuscation Techniques.
|
||||
@@ -223,10 +227,6 @@ description = This macro limites the output to file names that have been marked
|
||||
definition = sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype) for Windows Sysmon Logs. Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[system32_executables]
|
||||
definition = lookup update=true system32_executables filename as process_name OUTPUT systemFile | search systemFile=true
|
||||
description = This macro limits the output to process names that are in the Windows System directory
|
||||
|
||||
[system_network_configuration_discovery_tools]
|
||||
definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
|
||||
description = This macro is a list of process that can be used to discover the network configuration
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security-content
|
||||
# On Date: 2020-01-23T21:55:09 UTC
|
||||
# On Date: 2020-02-06T22:44:25 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -721,7 +721,7 @@ quantity = 0
|
||||
realtime_schedule = 0
|
||||
schedule_window = auto
|
||||
is_visible = false
|
||||
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`
|
||||
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`
|
||||
|
||||
[ESCU - Attempt To Stop Security Service - Rule]
|
||||
action.escu = 0
|
||||
@@ -4283,7 +4283,7 @@ quantity = 0
|
||||
realtime_schedule = 0
|
||||
schedule_window = auto
|
||||
is_visible = false
|
||||
search = sourcetype=aws:cloudtrail earliest=-1h StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion| inputlookup append=t previously_seen_aws_regions.csv | stats min(earliest) as earliest max(latest) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | eval regionStatus=if(earliest >= relative_time(now(), "-1d@d"), "Instance Started in a New Region","Previously Seen Region") | convert security_content_ctime(earliest) security_content_ctime(latest) | where regionStatus="Instance Started in a New Region"
|
||||
search = sourcetype=aws:cloudtrail earliest=-1h StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | inputlookup append=t previously_seen_aws_regions.csv | stats min(earliest) as earliest max(latest) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | eval regionStatus=if(earliest >= relative_time(now(),"-1d@d"), "Instance Started in a New Region","Previously Seen Region") | `security_content_ctime(earliest)` | `security_content_ctime(latest)` | where regionStatus="Instance Started in a New Region"
|
||||
|
||||
[ESCU - EC2 Instance Started With Previously Unseen AMI - Rule]
|
||||
action.escu = 0
|
||||
@@ -8223,11 +8223,11 @@ action.escu.enabled = 1
|
||||
description = This search looks for system processes that normally run out of C:\Windows\System32\ or C:\Windows\SysWOW64 that are not run from that location. This can indicate a malicious process that is trying to hide as a legitimate process.
|
||||
action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["Defense Evasion", "Masquerading"], "nist": ["PR.PT", "DE.CM"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
|
||||
action.escu.eli5 = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table `is_windows_system_file` of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
|
||||
action.escu.how_to_implement = To successfully implement this search you need to ingest details about process execution from your hosts. Specifically, this search requires the process name and the full path to the process executable.
|
||||
action.escu.known_false_positives = None identified
|
||||
action.escu.creation_date = 2016-08-24
|
||||
action.escu.modification_date = 2020-01-21
|
||||
action.escu.modification_date = 2020-02-04
|
||||
action.escu.confidence = medium
|
||||
action.escu.full_search_name = ESCU - System Processes Run From Unexpected Locations - Rule
|
||||
action.escu.search_type = detection
|
||||
@@ -8266,7 +8266,7 @@ quantity = 0
|
||||
realtime_schedule = 0
|
||||
schedule_window = auto
|
||||
is_visible = false
|
||||
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest Processes.process_name Processes.process_path Processes.process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file`
|
||||
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest Processes.process_name Processes.process_id Processes.process_path Processes.parent_process_name Processes.process_hash| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file`
|
||||
|
||||
[ESCU - TOR Traffic - Rule]
|
||||
action.escu = 0
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security-content
|
||||
# On Date: 2020-01-23T21:55:09 UTC
|
||||
# On Date: 2020-02-06T22:44:25 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -56,10 +56,16 @@ filename = escu_search_id.csv
|
||||
# description = A placeholder lookup file to hold information for ESCU Usage dashboard
|
||||
|
||||
[is_suspicious_file_extension_lookup]
|
||||
filename = suspicious_email_attachments.csv
|
||||
filename = is_suspicious_file_extension_lookup.csv
|
||||
# description = A list of suspicious extensions for email attachments
|
||||
match_type = WILDCARD(file_name)
|
||||
|
||||
[is_windows_system_file]
|
||||
filename = is_windows_system_file.csv
|
||||
default_match = false
|
||||
# description = A list of executable files in Windows\System32
|
||||
min_matches = 1
|
||||
|
||||
[legit_domains]
|
||||
filename = legit_domains.csv
|
||||
# description = A list of legit domains to be used to whitelist possible phishing sites
|
||||
@@ -194,9 +200,3 @@ default_match = false
|
||||
match_type = WILDCARD(file)
|
||||
min_matches = 1
|
||||
|
||||
[system32_executables]
|
||||
filename = system32_executables.csv
|
||||
default_match = false
|
||||
# description = A list of executable files in Windows\System32
|
||||
min_matches = 1
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security-content
|
||||
# On Date: 2020-01-23T21:55:09 UTC
|
||||
# On Date: 2020-02-06T22:44:25 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -515,8 +515,8 @@ narrative = A traditional security best practice is to control the ports, protoc
|
||||
|
||||
[analytic_story://Ransomware]
|
||||
category = Malware
|
||||
last_updated = 2017-09-10
|
||||
version = 1.0
|
||||
last_updated = 2020-02-04
|
||||
version = 1.1
|
||||
references = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware", "https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
|
||||
maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
|
||||
spec_version = 2
|
||||
@@ -660,8 +660,8 @@ The searches in this Analytic Story will monitor your AWS network traffic for ev
|
||||
|
||||
[analytic_story://Suspicious Command-Line Executions]
|
||||
category = Adversary Tactics
|
||||
last_updated = 2017-10-23
|
||||
version = 2.0
|
||||
last_updated = 2020-02-04
|
||||
version = 2.1
|
||||
references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
|
||||
maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
|
||||
spec_version = 2
|
||||
@@ -748,8 +748,8 @@ narrative = A common attack technique is to infiltrate a cloud instance and make
|
||||
|
||||
[analytic_story://Unusual Processes]
|
||||
category = Malware
|
||||
last_updated = 2018-11-20
|
||||
version = 2.0
|
||||
last_updated = 2020-02-04
|
||||
version = 2.1
|
||||
references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
|
||||
maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
|
||||
spec_version = 2
|
||||
@@ -2585,7 +2585,7 @@ providing_technologies = ["Sysmon"]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
|
||||
explanation = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table `is_windows_system_file` of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
|
||||
how_to_implement = To successfully implement this search you need to ingest details about process execution from your hosts. Specifically, this search requires the process name and the full path to the process executable.
|
||||
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["Defense Evasion", "Masquerading"], "nist": ["PR.PT", "DE.CM"]}
|
||||
known_false_positives = None identified
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
number, name
|
||||
1, Inventory of Authorized and Unauthorized Devices
|
||||
2, Inventory of Authorized and Unauthorized Software
|
||||
3, Secure Configuration of End-User Devices
|
||||
4, Continuous Vulnerability Assessment & Remediation
|
||||
5, Controlled Use of Administrative Privileges
|
||||
6, Maintenance Monitoring and Analysis of Audit Logs
|
||||
7, Email & Web Browser Protections
|
||||
8, Malware Defense
|
||||
9, Limitation & Control of Network Ports-Protocols & Services
|
||||
10, Data Recovery Capability
|
||||
11, Secure Configuration of Network Devices
|
||||
12, Boundary Defense
|
||||
13, Data Protection
|
||||
14, Controlled Access Based on Need to Know
|
||||
15, Wireless Access Control
|
||||
16, Account Monitoring and Control
|
||||
17, Security Skills Assessment and Appropriate Training
|
||||
18, Application Software Security
|
||||
19, Incident Response and Management
|
||||
20, Penetration Tests and Red Team Exercises
|
||||
|
@@ -1 +0,0 @@
|
||||
domain,isValidDomain
|
||||
|
File diff suppressed because it is too large
Load Diff
@@ -1,20 +0,0 @@
|
||||
domain, isLegit
|
||||
amazon.com, True
|
||||
ssl-images-amazon.com, True
|
||||
facebook.com, True
|
||||
xx.fbcdn.net, True
|
||||
github.com, True
|
||||
githubassets.com, True
|
||||
instagram.com, True
|
||||
linkedin.com, True
|
||||
microsoftonline.com, True
|
||||
office.com, True
|
||||
okta.com, True
|
||||
live.com, True
|
||||
protonmail.com, True
|
||||
reddit.com, True
|
||||
redditstatic.com, True
|
||||
twitter.com, True
|
||||
twimg.com, True
|
||||
google.com, True
|
||||
|
||||
|
@@ -1,16 +0,0 @@
|
||||
prohibited_applications,isProhibited
|
||||
winword.exe,prohibited
|
||||
EXCEL.EXE,prohibited
|
||||
OUTLOOK.EXE,prohibited
|
||||
POWERPNT.EXE,prohibited
|
||||
visio.exe,prohibited
|
||||
mspub.exe,prohibited
|
||||
Acrobat.exe,prohibited
|
||||
Acrord32.exe,prohibited
|
||||
chrome.exe,prohibited
|
||||
iexplore.exe,prohibited
|
||||
opera.exe,prohibited
|
||||
firefox.exe,prohibited
|
||||
java.exe,prohibited
|
||||
powershell.exe,prohibited
|
||||
mshta.exe, prohibited
|
||||
|
@@ -1,20 +0,0 @@
|
||||
app,note
|
||||
remcom.exe,ESCU - This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
|
||||
pwdump.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
|
||||
pwdump2.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
|
||||
nc.exe,ESCU - This process is an open source tool used for network communications.
|
||||
wce.exe,ESCU - This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
|
||||
cain.exe,ESCU - This process is associated with a tool used to collect user credentials and execute attacks.
|
||||
nmap.exe,ESCU - This process is an open source network mapping tool used to identify hosts and listening services on a network.
|
||||
kidlogger.exe,ESCU - This process is associated with a tool used to collect keyboard input on a host.
|
||||
isass.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
|
||||
svch0st.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
|
||||
at.exe,ESCU - This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility.
|
||||
getmail.exe,ESCU - This process is seen to be used by attackers to extract email files from host machines.
|
||||
ntdll.exe,ESCU - This process was identified as malicious by DHS Alert TA18-074A.
|
||||
netpass.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
|
||||
WebBrowserPassView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
|
||||
OutlookAddressBookView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
|
||||
mailpv.exe,ESCU - This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
|
||||
NLBrute.exe,ESCU - This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
|
||||
selfdel.exe,ESCU - This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
|
||||
|
@@ -1,7 +0,0 @@
|
||||
process,whitelist
|
||||
splunk-regmon.exe,true
|
||||
winword.exe,true
|
||||
excel.exe,true
|
||||
outlook.exe,true
|
||||
powerpnt.exe,true
|
||||
visio.exe,true
|
||||
|
@@ -1,5 +0,0 @@
|
||||
service,description,category
|
||||
*mpssvc*,Windows Firewall Service,security
|
||||
*wscsvc*,Windows Security Center Service,securty
|
||||
*windefend*,Windows Defender Service,security
|
||||
*sysmon*,Sysmon Driver,security
|
||||
|
@@ -1,9 +0,0 @@
|
||||
process_name,uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default
|
||||
sethc.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
||||
utilman.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
||||
osk.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
||||
magnify.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
||||
narrator.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
||||
displayswitch.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
||||
atbroker.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
|
||||
quser.exe,true,,DHS Report TA18-074A|Unusual Processes,Actions on Objectives,Execution
|
||||
|
+7
-7
@@ -3,16 +3,16 @@ attrs==19.3.0
|
||||
cfgv==2.0.1
|
||||
configparser==4.0.2
|
||||
contextlib2==0.6.0.post1
|
||||
identify==1.4.10
|
||||
importlib-metadata==1.4.0
|
||||
identify==1.4.11
|
||||
importlib-metadata==1.5.0
|
||||
importlib-resources==1.0.2
|
||||
Jinja2==2.10.3
|
||||
Jinja2==2.11.1
|
||||
jsonschema==3.2.0
|
||||
MarkupSafe==1.1.1
|
||||
more-itertools==8.1.0
|
||||
nodeenv==1.3.4
|
||||
more-itertools==8.2.0
|
||||
nodeenv==1.3.5
|
||||
pathlib2==2.3.5
|
||||
pre-commit==1.21.0
|
||||
pre-commit==2.0.1
|
||||
PyYAML==5.3
|
||||
pyrsistent==0.15.7
|
||||
scandir==1.10.0
|
||||
@@ -21,4 +21,4 @@ six==1.14.0
|
||||
toml==0.10.0
|
||||
typing==3.7.4.1
|
||||
virtualenv==16.7.9
|
||||
zipp==2.0.0
|
||||
zipp==2.1.0
|
||||
|
||||
@@ -66,7 +66,7 @@ maintainers:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
modification_date: '2017-09-10'
|
||||
modification_date: '2020-02-04'
|
||||
name: Ransomware
|
||||
narrative: Ransomware is an ever-present risk to the enterprise, wherein an infected
|
||||
host encrypts business-critical data, holding it hostage until the victim pays the
|
||||
@@ -87,4 +87,4 @@ references:
|
||||
- https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html
|
||||
spec_version: 2
|
||||
usecase: Advanced Threat Detection
|
||||
version: '1.0'
|
||||
version: '1.1'
|
||||
|
||||
@@ -51,4 +51,4 @@ references:
|
||||
- https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
|
||||
spec_version: 2
|
||||
usecase: Advanced Threat Detection
|
||||
version: '2.0'
|
||||
version: '2.1'
|
||||
|
||||
@@ -33,7 +33,7 @@ maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-11-20'
|
||||
modification_date: '2020-02-04'
|
||||
name: Unusual Processes
|
||||
narrative: 'Being able to profile a host''s processes within your environment can
|
||||
help you more quickly identify processes that seem out of place when compared to
|
||||
@@ -58,4 +58,4 @@ references:
|
||||
- https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262
|
||||
spec_version: 2
|
||||
usecase: Advanced Threat Detection
|
||||
version: '2.0'
|
||||
version: '2.1'
|
||||
|
||||
Reference in New Issue
Block a user