From a1837657dee33be674fd36a8e4be3fd5ec346ee2 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 26 Sep 2019 16:34:12 -0700 Subject: [PATCH] updating entities in manifest --- .gitignore | 3 +- ...onnect_to_internet_with_hidden_window.json | 270 +++++++++--------- ...us_powershell_process_encoded_command.json | 260 ++++++++--------- ...process_multiple_suspicious_arguments.json | 4 +- 4 files changed, 272 insertions(+), 265 deletions(-) diff --git a/.gitignore b/.gitignore index daabeb1fb9..eb21a24ea6 100644 --- a/.gitignore +++ b/.gitignore @@ -97,4 +97,5 @@ venv.bak/ # mypy .mypy_cache/ -package/bin/sftp-config.json \ No newline at end of file +package/bin/sftp-config.json +package/default/sftp-config.json \ No newline at end of file diff --git a/detections/malicious_powershell_process_connect_to_internet_with_hidden_window.json b/detections/malicious_powershell_process_connect_to_internet_with_hidden_window.json index b992558565..5b5487915e 100644 --- a/detections/malicious_powershell_process_connect_to_internet_with_hidden_window.json +++ b/detections/malicious_powershell_process_connect_to_internet_with_hidden_window.json @@ -1,140 +1,142 @@ { - "asset_type": "Endpoint", - "confidence": "medium", - "creation_date": "2016-09-18", - "data_metadata": { - "data_models": [ - "Endpoint" - ], - "data_source": [ - "Endpoint Intel" - ], - "providing_technologies": [ - "Carbon Black Response", - "CrowdStrike Falcon", - "Sysmon", - "Tanium", - "Ziften" - ] + "asset_type": "Endpoint", + "confidence": "medium", + "creation_date": "2016-09-18", + "data_metadata": { + "data_models": [ + "Endpoint" + ], + "data_source": [ + "Endpoint Intel" + ], + "providing_technologies": [ + "Carbon Black Response", + "CrowdStrike Falcon", + "Sysmon", + "Tanium", + "Ziften" + ] + }, + "description": "This search looks for PowerShell processes started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet. This combination of command-line options is suspicious because it's overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet.", + "detect": { + "splunk": { + "correlation_rule": { + "notable": { + "nes_fields": "dest, user, process_name", + "rule_description": "The system $dest$ executed a PowerShell process that connects to the Internet with a hidden window.", + "rule_title": "Malicious PowerShell Process detected on $dest$" + }, + "risk": { + "risk_object": "dest", + "risk_object_type": [ + "system" + ], + "risk_score": 75 + }, + "schedule": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m" + }, + "search": "| tstats `summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `ctime(firstTime)`| `ctime(lastTime)` | search process=\"*-Exec*\" process=\"*-WindowStyle*\" process=\"*hidden*\" process=\"*New-Object*\" process=\"*System.Net.WebClient*\"", + "suppress": { + "suppress_fields": "process_name, dest", + "suppress_period": "86400s" + } + } + } + }, + "eli5": "This search looks for PowerShell processes running with specific command-line arguments that indicate that the process will download a file from the Internet without display anything to the user. The search for \"*-Exec*\" is to check and see if the default execution policy for PowerShell is being overridden on the command-line. The search for \"*-WindowStyle*\" and \"*hidden*\" are to see if the window that would normally be displayed will be hidden from the user instead. Finally, the search for \"*New-Object*\" and \"*System.Net.WebClient*\" are there to check to see if a PowerShell object that can be used to download files will be created. This search will return the host, the user the process ran under, the process and it's command-line arguments, the number of times it's seen this process, and the first and last times it saw this process.", + "entities": [ + "dest", + "process_name", + "user" + ], + "how_to_implement": "You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", + "id": "ee18ed37-0802-4268-9435-b3b91aaa18db", + "investigations": [ + { + "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd76", + "name": "Get Authentication Logs For Endpoint", + "type": "splunk" }, - "description": "This search looks for PowerShell processes started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet. This combination of command-line options is suspicious because it's overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet.", - "detect": { - "splunk": { - "correlation_rule": { - "notable": { - "nes_fields": "dest, user, process_name", - "rule_description": "The system $dest$ executed a PowerShell process that connects to the Internet with a hidden window.", - "rule_title": "Malicious PowerShell Process detected on $dest$" - }, - "risk": { - "risk_object": "dest", - "risk_object_type": [ - "system" - ], - "risk_score": 75 - }, - "schedule": { - "cron_schedule": "0 * * * *", - "earliest_time": "-70m@m", - "latest_time": "-10m@m" - }, - "search": "| tstats `summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `ctime(firstTime)`| `ctime(lastTime)` | search process=\"*-Exec*\" process=\"*-WindowStyle*\" process=\"*hidden*\" process=\"*New-Object*\" process=\"*System.Net.WebClient*\"", - "suppress": { - "suppress_fields": "process_name, dest", - "suppress_period": "86400s" - } - } - } + { + "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", + "name": "Get Parent Process Info", + "type": "splunk" }, - "eli5": "This search looks for PowerShell processes running with specific command-line arguments that indicate that the process will download a file from the Internet without display anything to the user. The search for \"*-Exec*\" is to check and see if the default execution policy for PowerShell is being overridden on the command-line. The search for \"*-WindowStyle*\" and \"*hidden*\" are to see if the window that would normally be displayed will be hidden from the user instead. Finally, the search for \"*New-Object*\" and \"*System.Net.WebClient*\" are there to check to see if a PowerShell object that can be used to download files will be created. This search will return the host, the user the process ran under, the process and it's command-line arguments, the number of times it's seen this process, and the first and last times it saw this process.", - "entities": [ - "dest" - ], - "how_to_implement": "You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", - "id": "ee18ed37-0802-4268-9435-b3b91aaa18db", - "investigations": [ - { - "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd76", - "name": "Get Authentication Logs For Endpoint", - "type": "splunk" - }, - { - "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", - "name": "Get Parent Process Info", - "type": "splunk" - }, - { - "id": "fdcfb369-1725-4c24-824a-22972d7f0d55", - "name": "Get Risk Modifiers For User", - "type": "splunk" - }, - { - "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd71", - "name": "Get Process Info", - "type": "splunk" - }, - { - "id": "3d6c3213-5fff-4a1e-b57d-b24c262171e7", - "name": "Get Notable History", - "type": "splunk" - }, - { - "id": "f3fb4d1b-5f33-4b01-b541-c7af9534c242", - "name": "Get Notable Info", - "type": "splunk" - }, - { - "id": "fdcfb369-1725-4c24-824a-22972d7f0d65", - "name": "Get Risk Modifiers For Endpoint", - "type": "splunk" - }, - { - "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd74", - "name": "Get User Information from Identity Table", - "type": "splunk" - } - ], - "known_false_positives": "Legitimate process can have this combination of command-line options, but it's not common.", - "maintainers": [ - { - "company": "Splunk", - "email": "davidd@splunk.com", - "name": "David Dorsey" - } - ], - "mappings": { - "cis20": [ - "CIS 3", - "CIS 7", - "CIS 8" - ], - "kill_chain_phases": [ - "Command and Control", - "Actions on Objectives" - ], - "mitre_attack": [ - "Execution", - "PowerShell", - "Scripting" - ], - "nist": [ - "PR.PT", - "DE.CM", - "PR.IP" - ] + { + "id": "fdcfb369-1725-4c24-824a-22972d7f0d55", + "name": "Get Risk Modifiers For User", + "type": "splunk" }, - "modification_date": "2018-12-03", - "name": "Malicious PowerShell Process - Connect To Internet With Hidden Window", - "original_authors": [ - { - "company": "Splunk", - "email": "davidd@splunk.com", - "name": "David Dorsey" - } + { + "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd71", + "name": "Get Process Info", + "type": "splunk" + }, + { + "id": "3d6c3213-5fff-4a1e-b57d-b24c262171e7", + "name": "Get Notable History", + "type": "splunk" + }, + { + "id": "f3fb4d1b-5f33-4b01-b541-c7af9534c242", + "name": "Get Notable Info", + "type": "splunk" + }, + { + "id": "fdcfb369-1725-4c24-824a-22972d7f0d65", + "name": "Get Risk Modifiers For Endpoint", + "type": "splunk" + }, + { + "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd74", + "name": "Get User Information from Identity Table", + "type": "splunk" + } + ], + "known_false_positives": "Legitimate process can have this combination of command-line options, but it's not common.", + "maintainers": [ + { + "company": "Splunk", + "email": "davidd@splunk.com", + "name": "David Dorsey" + } + ], + "mappings": { + "cis20": [ + "CIS 3", + "CIS 7", + "CIS 8" ], - "references": [], - "security_domain": "endpoint", - "spec_version": 2, - "type": "splunk", - "version": "3.0" + "kill_chain_phases": [ + "Command and Control", + "Actions on Objectives" + ], + "mitre_attack": [ + "Execution", + "PowerShell", + "Scripting" + ], + "nist": [ + "PR.PT", + "DE.CM", + "PR.IP" + ] + }, + "modification_date": "2018-12-03", + "name": "Malicious PowerShell Process - Connect To Internet With Hidden Window", + "original_authors": [ + { + "company": "Splunk", + "email": "davidd@splunk.com", + "name": "David Dorsey" + } + ], + "references": [], + "security_domain": "endpoint", + "spec_version": 2, + "type": "splunk", + "version": "3.0" } diff --git a/detections/malicious_powershell_process_encoded_command.json b/detections/malicious_powershell_process_encoded_command.json index d66ca80c03..7f4804acc8 100644 --- a/detections/malicious_powershell_process_encoded_command.json +++ b/detections/malicious_powershell_process_encoded_command.json @@ -1,135 +1,137 @@ { - "asset_type": "Endpoint", - "confidence": "medium", - "creation_date": "2016-09-18", - "data_metadata": { - "data_models": [ - "Endpoint" - ], - "data_source": [ - "Endpoint Intel" - ], - "providing_technologies": [ - "Carbon Black Response", - "CrowdStrike Falcon", - "Sysmon", - "Tanium", - "Ziften" - ] + "asset_type": "Endpoint", + "confidence": "medium", + "creation_date": "2016-09-18", + "data_metadata": { + "data_models": [ + "Endpoint" + ], + "data_source": [ + "Endpoint Intel" + ], + "providing_technologies": [ + "Carbon Black Response", + "CrowdStrike Falcon", + "Sysmon", + "Tanium", + "Ziften" + ] + }, + "description": "This search looks for PowerShell processes that have encoded the script within the command-line. Malware has been seen using this parameter, as it obfuscates the code and makes it relatively easy to pass a script on the command-line.", + "detect": { + "splunk": { + "correlation_rule": { + "notable": { + "nes_fields": "dest, user, process_name", + "rule_description": "The system $dest$ executed a PowerShell process that has an encoded command on the command-line", + "rule_title": "PowerShell process with an encoded command detected on $dest$" + }, + "risk": { + "risk_object": "dest", + "risk_object_type": [ + "system" + ], + "risk_score": 20 + }, + "schedule": { + "cron_schedule": "0 * * * *", + "earliest_time": "-70m@m", + "latest_time": "-10m@m" + }, + "search": "| tstats `summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `ctime(firstTime)`| `ctime(lastTime)` | search process=*-EncodedCommand* OR process=*-enc*", + "suppress": { + "suppress_fields": "dest, user, process_name", + "suppress_period": "14400s" + } + } + } + }, + "eli5": "This search looks for PowerShell processes that are passing encoded commands on the command-line. The flags \"-EncodedCommand\" and \"-enc\" are two different possible flags that can be used to pass base64 encoded commands to PowerShell. This search will return the host, the user the process ran under, the process and it's command-line arguments, the number of times it's seen this process, and the first and last times it saw this process.", + "entities": [ + "dest", + "process_name", + "user" + ], + "how_to_implement": "You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", + "id": "c4db14d9-7909-48b4-a054-aa14d89dbb19", + "investigations": [ + { + "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd76", + "name": "Get Authentication Logs For Endpoint", + "type": "splunk" }, - "description": "This search looks for PowerShell processes that have encoded the script within the command-line. Malware has been seen using this parameter, as it obfuscates the code and makes it relatively easy to pass a script on the command-line.", - "detect": { - "splunk": { - "correlation_rule": { - "notable": { - "nes_fields": "dest, user, process_name", - "rule_description": "The system $dest$ executed a PowerShell process that has an encoded command on the command-line", - "rule_title": "PowerShell process with an encoded command detected on $dest$" - }, - "risk": { - "risk_object": "dest", - "risk_object_type": [ - "system" - ], - "risk_score": 20 - }, - "schedule": { - "cron_schedule": "0 * * * *", - "earliest_time": "-70m@m", - "latest_time": "-10m@m" - }, - "search": "| tstats `summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `ctime(firstTime)`| `ctime(lastTime)` | search process=*-EncodedCommand* OR process=*-enc*", - "suppress": { - "suppress_fields": "dest, user, process_name", - "suppress_period": "14400s" - } - } - } + { + "id": "fdcfb369-1725-4c24-824a-22972d7f0d55", + "name": "Get Risk Modifiers For User", + "type": "splunk" }, - "eli5": "This search looks for PowerShell processes that are passing encoded commands on the command-line. The flags \"-EncodedCommand\" and \"-enc\" are two different possible flags that can be used to pass base64 encoded commands to PowerShell. This search will return the host, the user the process ran under, the process and it's command-line arguments, the number of times it's seen this process, and the first and last times it saw this process.", - "entities": [ - "dest" - ], - "how_to_implement": "You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", - "id": "c4db14d9-7909-48b4-a054-aa14d89dbb19", - "investigations": [ - { - "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd76", - "name": "Get Authentication Logs For Endpoint", - "type": "splunk" - }, - { - "id": "fdcfb369-1725-4c24-824a-22972d7f0d55", - "name": "Get Risk Modifiers For User", - "type": "splunk" - }, - { - "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd71", - "name": "Get Process Info", - "type": "splunk" - }, - { - "id": "3d6c3213-5fff-4a1e-b57d-b24c262171e7", - "name": "Get Notable History", - "type": "splunk" - }, - { - "id": "f3fb4d1b-5f33-4b01-b541-c7af9534c242", - "name": "Get Notable Info", - "type": "splunk" - }, - { - "id": "fdcfb369-1725-4c24-824a-22972d7f0d65", - "name": "Get Risk Modifiers For Endpoint", - "type": "splunk" - }, - { - "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd74", - "name": "Get User Information from Identity Table", - "type": "splunk" - } - ], - "known_false_positives": "System administrators may use this option, but it's not common.", - "maintainers": [ - { - "company": "Splunk", - "email": "davidd@splunk.com", - "name": "David Dorsey" - } - ], - "mappings": { - "cis20": [ - "CIS 3", - "CIS 7", - "CIS 8" - ], - "kill_chain_phases": [ - "Command and Control", - "Actions on Objectives" - ], - "mitre_attack": [ - "Execution", - "PowerShell", - "Scripting" - ], - "nist": [ - "PR.PT", - "DE.CM", - "PR.IP" - ] + { + "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd71", + "name": "Get Process Info", + "type": "splunk" }, - "modification_date": "2018-12-03", - "name": "Malicious PowerShell Process - Encoded Command", - "original_authors": [ - { - "company": "Splunk", - "email": "davidd@splunk.com", - "name": "David Dorsey" - } + { + "id": "3d6c3213-5fff-4a1e-b57d-b24c262171e7", + "name": "Get Notable History", + "type": "splunk" + }, + { + "id": "f3fb4d1b-5f33-4b01-b541-c7af9534c242", + "name": "Get Notable Info", + "type": "splunk" + }, + { + "id": "fdcfb369-1725-4c24-824a-22972d7f0d65", + "name": "Get Risk Modifiers For Endpoint", + "type": "splunk" + }, + { + "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd74", + "name": "Get User Information from Identity Table", + "type": "splunk" + } + ], + "known_false_positives": "System administrators may use this option, but it's not common.", + "maintainers": [ + { + "company": "Splunk", + "email": "davidd@splunk.com", + "name": "David Dorsey" + } + ], + "mappings": { + "cis20": [ + "CIS 3", + "CIS 7", + "CIS 8" ], - "references": [], - "security_domain": "endpoint", - "spec_version": 2, - "type": "splunk", - "version": "3.0" + "kill_chain_phases": [ + "Command and Control", + "Actions on Objectives" + ], + "mitre_attack": [ + "Execution", + "PowerShell", + "Scripting" + ], + "nist": [ + "PR.PT", + "DE.CM", + "PR.IP" + ] + }, + "modification_date": "2018-12-03", + "name": "Malicious PowerShell Process - Encoded Command", + "original_authors": [ + { + "company": "Splunk", + "email": "davidd@splunk.com", + "name": "David Dorsey" + } + ], + "references": [], + "security_domain": "endpoint", + "spec_version": 2, + "type": "splunk", + "version": "3.0" } diff --git a/detections/malicious_powershell_process_multiple_suspicious_arguments.json b/detections/malicious_powershell_process_multiple_suspicious_arguments.json index 2946f94f54..38357e50dd 100644 --- a/detections/malicious_powershell_process_multiple_suspicious_arguments.json +++ b/detections/malicious_powershell_process_multiple_suspicious_arguments.json @@ -48,7 +48,9 @@ }, "eli5": "This search looks for PowerShell processes that have a number of suspicious flags on the command-line. It is looking for flags are passing encoded commands on the command-line. The flags `-EncodedCommand` and `-enc` are two different possible flags that can be used to pass base64 encoded commands to PowerShell. The `*-Exec*` flag looks to see it the default execution policy of PowerShell is being overridden, while the `*-NonI*` flag tells the PowerShell process that this will be a noninteractive process, so the user doesn't know about the process. This search will return the host, the user the process ran under, the process and it's command-line arguments, the number of times it's seen this process, and the first and last times it saw this process.", "entities": [ - "dest" + "dest", + "process_name", + "user" ], "how_to_implement": "You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "id": "2cdb91d2-542c-497f-b252-be495e71f38c",