From 6123e7b0eacf710bc3af6c7352698ea07fd5fdba Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 27 Aug 2021 09:48:39 -0700 Subject: [PATCH 1/5] duplicate --- .../endpoint/create_local_admin_accounts_using_net_exe.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index a14fc89726..a92d2b73cc 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -1,7 +1,7 @@ name: Create local admin accounts using net exe id: b89919ed-fe5f-492c-b139-151bb162040e -version: 4 -date: '2020-07-21' +version: 5 +date: '2021-08-27' author: Bhavin Patel, Splunk type: TTP datamodel: @@ -11,8 +11,7 @@ description: This search looks for the creation of local administrator accounts search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe - OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add* - OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest + OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`create_local_admin_accounts_using_net_exe_filter` ' how_to_implement: You must be ingesting data that records process activity from your From 74a25076aa6941c07f4f259236bb6d8def476c2c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 30 Aug 2021 11:47:19 -0700 Subject: [PATCH 2/5] Update create_local_admin_accounts_using_net_exe.yml From 05b10cecabd96e6066894c59b2e96cd82ae4302d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 30 Aug 2021 11:47:43 -0700 Subject: [PATCH 3/5] Update create_local_admin_accounts_using_net_exe.yml --- .../endpoint/create_local_admin_accounts_using_net_exe.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index a92d2b73cc..5774e675f3 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -1,7 +1,7 @@ name: Create local admin accounts using net exe id: b89919ed-fe5f-492c-b139-151bb162040e version: 5 -date: '2021-08-27' +date: '2021-08-28' author: Bhavin Patel, Splunk type: TTP datamodel: From 29c6e20ddb7c4493cf6ab224a5ce532e8a1fe82e Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 30 Aug 2021 13:48:04 -0700 Subject: [PATCH 4/5] detection testing --- .github/workflows/detection-testing.yml | 29 ++++++++++--------- ...ate_local_admin_accounts_using_net_exe.yml | 2 +- 2 files changed, 16 insertions(+), 15 deletions(-) diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml index 241c21d3ec..e3fdfff1cf 100644 --- a/.github/workflows/detection-testing.yml +++ b/.github/workflows/detection-testing.yml @@ -30,16 +30,20 @@ jobs: runs-on: ubuntu-latest environment: Detection-Testing-Approval needs: [validate-tag-if-present] - #Only run when we are pushing to the head of a branch or on a PR. - #This implicitly means that we do not run on a tag - if: startsWith(github.ref, 'refs/heads/') || startsWith(github.ref, 'refs/pull/') steps: - name: Checkout Repo uses: actions/checkout@v2 - with: - ref: 'develop' + + #The following branch name only works (and is only used) for a push + #to a branch. We used a different method for getting the source branch + #from a PR + - name: Get branch and PR required for detection testing main.py + id: vars + run: | + echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" + - name: Install System Packages run: | sudo apt update -qq @@ -58,10 +62,6 @@ jobs: source venv/bin/activate python3 -m pip install -q -r requirements.txt - - name: Get branch and PR required for detection testing main.py - id: vars - run: | - echo ::set-output name=tag::${GITHUB_REF#refs/tags/} #Set up credentials in the environment so that boto will be able to find them - uses: aws-actions/configure-aws-credentials@v1 @@ -80,9 +80,10 @@ jobs: source venv/bin/activate pip install -q -r requirements.txt - if [[ ! -z "${{ github.event.issue.pull_request }}" && ! -z "${{ github.event.issue.number }}" ]]; then - python3 main.py -b develop -pr ${{ github.event.issue.number }} - + if [[ ! -z "${{ github.event.issue.pull_request }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then + echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]" + python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }} else - python3 main.py -b develop - fi + echo "Push from branch [${{ steps.vars.outputs.branch }}]" + python3 main.py -b ${{ steps.vars.outputs.branch }} + fi \ No newline at end of file diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 5774e675f3..4e1f4a476f 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -1,7 +1,7 @@ name: Create local admin accounts using net exe id: b89919ed-fe5f-492c-b139-151bb162040e version: 5 -date: '2021-08-28' +date: '2021-08-29' author: Bhavin Patel, Splunk type: TTP datamodel: From 23dd1e6f6445453e22676b0a3f6a42cf0c0b1a6c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 30 Aug 2021 15:13:16 -0700 Subject: [PATCH 5/5] test --- .github/workflows/detection-testing.yml | 7 ++++++- .../endpoint/create_local_admin_accounts_using_net_exe.yml | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml index e3fdfff1cf..ecc55d38ce 100644 --- a/.github/workflows/detection-testing.yml +++ b/.github/workflows/detection-testing.yml @@ -80,7 +80,12 @@ jobs: source venv/bin/activate pip install -q -r requirements.txt - if [[ ! -z "${{ github.event.issue.pull_request }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then + echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]" + echo "github.event.pull_request.number : [${{ github.event.pull_request.number }}]" + echo "steps.vars.outputs.branch : [${{ steps.vars.outputs.branch }}]" + echo "github.event.pull_request.head.ref: [${{ github.event.pull_request.head.ref }}]" + + if [[ ! -z "${{ github.event.pull_request.head.ref }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]" python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }} else diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 4e1f4a476f..44d1cf8a46 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This search looks for the creation of local administrator accounts using - net.exe. + net.exe . search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe