From 487a87e41fc965b7689430080389ac3bb68d3259 Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Thu, 4 Mar 2021 21:17:38 -0500 Subject: [PATCH 1/5] First pass of tagging --- ...sa___applying_stolen_credentials_via_mimikatz_modules.yml | 2 ++ ...__applying_stolen_credentials_via_powersploit_modules.yml | 2 ++ ...___assess_credential_strength_via_dsinternals_modules.yml | 2 ++ ..._credential_extraction_dsinternals_conversion_modules.yml | 3 +++ .../ssa___credential_extraction_dsinternals_modules.yml | 3 +++ ...ssa___credential_extraction_fgdump_cachedump_s_option.yml | 3 +++ ...ssa___credential_extraction_fgdump_cachedump_v_option.yml | 3 +++ .../ssa___credential_extraction_getaddbaccount_from_dump.yml | 3 +++ .../ssa___credential_extraction_lazagne_command_options.yml | 2 ++ .../ssa___credential_extraction_mimikatz_modules.yml | 3 +++ .../ssa___credential_extraction_ms_debuggers_kernel_peek.yml | 3 +++ .../ssa___credential_extraction_ms_debuggers_z_option.yml | 3 +++ .../ssa___credential_extraction_powersploit_modules.yml | 3 +++ detections/endpoint/ssa___detect_kerberoasting.yml | 2 ++ detections/endpoint/ssa___detect_pass_hash.yml | 2 ++ detections/endpoint/ssa___first_time_seen_cmd_line.yml | 2 ++ ...__illegal_access_user_content_via_powersploit_modules.yml | 2 ++ ...sa___illegal_account_creation_via_powersploit_modules.yml | 2 ++ .../ssa___illegal_log_deletion_via_mimikatz_modules.yml | 2 ++ ...ment_AD_elements_and_policies_via_dsinternals_modules.yml | 2 ++ ...ent_computers_and_AD_elements_via_powersploit_modules.yml | 2 ++ ...ege_elevation_and_persistence_via_powersploit_modules.yml | 3 +++ ...sa___illegal_privilege_elevation_via_mimikatz_modules.yml | 2 ++ ...egal_service_and_process_control_via_mimikatz_modules.yml | 2 ++ ...l_service_and_process_control_via_powersploit_modules.yml | 3 +++ ...ccess_with_stolen_credentials_via_powersploit_modules.yml | 2 ++ .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 5 +++++ .../ssa___rare_parent_process_relationship_lolbas.yml | 2 ++ .../ssa___setting_credentials_via_dsinternals_modules.yml | 2 ++ .../ssa___setting_credentials_via_mimikatz_modules.yml | 2 ++ .../ssa___setting_credentials_via_powersploit_modules.yml | 2 ++ .../ssa___system_process_running_unexpected_location.yml | 2 ++ .../ssa___unusual_lolbas_in_short_period_of_time.yml | 2 ++ detections/endpoint/ssa___unusually_long_command_line.yml | 2 ++ 34 files changed, 82 insertions(+) diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index a9ef52f8a6..dc7c3779b7 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -25,6 +25,8 @@ references: - https://github.com/gentilkiwi/mimikatz - https://adsecurity.org/?p=1275 tags: + analytic_story: + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index ff9570b530..45021bbee9 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -27,6 +27,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index 1928fadc18..ac791a6cf3 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/MichaelGrafnetter/DSInternals tags: + analytic_story: + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index 15a818e898..02bfe04cdc 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -33,6 +33,9 @@ known_false_positives: None identified. references: - https://github.com/MichaelGrafnetter/DSInternals tags: + analytic_story: + - Credential Dumping + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index 6eb4d35391..443405241b 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -34,6 +34,9 @@ known_false_positives: None identified. references: - https://github.com/MichaelGrafnetter/DSInternals tags: + analytic_story: + - Credential Dumping + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 66165baa8a..8ddf9ffa94 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -30,6 +30,9 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in known_false_positives: None identified. references: [] tags: + analytic_story: + - Unusual Processes + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index 6290060a2b..1b0313cc0c 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -28,6 +28,9 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in known_false_positives: None identified. references: [] tags: + analytic_story: + - Unusual Processes + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index 077bfe34eb..99764e36b2 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -26,6 +26,9 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in known_false_positives: None identified. references: [] tags: + analytic_story: + - Credential Dumping + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index 16eccd2dfd..27baf66801 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -24,6 +24,8 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in known_false_positives: None identified. references: [] tags: + analytic_story: + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index ae9272f7b9..db83ecf225 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -29,6 +29,9 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Credential Dumping + - Unusual Processes asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index cb9db98b20..77eec1d770 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -33,6 +33,9 @@ known_false_positives: Although unlikely, using debuggers this way may be indica references: - https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29 tags: + analytic_story: + - Credential Dumping + - Unusual Processes asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index 474b91d093..257d5c7b27 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -29,6 +29,9 @@ known_false_positives: Although unlikely, using debuggers this way may be indica code, not analyze its crash dumps. references: [] tags: + analytic_story: + - Credential Dumping + - Unusual Processes asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index b571a165e0..7880182adf 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -30,6 +30,9 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Credential Dumping + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index 5c68d026ec..b16907613e 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -23,6 +23,8 @@ known_false_positives: Older systems that support kerberos RC4 by default NetApp references: - Initial ESCU implementation by Jose Hernandez and Patrick Bareiss tags: + analytic_story: + - Credential Dumping cis20: - CIS 8 - CIS 16 diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index c454713d1e..e020e8e71d 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -23,6 +23,8 @@ known_false_positives: Legitimate logon activity by authorized NTLM systems may references: - Initial ESCU implementation by Bhavin Patel and Patrick Bareiss tags: + analytic_story: + - Lateral Movement cis20: - CIS 3 - CIS 5 diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 86ef3bd37e..8a904421ad 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -31,6 +31,8 @@ known_false_positives: Legitimate programs can also use command-line arguments t macro to exclude legitimate parent_process_name references: [] tags: + analytic_story: + - Unusual Processes cis20: - CIS 3 - CIS 8 diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index b376126867..e605c0960f 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -27,6 +27,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 957ba2115a..1a4564a88c 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index a60f17bbc7..ae1204212a 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -23,6 +23,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Log Manipulation asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index 336d4e8372..76c9d4967e 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -25,6 +25,8 @@ known_false_positives: None identified. references: - https://github.com/MichaelGrafnetter/DSInternals tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index c85690fd9a..95ccb9251d 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -26,6 +26,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index af57bf40cd..46d307c0c9 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -26,6 +26,9 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Malicious PowerShell + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index abe229cae2..0a2ca29400 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -23,6 +23,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Privilege Escalation asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index 48bc0d341c..347282d793 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -26,6 +26,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Service Abuse asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index 35bcc45b53..458a1ccdb5 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -34,6 +34,9 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Service Abuse + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index 533125e359..78d8fe4cca 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -24,6 +24,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Privilege Escalation asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index b95526d78d..be323b6aed 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -32,6 +32,11 @@ known_false_positives: There are circumstances where an application may legitima the lookup file, as appropriate. references: [] tags: + analytic_story: + - Suspicious Command-Line Executions + - Suspicious MSHTA Activity + - Suspicious Zoom Child Processes + - Sunburst Malware cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml index 1c77e8e1a6..c06bf90ffe 100644 --- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml +++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml @@ -56,6 +56,8 @@ known_false_positives: 'Some custom tools used by admins could be used rarely to ' references: [] tags: + analytic_story: + - Unusual Processes cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index 305ad3a7b3..311810f7cf 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -28,6 +28,8 @@ known_false_positives: None identified. references: - https://github.com/MichaelGrafnetter/DSInternals tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index e41310e82d..4af6413a81 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -23,6 +23,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index 137e20b0e0..d8b7979a7d 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index 00a043d53a..c1643f6dbd 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -231,6 +231,8 @@ how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: None references: [] tags: + analytic_story: + - Windows Defense Evasion Tactics cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml index 3f2f33ae95..d273cdbfd8 100644 --- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -50,6 +50,8 @@ known_false_positives: 'Some administrative tasks may involve multiple use of LO references: - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries tags: + analytic_story: + - Unusual Processes cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml index 6a8e87d1ff..867cb6abcb 100644 --- a/detections/endpoint/ssa___unusually_long_command_line.yml +++ b/detections/endpoint/ssa___unusually_long_command_line.yml @@ -33,6 +33,8 @@ known_false_positives: This detection may flag suspiciously long command lines w Attackers may use this technique to obfuscate their payloads. references: [] tags: + analytic_story: + - Unusual Processes cis20: - CIS 8 kill_chain_phases: From f4a04f55ff0b840425b615763c9950dd4996459f Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Thu, 4 Mar 2021 22:02:25 -0500 Subject: [PATCH 2/5] Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story --- ..._opportunities_via_powersploit_modules.yml | 2 ++ ...roups_policies_via_powersploit_modules.yml | 2 ++ ...e_accounts_groups_via_mimikatz_modules.yml | 2 ++ ...infrastructure_via_powersploit_modules.yml | 2 ++ ...puters_domains_via_powersploit_modules.yml | 2 ++ ...and_use_computers_via_mimikatz_modules.yml | 2 ++ ...ystem_elements_via_powersploit_modules.yml | 2 ++ ...on_and_use_shares_via_mimikatz_modules.yml | 2 ++ ...and_use_shares_via_powersploit_modules.yml | 2 ++ ...n_connectivity_via_powersploit_modules.yml | 2 ++ ...ores_and_services_via_mimikatz_modules.yml | 2 ++ ...efensive_tools_via_powersploit_modules.yml | 2 ++ ..._opportunities_via_powersploit_modules.yml | 2 ++ ...service_hijacking_via_mimikatz_modules.yml | 2 ++ ...sses_and_services_via_mimikatz_modules.yml | 2 ++ stories/windows_discovery_techniques.yml | 25 +++++++++++++++++++ 16 files changed, 55 insertions(+) create mode 100644 stories/windows_discovery_techniques.yml diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index 0b7719dba9..ccd1366fc5 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -35,6 +35,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index 231ab0a12c..e4909636d9 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -44,6 +44,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index 734b7f6ffa..bc2414280b 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -23,6 +23,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index c690611bab..5a1dc87a99 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -34,6 +34,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index 8d367a6176..c4965bde6d 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -27,6 +27,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index b560b3e926..524c41dbee 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index 322a14cd76..c38b8ec4f4 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -29,6 +29,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index 0531d79905..52b742344c 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index 014a52e628..440b14a3fc 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -27,6 +27,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index 00376d8266..f5ec31ffd3 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -28,6 +28,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index e68d1bbf83..59ca2ded68 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -25,6 +25,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index 3144c0201a..cbf2f7434a 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index 2b23aa38ef..4d02192a44 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index a2bfc5c823..44341325ec 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -27,6 +27,8 @@ references: - https://github.com/gentilkiwi/mimikatz - https://en.wikipedia.org/wiki/Microsoft_Detours tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index d388dc0620..af50324fcb 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -23,6 +23,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/stories/windows_discovery_techniques.yml b/stories/windows_discovery_techniques.yml new file mode 100644 index 0000000000..546bba2bad --- /dev/null +++ b/stories/windows_discovery_techniques.yml @@ -0,0 +1,25 @@ +name: Windows Discovery Techniques +id: f7aba570-7d59-11eb-825e-acde48001122 +version: 1 +date: '2021-03-04' +author: Michael Hart, Splunk +type: streaming +description: Monitors for behaviors associated with adversaries discovering objects in the + environment that can be leveraged in the progression of the attack. +narrative: Attackers may not have much if any insight into their target's environment + before the initial compromise. Once a foothold has been established, attackers will + start enumerating objects in the environment (accounts, services, network shares, etc.) + that can be used to achieve their objectives. This Analytic Story provides searches to + help identify activities consistent with adversaries gaining knowledge of compromised + Windows environments. +references: + - https://attack.mitre.org/tactics/TA0007/ + - https://cyberd.us/penetration-testing +tags: + analytic_story: + - Windows Discovery Techniques + category: + - Adversary Tactics + product: + - UEBA for Security Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 3288eb7571064c2f04a97f1613aaada6cd0d6c1f Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Fri, 5 Mar 2021 09:14:13 -0500 Subject: [PATCH 3/5] If there is a story that is only for streaming, and all detections with that story are streaming as well, it will cause an error later in this code --- bin/generate.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bin/generate.py b/bin/generate.py index 7e101fe51f..18150c250e 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -639,7 +639,8 @@ def main(REPO_PATH, OUTPUT_PATH, VERBOSE): baselines = sorted(baselines, key=lambda b: b['name']) detection_path = generate_savedsearches_conf(detections, response_tasks, baselines, deployments, TEMPLATE_PATH, OUTPUT_PATH) - stories = sorted(stories, key=lambda s: s['name']) + # only use ESCU stories to the configuration + stories = sorted(filter(lambda s: s['type'].lower() == 'batch', stories), key=lambda s: s['name']) story_path = generate_analytic_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH) use_case_lib_path = generate_use_case_library_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH) From 037d40575a27f9401f7d6f7d9589735691647055 Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Fri, 5 Mar 2021 10:24:47 -0500 Subject: [PATCH 4/5] Tagging last story --- ...__illegal_account_enable_disable_via_dsinternals_modules.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index 404792b0d6..67cc8de51e 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -23,6 +23,8 @@ known_false_positives: None identified. references: - https://github.com/MichaelGrafnetter/DSInternals tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 From de81557e8326297e12ee277a815c06a825d54c4e Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Fri, 5 Mar 2021 13:33:16 -0500 Subject: [PATCH 5/5] Adding in a newline --- stories/windows_discovery_techniques.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/windows_discovery_techniques.yml b/stories/windows_discovery_techniques.yml index 546bba2bad..8320b3903d 100644 --- a/stories/windows_discovery_techniques.yml +++ b/stories/windows_discovery_techniques.yml @@ -22,4 +22,4 @@ tags: - Adversary Tactics product: - UEBA for Security Cloud - usecase: Advanced Threat Detection \ No newline at end of file + usecase: Advanced Threat Detection