From 0254c60a28935e21e1fe690a187f4769c72195ac Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 29 Nov 2021 16:50:39 -0500 Subject: [PATCH 01/11] adding detection --- ...ible_lateral_movement_powershell_spawn.yml | 80 +++++++++++++++++++ ...lateral_movement_powershell_spawn.test.yml | 12 +++ 2 files changed, 92 insertions(+) create mode 100644 detections/endpoint/possible_lateral_movement_powershell_spawn.yml create mode 100644 tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml new file mode 100644 index 0000000000..64a275e4aa --- /dev/null +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -0,0 +1,80 @@ +name: Possible Lateral Movement PowerShell Spawn +id: cb909b3e-512b-11ec-aa31-3e22fbd008af +version: 1 +date: '2021-11-29' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic assists with identifying a PowerShell process + spawned as a child or grand child process of commonly abused processes during lateral movement techniques including + `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` and `mmc.exe`. Legitimate Windows + features such as the Service Control Manager, Windows Management Instrumentation, Task Scheduler, + Windows Remote Management and the DCOM protocol can be abused to start a process on a remote endpoint. + Looking for PowerShell spawned out of this processes may reveal a lateral movement attack. + Red Teams and adversaries alike may abuse these services during a breach for lateral movement and remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe OR + Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe OR + Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) + (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) OR + Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Legitimate applications may spawn PowerShell as a child process + of the the identified processes. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1021/003 +- https://attack.mitre.org/techniques/T1021/006/ +- https://attack.mitre.org/techniques/T1047/ +- https://attack.mitre.org/techniques/T1053.005/ +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - Lateral Movement + - Malicious PowerShell + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1021 + - T1021.003 + - T1021.006 + - T1047 + - T1053.005 + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 90 + confidence: 50 + risk_score: 45 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A PowerShell process was spawned as a child process of typically abused processes on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim diff --git a/tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml b/tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml new file mode 100644 index 0000000000..96d82a8249 --- /dev/null +++ b/tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml @@ -0,0 +1,12 @@ +name: Possible Lateral Movement PowerShell Spawn Unit Test +tests: +- name: Possible Lateral Movement PowerShell Spawn + file: endpoint/possible_lateral_movement_powershell_spawn.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 7ea845c9d51b2aadc3b32a2cdde28fd2100f2d25 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 29 Nov 2021 22:12:37 +0000 Subject: [PATCH 02/11] Added detection testing service results inPossible Lateral Movement PowerShell Spawn --- ...ible_lateral_movement_powershell_spawn.yml | 32 +++++++++++-------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 64a275e4aa..7eb8f0ef5a 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -7,20 +7,22 @@ type: TTP datamodel: - Endpoint description: The following analytic assists with identifying a PowerShell process - spawned as a child or grand child process of commonly abused processes during lateral movement techniques including - `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` and `mmc.exe`. Legitimate Windows - features such as the Service Control Manager, Windows Management Instrumentation, Task Scheduler, - Windows Remote Management and the DCOM protocol can be abused to start a process on a remote endpoint. - Looking for PowerShell spawned out of this processes may reveal a lateral movement attack. - Red Teams and adversaries alike may abuse these services during a breach for lateral movement and remote code execution. + spawned as a child or grand child process of commonly abused processes during lateral + movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` + and `mmc.exe`. Legitimate Windows features such as the Service Control Manager, + Windows Management Instrumentation, Task Scheduler, Windows Remote Management and + the DCOM protocol can be abused to start a process on a remote endpoint. Looking + for PowerShell spawned out of this processes may reveal a lateral movement attack. + Red Teams and adversaries alike may abuse these services during a breach for lateral + movement and remote code execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe OR - Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe OR - Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) - (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) OR - Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe + OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe + OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) + (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) + OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -72,9 +74,11 @@ tags: context: - Source:Endpoint - Stage:Lateral Movement - message: A PowerShell process was spawned as a child process of typically abused processes on $dest$ + message: A PowerShell process was spawned as a child process of typically abused + processes on $dest$ observable: - name: dest type: Endpoint role: - Victim + automated_detection_testing: passed From b5783ab849298bd3dce9eafc8e21e3999503be22 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 30 Nov 2021 12:51:43 -0500 Subject: [PATCH 03/11] adding 2 experimental detections --- .../suspicious_scheduled_task_name.yml | 63 ++++++++++++++++++ .../suspicious_windows_service_name.yml | 64 +++++++++++++++++++ 2 files changed, 127 insertions(+) create mode 100644 detections/experimental/endpoint/suspicious_scheduled_task_name.yml create mode 100644 detections/experimental/endpoint/suspicious_windows_service_name.yml diff --git a/detections/experimental/endpoint/suspicious_scheduled_task_name.yml b/detections/experimental/endpoint/suspicious_scheduled_task_name.yml new file mode 100644 index 0000000000..72023a5b7e --- /dev/null +++ b/detections/experimental/endpoint/suspicious_scheduled_task_name.yml @@ -0,0 +1,63 @@ +name: Suspicious Scheduled Task Name +id: 9d22a780-5165-11ec-ad4f-3e22fbd008af +version: 1 +date: '2021-11-29' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following hunting analytic leverages Event ID 4698, `A sheduled task was created`, + to identify the creation of a Scheduled Task with a suspicious, high entropy, Task Name. To achieve this, + this analytc also leverages the `ut_shannon` function from the URL ToolBox Splunk application. + Red teams and adversaries alike may abuse the Task Scheduler to create and start a remote Scheduled Task + and obtain remote code execution. To achieve this goal, tools like Impacket or Crapmapexec, + typically create a Scheduled Task with a random task name on the victim host. This hunting analytic may help + defenders identify Scheduled Tasks created as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` + can be customized by users. The Command field can be used to determine if the task has malicious intent or not. +search: '`wineventlog_security` EventCode=4698 | xmlkv Message +| lookup ut_shannon_lookup word as Task_Name +| where ut_shannon > 3 +| table _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden | `suspicious_scheduled_task_name_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also + required. +known_false_positives: Legitimate applications may use random Scheduled Task names. +references: +- https://attack.mitre.org/techniques/T1053/005/ +- https://splunkbase.splunk.com/app/2734/ +- https://en.wikipedia.org/wiki/Entropy_(information_theory) +tags: + analytic_story: + - Lateral Movement + kill_chain_phases: + - Privilege Escalation + - Lateral Movement + - Persistence + mitre_attack_id: + - T1053 + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - Task_Name + - Description + - Command + security_domain: endpoint + impact: 90 + confidence: 50 + risk_score: 45 + context: + - Source:Endpoint + - Stage:Persistence + - Stage:Lateral Movement + message: 'A windows scheduled task with a suspicious task name was created on $dest$' + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/experimental/endpoint/suspicious_windows_service_name.yml b/detections/experimental/endpoint/suspicious_windows_service_name.yml new file mode 100644 index 0000000000..d926cf9319 --- /dev/null +++ b/detections/experimental/endpoint/suspicious_windows_service_name.yml @@ -0,0 +1,64 @@ +name: Suspicious Windows Service Name +id: 2032a95a-5165-11ec-a2c3-3e22fbd008af +version: 1 +date: '2021-11-29' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following hunting analytic leverages Event ID 7045, `A new service was installed in the system`, + to identify the installation of a Windows Service with a suspicious, high entropy, Service Name. To achieve this, + this analytc also leverages the `ut_shannon` function from the URL ToolBox Splunk application. + Red teams and adversaries alike may abuse the Service Control Manager to create and start a remote Windows Service + and obtain remote code execution. To achieve this goal, some tools like Metasploit, Cobalt Strike and Impacket, + typically create a Windows Service with a random service name on the victim host. This hunting analytic may help + defenders identify Windows Services installed as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` + can be customized by users. The Service_File_Name field can be used to determine if the Windows Service has malicious intent or not. +search: ' `wineventlog_system` EventCode=7045 +| lookup ut_shannon_lookup word as Service_Name +| where ut_shannon > 3 +| table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name | `suspicious_windows_service_name_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints. +known_false_positives: Legitimate applications may use random Windows Service names. +references: +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - Lateral Movement + kill_chain_phases: + - Privilege Escalation + - Lateral Movement + mitre_attack_id: + - T1543 + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ComputerName + - Service_File_Name + - Service_Type + - Service_Name + - Service_Start_Type + security_domain: endpoint + impact: 90 + confidence: 50 + risk_score: 45 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A Windows Service with a suspicious service name was installed on $ComputerName$ + observable: + - name: Service_File_Name + type: Other + role: + - Other + - name: ComputerName + type: Endpoint + role: + - Victim \ No newline at end of file From 918b6803507f44598f4ab814a4f3193ea5d3481c Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 30 Nov 2021 13:20:42 -0500 Subject: [PATCH 04/11] update experimental detection names --- ..._name.yml => randomly_generated_scheduled_task_name.yml} | 6 +++--- ...name.yml => randomly_generated_windows_service_name.yml} | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) rename detections/experimental/endpoint/{suspicious_scheduled_task_name.yml => randomly_generated_scheduled_task_name.yml} (92%) rename detections/experimental/endpoint/{suspicious_windows_service_name.yml => randomly_generated_windows_service_name.yml} (94%) diff --git a/detections/experimental/endpoint/suspicious_scheduled_task_name.yml b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml similarity index 92% rename from detections/experimental/endpoint/suspicious_scheduled_task_name.yml rename to detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml index 72023a5b7e..06fff9f300 100644 --- a/detections/experimental/endpoint/suspicious_scheduled_task_name.yml +++ b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml @@ -1,4 +1,4 @@ -name: Suspicious Scheduled Task Name +name: Randomly Generated Scheduled Task Name id: 9d22a780-5165-11ec-ad4f-3e22fbd008af version: 1 date: '2021-11-29' @@ -14,10 +14,10 @@ description: The following hunting analytic leverages Event ID 4698, `A sheduled typically create a Scheduled Task with a random task name on the victim host. This hunting analytic may help defenders identify Scheduled Tasks created as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` can be customized by users. The Command field can be used to determine if the task has malicious intent or not. -search: '`wineventlog_security` EventCode=4698 | xmlkv Message +search: ' `wineventlog_security` EventCode=4698 | xmlkv Message | lookup ut_shannon_lookup word as Task_Name | where ut_shannon > 3 -| table _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden | `suspicious_scheduled_task_name_filter`' +| table _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden | `randomly_generated_scheduled_task_name_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. diff --git a/detections/experimental/endpoint/suspicious_windows_service_name.yml b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml similarity index 94% rename from detections/experimental/endpoint/suspicious_windows_service_name.yml rename to detections/experimental/endpoint/randomly_generated_windows_service_name.yml index d926cf9319..34d31f4a0d 100644 --- a/detections/experimental/endpoint/suspicious_windows_service_name.yml +++ b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml @@ -1,4 +1,4 @@ -name: Suspicious Windows Service Name +name: Randomly Generated Windows Service Name id: 2032a95a-5165-11ec-a2c3-3e22fbd008af version: 1 date: '2021-11-29' @@ -17,7 +17,7 @@ description: The following hunting analytic leverages Event ID 7045, `A new serv search: ' `wineventlog_system` EventCode=7045 | lookup ut_shannon_lookup word as Service_Name | where ut_shannon > 3 -| table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name | `suspicious_windows_service_name_filter` ' +| table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name | `randomly_generated_windows_service_name_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. From 71410ddb7af005b48ae96ce4b629578e493df733 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 3 Dec 2021 15:58:00 -0500 Subject: [PATCH 05/11] 3 new detections --- ...ible_lateral_movement_powershell_spawn.yml | 2 + ...ces_exe_lolbas_execution_process_spawn.yml | 2 +- .../endpoint/short_lived_scheduled_task.yml | 67 ++++++++++++++++++ ...ost_exe_lolbas_execution_process_spawn.yml | 2 +- ...sve_exe_lolbas_execution_process_spawn.yml | 2 +- ...randomly_generated_scheduled_task_name.yml | 4 +- ...andomly_generated_windows_service_name.yml | 2 +- ..._of_computer_service_tickets_requested.yml | 70 +++++++++++++++++++ ..._remote_endpoint_authentication_events.yml | 70 +++++++++++++++++++ .../short_lived_scheduled_task.test.yml | 12 ++++ 10 files changed, 227 insertions(+), 6 deletions(-) create mode 100644 detections/endpoint/short_lived_scheduled_task.yml create mode 100644 detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml create mode 100644 detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml create mode 100644 tests/endpoint/short_lived_scheduled_task.test.yml diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 7eb8f0ef5a..1d9e2da944 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -43,6 +43,7 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log kill_chain_phases: - Lateral Movement + - Malicious PowerShell mitre_attack_id: - T1021 - T1021.003 @@ -50,6 +51,7 @@ tags: - T1047 - T1053.005 - T1543.003 + - T1059.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index 3e5f40f6d6..f7e9b7d928 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytic identifies `services.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned - as a child processs of `services.exe`. The LOLBAS project documents Windows native + as a child process of `services.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of services.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml new file mode 100644 index 0000000000..f2f216c6f2 --- /dev/null +++ b/detections/endpoint/short_lived_scheduled_task.yml @@ -0,0 +1,67 @@ +name: Short Lived Scheduled Task +id: 6fa31414-546e-11ec-adfa-acde48001122 +version: 1 +date: '2021-12-03' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic leverages Windows Security EventCode 4698, `A scheduled + task was created` and Windows Security EventCode 4699, `A scheduled task was deleted` to identify + scheduled tasks created and deleted in less than 30 seconds. This behavior may represent + a lateral movement attack abusing the Task Scheduler to obtain code execution. + Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution. +search: ' `wineventlog_security` EventCode=4698 OR EventCode=4699 | xmlkv Message +| transaction Task_Name startswith=(EventCode=4698) endswith=(EventCode=4699) +| eval short_lived=case((duration<30),"TRUE") +| search short_lived = TRUE +| table _time, ComputerName, Account_Name, Command, Task_Name, short_lived +| `short_lived_scheduled_task_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also + required. +known_false_positives: Although uncommon, legitimate applications may create and + delete a Scheduled Task within 30 seconds. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1053/005/ +- https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler +tags: + analytic_story: + - Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - ComputerName + - Account_Name + - Task_Name + - Description + - Command + security_domain: endpoint + impact: 90 + confidence: 90 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Persistence + - Stage:Privilege Escalation + - Stage:Lateral Movement + message: 'A windows scheduled task was created and deleted in 30 seconds on $ComputerName$' + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: Command + type: Command + role: + - Target \ No newline at end of file diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index 64011402f9..843441596a 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Task Scheduler and creating a malicious remote scheduled task, the executed command is spawned - as a child processs of `svchost.exe`. The LOLBAS project documents Windows native + as a child process of `svchost.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of svchost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index 98696cc301..bb62d11118 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing Windows Management - Instrumention (WMI), the executed command is spawned as a child processs of `wmiprvse.exe`. + Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of wmiprvse.exe that are part of the LOLBAS project can help defenders identify diff --git a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml index 06fff9f300..fc33ad298c 100644 --- a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml +++ b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml @@ -6,9 +6,9 @@ author: Mauricio Velazco, Splunk type: Hunting datamodel: - Endpoint -description: The following hunting analytic leverages Event ID 4698, `A sheduled task was created`, +description: The following hunting analytic leverages Event ID 4698, `A scheduled task was created`, to identify the creation of a Scheduled Task with a suspicious, high entropy, Task Name. To achieve this, - this analytc also leverages the `ut_shannon` function from the URL ToolBox Splunk application. + this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application. Red teams and adversaries alike may abuse the Task Scheduler to create and start a remote Scheduled Task and obtain remote code execution. To achieve this goal, tools like Impacket or Crapmapexec, typically create a Scheduled Task with a random task name on the victim host. This hunting analytic may help diff --git a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml index 34d31f4a0d..9d51224833 100644 --- a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml +++ b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: The following hunting analytic leverages Event ID 7045, `A new service was installed in the system`, to identify the installation of a Windows Service with a suspicious, high entropy, Service Name. To achieve this, - this analytc also leverages the `ut_shannon` function from the URL ToolBox Splunk application. + this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application. Red teams and adversaries alike may abuse the Service Control Manager to create and start a remote Windows Service and obtain remote code execution. To achieve this goal, some tools like Metasploit, Cobalt Strike and Impacket, typically create a Windows Service with a random service name on the victim host. This hunting analytic may help diff --git a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml new file mode 100644 index 0000000000..7255ea9824 --- /dev/null +++ b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml @@ -0,0 +1,70 @@ +name: Unusual Number of Computer Service Tickets Requested +id: ac3b81c0-52f4-11ec-ac44-acde48001122 +version: 1 +date: '2021-12-01' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following hunting analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, + to identify an unusual number of computer service tickets request from one source. When a domain joined endpoint connects + to a remote endpoint, it first will request a Kerberos Ticket with the computer name as the Service Name. An endpoint + requesting a large number of computer service tickets for different endpoints could represent malicious behavior like + lateral movement, malware staging, reconoissance, etc.\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of service requests. To customize this + analytic, users can try different combinations of the `bucket` span time, the + calculation of the `upperBound` field as well as the Outlier calculation. + This logic can be used for real time security monitoring as well as threat hunting exercises.\ + +search: ' `wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*" +| bucket span=2m _time +| stats dc(Service_Name) AS unique_targets values(Service_Name) as host_targets by _time, Client_Address, Account_Name +| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Client_Address, Account_Name +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0) +| `unusual_number_of_computer_service_tickets_requested_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: An single endpoint requesting a large number of computer service tickets + is not common behavior. Possible false positive scenarios include but are not limited + to vulnerability scanners, administration systeams and missconfigured systems. +references: +- https://attack.mitre.org/techniques/T1078/ +tags: + analytic_story: + - Lateral Movement + kill_chain_phases: + - Reconnaissance + - Exploitation + - Lateral Movement + mitre_attack_id: + - T1078 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Ticket_Options + - Ticket_Encryption_Type + - dest + - service + - service_id + security_domain: endpoint + impact: 70 + confidence: 60 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: + observable: + - name: Client_Address + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml new file mode 100644 index 0000000000..daf51b8e4c --- /dev/null +++ b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml @@ -0,0 +1,70 @@ +name: Unusual Number of Remote Endpoint Authentication Events +id: acb5dc74-5324-11ec-a36d-acde48001122 +version: 1 +date: '2021-12-01' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`, + to identify an unusual number of remote authentication atttemps coming from one source. An endpoint + authenticating to a large number of remote endpoints could represent malicious behavior like + lateral movement, malware staging, reconoissance, etc.\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual high number of authentication events. To customize this + analytic, users can try different combinations of the `bucket` span time, the + calculation of the `upperBound` field as well as the Outlier calculation. + This logic can be used for real time security monitoring as well as threat hunting exercises.\ + +search: ' `wineventlog_security` EventCode=4624 Logon_Type=3 Account_Name!="*$" +| eval Source_Account = mvindex(Account_Name, 1) +| bucket span=2m _time +| stats dc(ComputerName) AS unique_targets values(ComputerName) as target_hosts by _time, Source_Network_Address, Source_Account +| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Source_Network_Address, Source_Account +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0) + `unusual_number_of_remote_endpoint_authentication_events_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers aas well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: An single endpoint authenticating to a large number of hosts + is not common behavior. Possible false positive scenarios include but are not limited + to vulnerability scanners, jump servers and missconfigured systems. +references: +- https://attack.mitre.org/techniques/T1078/ +tags: + analytic_story: + - Lateral Movement + kill_chain_phases: + - Reconnaissance + - Lateral Movement + mitre_attack_id: + - T1078 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Logon_Type + - Caller_Process_Name + - Security_ID + - Account_Name + - ComputerName + security_domain: endpoint + impact: 70 + confidence: 60 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Reconnaissance + - Stage:Lateral Movement + message: + observable: + - name: ComputerName + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/short_lived_scheduled_task.test.yml b/tests/endpoint/short_lived_scheduled_task.test.yml new file mode 100644 index 0000000000..5cc0192b87 --- /dev/null +++ b/tests/endpoint/short_lived_scheduled_task.test.yml @@ -0,0 +1,12 @@ +name: Short Lived Scheduled Task Unit Test +tests: +- name: Short Lived Scheduled Task + file: endpoint/short_lived_scheduled_task.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file From 3cf105d7a6c436bf09a3f27d6bcac29e2b14ff6d Mon Sep 17 00:00:00 2001 From: root Date: Fri, 3 Dec 2021 21:22:38 +0000 Subject: [PATCH 06/11] Added detection testing service results inShort Lived Scheduled Task --- .../endpoint/short_lived_scheduled_task.yml | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml index f2f216c6f2..0f628f47ea 100644 --- a/detections/endpoint/short_lived_scheduled_task.yml +++ b/detections/endpoint/short_lived_scheduled_task.yml @@ -5,24 +5,23 @@ date: '2021-12-03' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic leverages Windows Security EventCode 4698, `A scheduled - task was created` and Windows Security EventCode 4699, `A scheduled task was deleted` to identify - scheduled tasks created and deleted in less than 30 seconds. This behavior may represent - a lateral movement attack abusing the Task Scheduler to obtain code execution. - Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution. -search: ' `wineventlog_security` EventCode=4698 OR EventCode=4699 | xmlkv Message -| transaction Task_Name startswith=(EventCode=4698) endswith=(EventCode=4699) -| eval short_lived=case((duration<30),"TRUE") -| search short_lived = TRUE -| table _time, ComputerName, Account_Name, Command, Task_Name, short_lived -| `short_lived_scheduled_task_filter` ' +description: The following analytic leverages Windows Security EventCode 4698, `A + scheduled task was created` and Windows Security EventCode 4699, `A scheduled task + was deleted` to identify scheduled tasks created and deleted in less than 30 seconds. + This behavior may represent a lateral movement attack abusing the Task Scheduler + to obtain code execution. Red Teams and adversaries alike may abuse the Task Scheduler + for lateral movement and remote code execution. +search: ' `wineventlog_security` EventCode=4698 OR EventCode=4699 | xmlkv Message + | transaction Task_Name startswith=(EventCode=4698) endswith=(EventCode=4699) | + eval short_lived=case((duration<30),"TRUE") | search short_lived = TRUE | table + _time, ComputerName, Account_Name, Command, Task_Name, short_lived | `short_lived_scheduled_task_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. -known_false_positives: Although uncommon, legitimate applications may create and - delete a Scheduled Task within 30 seconds. Filter as needed. +known_false_positives: Although uncommon, legitimate applications may create and delete + a Scheduled Task within 30 seconds. Filter as needed. references: -- https://attack.mitre.org/techniques/T1053/005/ +- https://attack.mitre.org/techniques/T1053/005/ - https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler tags: analytic_story: @@ -55,7 +54,7 @@ tags: - Stage:Persistence - Stage:Privilege Escalation - Stage:Lateral Movement - message: 'A windows scheduled task was created and deleted in 30 seconds on $ComputerName$' + message: A windows scheduled task was created and deleted in 30 seconds on $ComputerName$ observable: - name: dest type: Endpoint @@ -64,4 +63,5 @@ tags: - name: Command type: Command role: - - Target \ No newline at end of file + - Target + automated_detection_testing: passed From 20425018bcd008a63d6a673b9f248c05bbb84792 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 3 Dec 2021 21:12:31 -0500 Subject: [PATCH 07/11] minor fixes --- .../unusual_number_of_computer_service_tickets_requested.yml | 4 ++-- ...nusual_number_of_remote_endpoint_authentication_events.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml index 7255ea9824..7939e23a88 100644 --- a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml +++ b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml @@ -7,10 +7,10 @@ type: Hunting datamodel: - Endpoint description: The following hunting analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, - to identify an unusual number of computer service tickets request from one source. When a domain joined endpoint connects + to identify an unusual number of computer service ticket requests from one source. When a domain joined endpoint connects to a remote endpoint, it first will request a Kerberos Ticket with the computer name as the Service Name. An endpoint requesting a large number of computer service tickets for different endpoints could represent malicious behavior like - lateral movement, malware staging, reconoissance, etc.\ + lateral movement, malware staging, reconnaissance, etc.\ The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of service requests. To customize this diff --git a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml index daf51b8e4c..107f9b059f 100644 --- a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml +++ b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml @@ -7,9 +7,9 @@ type: Hunting datamodel: - Endpoint description: The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`, - to identify an unusual number of remote authentication atttemps coming from one source. An endpoint + to identify an unusual number of remote authentication attempts coming from one source. An endpoint authenticating to a large number of remote endpoints could represent malicious behavior like - lateral movement, malware staging, reconoissance, etc.\ + lateral movement, malware staging, reconnaissance, etc.\ The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual high number of authentication events. To customize this From efd890e2c2a09de3455420283b3a15faf00cd016 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 6 Dec 2021 17:01:58 -0500 Subject: [PATCH 08/11] updating analytic story name --- .../detect_activity_related_to_pass_the_hash_attacks.yml | 2 +- detections/endpoint/detect_psexec_with_accepteula_flag.yml | 2 +- detections/endpoint/detect_renamed_psexec.yml | 2 +- .../executable_file_written_in_administrative_smb_share.yml | 4 ++-- .../impacket_lateral_movement_commandline_parameters.yml | 2 +- ...teractive_session_on_remote_endpoint_with_powershell.yml | 2 +- ...nvestigate_successful_remote_desktop_authentications.yml | 2 +- .../endpoint/mmc_exe_lolbas_execution_process_spawn.yml | 2 +- .../endpoint/possible_lateral_movement_powershell_spawn.yml | 2 +- ...remote_process_instantiation_via_dcom_and_powershell.yml | 2 +- ...s_instantiation_via_dcom_and_powershell_script_block.yml | 2 +- ...emote_process_instantiation_via_winrm_and_powershell.yml | 2 +- ..._instantiation_via_winrm_and_powershell_script_block.yml | 2 +- .../remote_process_instantiation_via_winrm_and_winrs.yml | 2 +- .../endpoint/remote_process_instantiation_via_wmi.yml | 2 +- .../remote_process_instantiation_via_wmi_and_powershell.yml | 2 +- ...ss_instantiation_via_wmi_and_powershell_script_block.yml | 2 +- .../scheduled_task_creation_on_remote_endpoint_using_at.yml | 2 +- .../scheduled_task_initiation_on_remote_endpoint.yml | 2 +- .../endpoint/schtasks_scheduling_job_on_remote_system.yml | 2 +- .../services_exe_lolbas_execution_process_spawn.yml | 2 +- detections/endpoint/short_lived_scheduled_task.yml | 2 +- detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml | 2 +- .../endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml | 2 +- .../endpoint/svchost_exe_lolbas_execution_process_spawn.yml | 2 +- ...windows_service_created_with_suspicious_service_path.yml | 2 +- .../endpoint/windows_service_created_within_public_path.yml | 2 +- .../windows_service_creation_on_remote_endpoint.yml | 2 +- .../windows_service_initiation_on_remote_endpoint.yml | 2 +- .../winevent_scheduled_task_created_within_public_path.yml | 2 +- .../wmiprsve_exe_lolbas_execution_process_spawn.yml | 2 +- .../wsmprovhost_exe_lolbas_execution_process_spawn.yml | 2 +- .../endpoint/randomly_generated_scheduled_task_name.yml | 2 +- .../endpoint/randomly_generated_windows_service_name.yml | 2 +- .../endpoint/remote_desktop_process_running_on_system.yml | 2 +- ...unusual_number_of_computer_service_tickets_requested.yml | 2 +- ...sual_number_of_remote_endpoint_authentication_events.yml | 2 +- .../experimental/network/remote_desktop_network_traffic.yml | 2 +- ...l_movement.yml => active_directory_lateral_movement.yml} | 6 +++--- 39 files changed, 42 insertions(+), 42 deletions(-) rename stories/{lateral_movement.yml => active_directory_lateral_movement.yml} (97%) diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml index 7b38c7b154..d4993baf2c 100644 --- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml @@ -19,7 +19,7 @@ known_false_positives: Legitimate logon activity by authorized NTLM systems may references: [] tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 6b8b7a8286..a8f9c6fc3c 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -36,7 +36,7 @@ tags: - DHS Report TA18-074A - HAFNIUM Group - DarkSide Ransomware - - Lateral Movement + - Active Directory Lateral Movement asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index f3bed31e95..aae0bea823 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -33,7 +33,7 @@ tags: - DHS Report TA18-074A - HAFNIUM Group - DarkSide Ransomware - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 90 context: diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index cea14e9c2d..d4cdc813b6 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: The following analytic identifies executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents - suspicious behavior as its commonly user by tools like like PsExec/PaExec and others + suspicious behavior as its commonly used by tools like like PsExec/PaExec and others to stage service binaries before creating and starting a Windows service on remote endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral movement and remote code execution. The Trickbot malware family also implements @@ -31,7 +31,7 @@ references: - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement - Trickbot automated_detection_testing: passed confidence: 100 diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index a6a80d99ab..bdf9d09c65 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -36,7 +36,7 @@ references: - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/impacket/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml index 58d8c2ef3c..dab421ae05 100644 --- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml +++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml @@ -23,7 +23,7 @@ references: - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2 tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell.log kill_chain_phases: diff --git a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml index adb4eb9517..0ef0b02006 100644 --- a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml +++ b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml @@ -23,7 +23,7 @@ references: [] tags: analytic_story: - Hidden Cobra Malware - - Lateral Movement + - Active Directory Lateral Movement - SamSam Ransomware product: - Splunk Phantom diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml index a16660a08b..6022ea1f71 100644 --- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml @@ -40,7 +40,7 @@ references: - https://lolbas-project.github.io/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 1d9e2da944..b9179b8089 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -37,7 +37,7 @@ references: - https://attack.mitre.org/techniques/T1543/003/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement - Malicious PowerShell dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml index e2661b19df..1f9733240c 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml @@ -27,7 +27,7 @@ references: - https://www.cybereason.com/blog/dcom-lateral-movement-techniques tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml index 488ddda2f7..8ed37d1451 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml @@ -25,7 +25,7 @@ references: - https://www.cybereason.com/blog/dcom-lateral-movement-techniques tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-powershell.log kill_chain_phases: diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml index 9aeb221ca4..b0ad6f4ab7 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml @@ -28,7 +28,7 @@ references: - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml index 56aa9292c0..f3641ee8e6 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml @@ -25,7 +25,7 @@ references: - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell.log kill_chain_phases: diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml index 9f9c31b4f9..10c84238d7 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -27,7 +27,7 @@ references: - https://attack.mitre.org/techniques/T1021/006/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 4a29b6ae73..ea0ab2981e 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -30,7 +30,7 @@ tags: analytic_story: - Ransomware - Suspicious WMI Use - - Lateral Movement + - Active Directory Lateral Movement asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml index 5afc5c14fd..c937a23c27 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml @@ -27,7 +27,7 @@ references: - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml index 7307c4ff74..2c073c1e16 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -25,7 +25,7 @@ references: - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log kill_chain_phases: diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml index 886e19be11..5db178a6db 100644 --- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml @@ -29,7 +29,7 @@ references: - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index 74a2245062..82e8466a4c 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -26,7 +26,7 @@ references: - https://attack.mitre.org/techniques/T1053/005/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 06696828bb..ba117efbda 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -27,7 +27,7 @@ known_false_positives: Administrators may create scheduled tasks on remote syste references: [] tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement - NOBELIUM Group asset_type: Endpoint automated_detection_testing: passed diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index f7e9b7d928..4571e018e1 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -40,7 +40,7 @@ references: - https://lolbas-project.github.io/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml index 0f628f47ea..7caeaf1551 100644 --- a/detections/endpoint/short_lived_scheduled_task.yml +++ b/detections/endpoint/short_lived_scheduled_task.yml @@ -25,7 +25,7 @@ references: - https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log kill_chain_phases: diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml index 510598c50d..8e0af47a9e 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml @@ -48,7 +48,7 @@ references: - https://attack.mitre.org/techniques/T1550/002/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index 7edffc64c4..c7ec2bba52 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -51,7 +51,7 @@ references: - https://attack.mitre.org/techniques/T1550/002/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index 843441596a..db833d1c5d 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -39,7 +39,7 @@ references: - https://lolbas-project.github.io/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement_lolbas/windows-security.log kill_chain_phases: diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 63dfff09af..c3fa2d88f7 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -28,7 +28,7 @@ references: tags: analytic_story: - Clop Ransomware - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 80 context: diff --git a/detections/endpoint/windows_service_created_within_public_path.yml b/detections/endpoint/windows_service_created_within_public_path.yml index c1e2ac529a..e0d2620864 100644 --- a/detections/endpoint/windows_service_created_within_public_path.yml +++ b/detections/endpoint/windows_service_created_within_public_path.yml @@ -26,7 +26,7 @@ references: - https://pentestlab.blog/2020/07/21/lateral-movement-services/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_suspicious_path/windows-system.log kill_chain_phases: diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index ab55d5ce1e..700d76ee96 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -28,7 +28,7 @@ references: - https://attack.mitre.org/techniques/T1543/003/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index 66394e80ff..9d1cf1187e 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -26,7 +26,7 @@ references: - https://attack.mitre.org/techniques/T1543/003/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 0091f8b44b..ff59f2304b 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -47,7 +47,7 @@ tags: - Ransomware - Ryuk Ransomware - IcedID - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index bb62d11118..3e235a979c 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -40,7 +40,7 @@ references: - https://lolbas-project.github.io/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index 9713a3fb68..6555f6e797 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -40,7 +40,7 @@ references: - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon.log kill_chain_phases: diff --git a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml index fc33ad298c..faf9d30857 100644 --- a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml +++ b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml @@ -28,7 +28,7 @@ references: - https://en.wikipedia.org/wiki/Entropy_(information_theory) tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement kill_chain_phases: - Privilege Escalation - Lateral Movement diff --git a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml index 9d51224833..dac69edd69 100644 --- a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml +++ b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml @@ -26,7 +26,7 @@ references: - https://attack.mitre.org/techniques/T1543/003/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement kill_chain_phases: - Privilege Escalation - Lateral Movement diff --git a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml index 512846226c..d9c7c0dda1 100644 --- a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml +++ b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml @@ -28,7 +28,7 @@ references: [] tags: analytic_story: - Hidden Cobra Malware - - Lateral Movement + - Active Directory Lateral Movement asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml index 7939e23a88..0072e766ee 100644 --- a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml +++ b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml @@ -35,7 +35,7 @@ references: - https://attack.mitre.org/techniques/T1078/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement kill_chain_phases: - Reconnaissance - Exploitation diff --git a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml index 107f9b059f..0fc6e072e6 100644 --- a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml +++ b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml @@ -36,7 +36,7 @@ references: - https://attack.mitre.org/techniques/T1078/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement kill_chain_phases: - Reconnaissance - Lateral Movement diff --git a/detections/experimental/network/remote_desktop_network_traffic.yml b/detections/experimental/network/remote_desktop_network_traffic.yml index a3148b01dd..e08cb53592 100644 --- a/detections/experimental/network/remote_desktop_network_traffic.yml +++ b/detections/experimental/network/remote_desktop_network_traffic.yml @@ -32,7 +32,7 @@ tags: - SamSam Ransomware - Ryuk Ransomware - Hidden Cobra Malware - - Lateral Movement + - Active Directory Lateral Movement asset_type: Endpoint cis20: - CIS 3 diff --git a/stories/lateral_movement.yml b/stories/active_directory_lateral_movement.yml similarity index 97% rename from stories/lateral_movement.yml rename to stories/active_directory_lateral_movement.yml index b245f947c7..9ad1c178b5 100644 --- a/stories/lateral_movement.yml +++ b/stories/active_directory_lateral_movement.yml @@ -1,7 +1,7 @@ -name: Lateral Movement +name: Active Directory Lateral Movement id: 399d65dc-1f08-499b-a259-aad9051f38ad -version: 2 -date: '2021-11-23' +version: 3 +date: '2021-12-06' author: David Dorsey, Mauricio Velazco Splunk description: Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose From 648bf1fc6eb2cae72cc79e9dcbdec868f8d765c7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 8 Dec 2021 13:41:04 -0500 Subject: [PATCH 09/11] minor fixes --- .../endpoint/randomly_generated_scheduled_task_name.yml | 4 ++-- .../endpoint/randomly_generated_windows_service_name.yml | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml index faf9d30857..ddb0436bae 100644 --- a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml +++ b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml @@ -13,13 +13,13 @@ description: The following hunting analytic leverages Event ID 4698, `A schedule and obtain remote code execution. To achieve this goal, tools like Impacket or Crapmapexec, typically create a Scheduled Task with a random task name on the victim host. This hunting analytic may help defenders identify Scheduled Tasks created as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` - can be customized by users. The Command field can be used to determine if the task has malicious intent or not. + should be customized by users. The Command field can be used to determine if the task has malicious intent or not. search: ' `wineventlog_security` EventCode=4698 | xmlkv Message | lookup ut_shannon_lookup word as Task_Name | where ut_shannon > 3 | table _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden | `randomly_generated_scheduled_task_name_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also required. known_false_positives: Legitimate applications may use random Scheduled Task names. references: diff --git a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml index dac69edd69..af39d3a77f 100644 --- a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml +++ b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml @@ -13,14 +13,15 @@ description: The following hunting analytic leverages Event ID 7045, `A new serv and obtain remote code execution. To achieve this goal, some tools like Metasploit, Cobalt Strike and Impacket, typically create a Windows Service with a random service name on the victim host. This hunting analytic may help defenders identify Windows Services installed as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` - can be customized by users. The Service_File_Name field can be used to determine if the Windows Service has malicious intent or not. + should be customized by users. The Service_File_Name field can be used to determine if the Windows Service has malicious intent or not. search: ' `wineventlog_system` EventCode=7045 | lookup ut_shannon_lookup word as Service_Name | where ut_shannon > 3 | table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name | `randomly_generated_windows_service_name_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type - from your endpoints. + from your endpoints. The Windows TA as well as the URL ToolBox application are also + required. known_false_positives: Legitimate applications may use random Windows Service names. references: - https://attack.mitre.org/techniques/T1543/003/ From 37732ba1ddc2af9421466d9cf92344d26dfeaf2d Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 9 Dec 2021 11:58:22 -0500 Subject: [PATCH 10/11] Update active_directory_lateral_movement.yml --- stories/active_directory_lateral_movement.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/stories/active_directory_lateral_movement.yml b/stories/active_directory_lateral_movement.yml index 9ad1c178b5..9000730367 100644 --- a/stories/active_directory_lateral_movement.yml +++ b/stories/active_directory_lateral_movement.yml @@ -4,8 +4,9 @@ version: 3 date: '2021-12-06' author: David Dorsey, Mauricio Velazco Splunk description: Detect and investigate tactics, techniques, and procedures around how - attackers move laterally within the enterprise. Because lateral movement can expose - the adversary to detection, it should be an important focus for security analysts. + attackers move laterally within an Active Directory environment. Since lateral movement + is often a necessary step in a breach, it is important for cyber defenders to deploy + detection coverage. narrative: "Once attackers gain a foothold within an enterprise, they will seek to\ \ expand their accesses and leverage techniques that facilitate lateral movement.\ \ Attackers will often spend quite a bit of time and effort moving laterally. Because\ @@ -32,9 +33,9 @@ narrative: "Once attackers gain a foothold within an enterprise, they will seek \ for all processes to ensure that the attackers did not install unauthorized software." references: - https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html -- https://www.youtube.com/watch?v=hVTkkkM9XDg +- http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco tags: - analytic_story: Lateral Movement + analytic_story: Active Directory Lateral Movement category: - Adversary Tactics product: From dc26fb0312551fbbd4e6034c1764b0448f51e03c Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 9 Dec 2021 12:00:49 -0500 Subject: [PATCH 11/11] Update active_directory_lateral_movement.yml --- stories/active_directory_lateral_movement.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/stories/active_directory_lateral_movement.yml b/stories/active_directory_lateral_movement.yml index 9000730367..c54c881974 100644 --- a/stories/active_directory_lateral_movement.yml +++ b/stories/active_directory_lateral_movement.yml @@ -1,7 +1,7 @@ name: Active Directory Lateral Movement id: 399d65dc-1f08-499b-a259-aad9051f38ad version: 3 -date: '2021-12-06' +date: '2021-12-09' author: David Dorsey, Mauricio Velazco Splunk description: Detect and investigate tactics, techniques, and procedures around how attackers move laterally within an Active Directory environment. Since lateral movement @@ -12,9 +12,9 @@ narrative: "Once attackers gain a foothold within an enterprise, they will seek \ Attackers will often spend quite a bit of time and effort moving laterally. Because\ \ lateral movement renders an attacker the most vulnerable to detection, it's an\ \ excellent focus for detection and investigation.\\\nIndications of lateral movement\ - \ can include the abuse of system utilities (such as `psexec.exe`), unauthorized\ - \ use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash,\ - \ or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting\ + \ in an Active Directory network can include the abuse of system utilities (such as `psexec.exe`), unauthorized\ + \ use of remote desktop services, `file/admin$` shares, WMI, PowerShell, Service Control Manager,\ + \ the DCOM protocol, WinRM or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting\ \ lateral movement techniques and look for suspicious activity in and around high-value\ \ strategic network assets, such as Active Directory, which are often considered\ \ the primary target or \"crown jewels\" to a persistent threat actor.\\\nAn adversary\