From b5d3de10f26bcfd24babd5b7a617e81c005b420b Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 6 Apr 2021 14:39:27 -0600 Subject: [PATCH 01/72] AWS --- .../aws_excessive_list_command_usage.yml | 36 ++++++++++++++ .../aws_iam_accessdenied_discovery_events.yml | 47 +++++++++++++++++++ ...aws_iam_assume_role_policy_brute_force.yml | 36 ++++++++++++++ detections/cloud/aws_iam_delete_policy.yml | 38 +++++++++++++++ ...reation_usage_of_access_keys_with_root.yml | 34 ++++++++++++++ .../cloud/aws_iam_failure_group_deletion.yml | 39 +++++++++++++++ detections/cloud/aws_iam_mfa_deactivated.yml | 37 +++++++++++++++ .../cloud/aws_iam_root_account_login.yml | 35 ++++++++++++++ .../aws_iam_successful_group_deletion.yml | 39 +++++++++++++++ ...aws_iam_successful_update_assumed_role.yml | 38 +++++++++++++++ .../aws_excessive_list_command_usage.test.yml | 12 +++++ ...iam_accessdenied_discovery_events.test.yml | 12 +++++ ...am_assume_role_policy_brute_force.test.yml | 12 +++++ tests/cloud/aws_iam_delete_policy.test.yml | 12 +++++ ...on_usage_of_access_keys_with_root.test.yml | 12 +++++ .../aws_iam_failure_group_deletion.test.yml | 12 +++++ tests/cloud/aws_iam_mfa_deactivated.test.yml | 12 +++++ .../cloud/aws_iam_root_account_login.test.yml | 12 +++++ ...aws_iam_successful_group_deletion.test.yml | 12 +++++ ...am_successful_update_assumed_role.test.yml | 12 +++++ 20 files changed, 499 insertions(+) create mode 100644 detections/cloud/aws_excessive_list_command_usage.yml create mode 100644 detections/cloud/aws_iam_accessdenied_discovery_events.yml create mode 100644 detections/cloud/aws_iam_assume_role_policy_brute_force.yml create mode 100644 detections/cloud/aws_iam_delete_policy.yml create mode 100644 detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml create mode 100644 detections/cloud/aws_iam_failure_group_deletion.yml create mode 100644 detections/cloud/aws_iam_mfa_deactivated.yml create mode 100644 detections/cloud/aws_iam_root_account_login.yml create mode 100644 detections/cloud/aws_iam_successful_group_deletion.yml create mode 100644 detections/cloud/aws_iam_successful_update_assumed_role.yml create mode 100644 tests/cloud/aws_excessive_list_command_usage.test.yml create mode 100644 tests/cloud/aws_iam_accessdenied_discovery_events.test.yml create mode 100644 tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml create mode 100644 tests/cloud/aws_iam_delete_policy.test.yml create mode 100644 tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml create mode 100644 tests/cloud/aws_iam_failure_group_deletion.test.yml create mode 100644 tests/cloud/aws_iam_mfa_deactivated.test.yml create mode 100644 tests/cloud/aws_iam_root_account_login.test.yml create mode 100644 tests/cloud/aws_iam_successful_group_deletion.test.yml create mode 100644 tests/cloud/aws_iam_successful_update_assumed_role.test.yml diff --git a/detections/cloud/aws_excessive_list_command_usage.yml b/detections/cloud/aws_excessive_list_command_usage.yml new file mode 100644 index 0000000000..4eb046d039 --- /dev/null +++ b/detections/cloud/aws_excessive_list_command_usage.yml @@ -0,0 +1,36 @@ +name: AWS Excessive List Command Usage +id: d1767712-9650-11eb-a8e6-acde48001122 +version: 1 +date: '2021-04-05' +author: Michael Haag, Splunk +type: batch +datamodel: +description: UPDATE_DESCRIPTION +search: '`cloudtrail` command=list* userIdentity.type=IAMUser +| bucket _time span=1h +| stats count as total min(_time) as firstTime max(_time) as lastTime , dc(command) as list_command, dc(eventSource) as sources values(command) by src_ip, userName, _time +| where total >= 5 and list_command >= 1 and sources >= 1 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_excessive_list_command_usage_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + security_domain: access + diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml new file mode 100644 index 0000000000..4ac01dfcfb --- /dev/null +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -0,0 +1,47 @@ +name: AWS IAM AccessDenied Discovery Events +id: 3e1f1568-9633-11eb-a69c-acde48001122 +version: 1 +date: '2021-04-05' +author: Michael Haag, Splunk +type: batch +datamodel: +description: The following detection identifies excessive AccessDenied events within an hour timeframe +search: '`cloudtrail` errorCode = "AccessDenied" userIdentity.type=IAMUser +| bucket _time span=1h +| stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) by src_ip, userIdentity.arn, _time +| where failures >= 5 and methods >= 1 and sources >= 1 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_iam_accessdenied_discovery_events_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - eventSource + - userAgent + - errorCode + - userIdentity.type + security_domain: access + + index=aws_all errorCode = "AccessDenied" +| bucket _time span=1h +| stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(src) by _time, "userIdentity.type", eventSource, errorMessage,errorCode src_ip, userName +| where failures >= 5 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` \ No newline at end of file diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml new file mode 100644 index 0000000000..49bcd270ef --- /dev/null +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -0,0 +1,36 @@ +name: AWS IAM Assume Role Policy Brute Force +id: f19e09b0-9308-11eb-b7ec-acde48001122 +version: 1 +date: '2021-04-01' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: The following detection identifies any malformed policy document exceptions with a status of `failure`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur. +search: '`cloudtrail` errorCode=MalformedPolicyDocumentException status=failure +| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn +| where count >= 2 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_iam_assume_role_policy_brute_force_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. Set the `where count` greater than a value to identify suspicious activity in your environment. +known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. +references: +- https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html +tags: + analytic_story: [] + dataset: [] + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: [] + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.policyName + security_domain: access \ No newline at end of file diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml new file mode 100644 index 0000000000..141c840ba6 --- /dev/null +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -0,0 +1,38 @@ +name: AWS IAM Delete Policy +id: ec3a9362-92fe-11eb-99d0-acde48001122 +version: 1 +date: '2021-04-01' +author: Michael Haag, Splunk +type: batch +datamodel: +description: The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy. +search: '`cloudtrail` eventName=DeletePolicy +| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn) as policyArn by src eventName eventSource aws_account_id errorCode errorMessage userAgent eventID awsRegion userIdentity.principalId userIdentity.arn +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_iam_delete_policy_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only. +references: +- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html +- https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: [] + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1098 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.policyArn + security_domain: access \ No newline at end of file diff --git a/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml b/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml new file mode 100644 index 0000000000..a7a83c3351 --- /dev/null +++ b/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml @@ -0,0 +1,34 @@ +name: AWS IAM Detect Creation Usage of Access Keys with Root +id: 42528528-9329-11eb-9fe1-acde48001122 +version: 1 +date: '2021-04-01' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: UPDATE_DESCRIPTION +search: '`cloudtrail` eventName IN (CreateKey, CreateAccessKey) userIdentity.userName=root +| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.userName) as username by src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn +| where username=root +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_iam_detect_creation_usage_of_access_keys_with_root_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: [] + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + security_domain: access \ No newline at end of file diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml new file mode 100644 index 0000000000..159bf6bda9 --- /dev/null +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -0,0 +1,39 @@ +name: AWS IAM Failure Group Deletion +id: 723b861a-92eb-11eb-93b8-acde48001122 +version: 1 +date: '2021-04-01' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: This detection identifies the inverse of success. We want to identify when a group is attempting to be deleted, but either access is denied, there is a conflict or there is no group. This is indicative of administrators performing an action, but also could be suspicious behavior occurring. Review parallel IAM events - recently added users, new groups and so forth. +search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode IN (NoSuchEntityException,DeleteConflictException, AccessDenied) +| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName) as group_name by src eventName eventSource aws_account_id errorCode errorMessage userAgent eventID awsRegion userIdentity.principalId user_arn +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_iam_failure_group_deletion_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege). +references: +- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html +- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: [] + kill_chain_phases: + - Privilege Escalation + - Denial of Service + mitre_attack_id: + - T1069.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.groupName + security_domain: identity \ No newline at end of file diff --git a/detections/cloud/aws_iam_mfa_deactivated.yml b/detections/cloud/aws_iam_mfa_deactivated.yml new file mode 100644 index 0000000000..37b6678337 --- /dev/null +++ b/detections/cloud/aws_iam_mfa_deactivated.yml @@ -0,0 +1,37 @@ +name: AWS IAM MFA Deactivated +id: 452972ca-930b-11eb-ba0d-acde48001122 +version: 1 +date: '2021-04-01' +author: Michael Haag, Splunk +type: batch +datamodel: +description: This detection looks for the successful event of MFA being deactivated on an account. +search: '`cloudtrail` errorCode=DeactivateMFADevice status=success +| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` + | `aws_iam_mfa_deactivated_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: False positives should be limited as the ability to disable MFA should be restricted and only used for troubleshooting an account issue. +references: +- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeactivateMFADevice.html +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: [] + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.policyName + security_domain: access \ No newline at end of file diff --git a/detections/cloud/aws_iam_root_account_login.yml b/detections/cloud/aws_iam_root_account_login.yml new file mode 100644 index 0000000000..b9c12958d0 --- /dev/null +++ b/detections/cloud/aws_iam_root_account_login.yml @@ -0,0 +1,35 @@ +name: AWS IAM Root Account Login +id: c2f7330e-9315-11eb-b1d0-acde48001122 +version: 1 +date: '2021-04-01' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: The following detection identifies the use of the account `root` on the given AWS instance. Per AWS best practices, this account should have MFA enabled and not used for day to day activity. +search: '`cloudtrail` eventName=ConsoleLogin eventSource=signin.amazonaws.com userName=root +| stats count min(_time) as firstTime max(_time) as lastTime values(responseElements.ConsoleLogin) as Console_login by src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_iam_root_account_login_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: False positives should be limited as the root account should not be used in day to day activity. The detection may be filtered down based on the `action` field - success / failure. +references: +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: [] + kill_chain_phases: + - Intrusion + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - userAgent + - errorCode + security_domain: access \ No newline at end of file diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml new file mode 100644 index 0000000000..fa120f884a --- /dev/null +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -0,0 +1,39 @@ +name: AWS IAM Successful Group Deletion +id: e776d06c-9267-11eb-819b-acde48001122 +version: 1 +date: '2021-03-31' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner. +search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success +| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName) as group_name by src eventName eventSource aws_account_id errorCode errorMessage userAgent eventID awsRegion userIdentity.principalId user_arn +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_iam_successful_group_deletion_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege). +references: +- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html +- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: [] + kill_chain_phases: + - Denial of Service + - Privilege Escalation + mitre_attack_id: + - T1069.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.groupName + security_domain: identity \ No newline at end of file diff --git a/detections/cloud/aws_iam_successful_update_assumed_role.yml b/detections/cloud/aws_iam_successful_update_assumed_role.yml new file mode 100644 index 0000000000..a81843950d --- /dev/null +++ b/detections/cloud/aws_iam_successful_update_assumed_role.yml @@ -0,0 +1,38 @@ +name: AWS IAM Successful Update Assumed Role +id: 63787a0e-9302-11eb-961a-acde48001122 +version: 1 +date: '2021-04-01' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: The following detection identifies a succesful account assuming a role - receiving access. +search: '`cloudtrail` index="aws-cloudtrail" sourcetype=aws:cloudtrail eventName=UpdateAssumeRolePolicy errorCode=success +| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.roleName) as role by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_iam_successful_update_assumed_role_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to grant role access (least privilege). +references: +- https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAssumeRolePolicy.html +- https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities/ +- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: [] + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: [] + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.roleName + security_domain: access \ No newline at end of file diff --git a/tests/cloud/aws_excessive_list_command_usage.test.yml b/tests/cloud/aws_excessive_list_command_usage.test.yml new file mode 100644 index 0000000000..7d26298829 --- /dev/null +++ b/tests/cloud/aws_excessive_list_command_usage.test.yml @@ -0,0 +1,12 @@ +name: AWS Excessive List Command Usage Unit Test +tests: +- name: AWS Excessive List Command Usage + file: detections/cloud/aws_excessive_list_command_usage.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml b/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml new file mode 100644 index 0000000000..a591a32498 --- /dev/null +++ b/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml @@ -0,0 +1,12 @@ +name: AWS IAM AccessDenied Discovery Events Unit Test +tests: +- name: AWS IAM AccessDenied Discovery Events + file: detections/cloud/aws_iam_accessdenied_discovery_events.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml b/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml new file mode 100644 index 0000000000..68f5d5c276 --- /dev/null +++ b/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml @@ -0,0 +1,12 @@ +name: AWS IAM Assume Role Policy Brute Force Unit Test +tests: +- name: AWS IAM Assume Role Policy Brute Force + file: detections/cloud/aws_iam_assume_role_policy_brute_force.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/cloud/aws_iam_delete_policy.test.yml b/tests/cloud/aws_iam_delete_policy.test.yml new file mode 100644 index 0000000000..ef7a1f2159 --- /dev/null +++ b/tests/cloud/aws_iam_delete_policy.test.yml @@ -0,0 +1,12 @@ +name: AWS IAM Delete Policy Unit Test +tests: +- name: AWS IAM Delete Policy + file: detections/cloud/aws_iam_delete_policy.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml b/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml new file mode 100644 index 0000000000..8066f5b5fa --- /dev/null +++ b/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml @@ -0,0 +1,12 @@ +name: AWS IAM Detect Creation Usage of Access Keys with Root Unit Test +tests: +- name: AWS IAM Detect Creation Usage of Access Keys with Root + file: detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/cloud/aws_iam_failure_group_deletion.test.yml b/tests/cloud/aws_iam_failure_group_deletion.test.yml new file mode 100644 index 0000000000..0fa9fb82f2 --- /dev/null +++ b/tests/cloud/aws_iam_failure_group_deletion.test.yml @@ -0,0 +1,12 @@ +name: AWS IAM Failure Group Deletion Unit Test +tests: +- name: AWS IAM Failure Group Deletion + file: detections/cloud/aws_iam_failure_group_deletion.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/cloud/aws_iam_mfa_deactivated.test.yml b/tests/cloud/aws_iam_mfa_deactivated.test.yml new file mode 100644 index 0000000000..404f1cee6d --- /dev/null +++ b/tests/cloud/aws_iam_mfa_deactivated.test.yml @@ -0,0 +1,12 @@ +name: AWS IAM MFA Deactivated Unit Test +tests: +- name: AWS IAM MFA Deactivated + file: detections/cloud/aws_iam_mfa_deactivated.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/cloud/aws_iam_root_account_login.test.yml b/tests/cloud/aws_iam_root_account_login.test.yml new file mode 100644 index 0000000000..89a575daee --- /dev/null +++ b/tests/cloud/aws_iam_root_account_login.test.yml @@ -0,0 +1,12 @@ +name: AWS IAM Root Account Login Unit Test +tests: +- name: AWS IAM Root Account Login + file: detections/cloud/aws_iam_root_account_login.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/cloud/aws_iam_successful_group_deletion.test.yml b/tests/cloud/aws_iam_successful_group_deletion.test.yml new file mode 100644 index 0000000000..3b0d873af5 --- /dev/null +++ b/tests/cloud/aws_iam_successful_group_deletion.test.yml @@ -0,0 +1,12 @@ +name: AWS IAM Successful Group Deletion Unit Test +tests: +- name: AWS IAM Successful Group Deletion + file: detections/cloud/aws_iam_successful_group_deletion.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/cloud/aws_iam_successful_update_assumed_role.test.yml b/tests/cloud/aws_iam_successful_update_assumed_role.test.yml new file mode 100644 index 0000000000..d0d0f7fdb9 --- /dev/null +++ b/tests/cloud/aws_iam_successful_update_assumed_role.test.yml @@ -0,0 +1,12 @@ +name: AWS IAM Successful Update Assumed Role Unit Test +tests: +- name: AWS IAM Successful Update Assumed Role + file: detections/cloud/aws_iam_successful_update_assumed_role.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 2f5c84460ac1c2cea4de98eb34cda2114b0a4db1 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 8 Apr 2021 14:57:43 -0600 Subject: [PATCH 02/72] TaskService Usage --- ...eduled_task_created_within_public_path.yml | 51 +++++++++++++++++++ ...d_task_created_within_public_path.test.yml | 12 +++++ 2 files changed, 63 insertions(+) create mode 100644 detections/endpoint/winevent_scheduled_task_created_within_public_path.yml create mode 100644 tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml new file mode 100644 index 0000000000..24820b2a5c --- /dev/null +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -0,0 +1,51 @@ +name: WinEvent Scheduled Task Created Within Public Path +id: 5d9c6eee-988c-11eb-8253-acde48001122 +version: 1 +date: '2021-04-08' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed from a user writeable file path.\ + + The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ + + schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ + + The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it's possible a scheduled task is being registered within that process context in memory.\ + + Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review.' +search: '`wineventlog_security` EventCode=4698 + | xmlkv Message + | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\windows\\temp*", "*\\Windows\\Tasks\\*", "*\\appdata\\*") + | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `winevent_scheduled_task_created_within_public_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. +known_false_positives: False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed. +references: + - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ + - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 + - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ + - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN + analytic_story: + - Windows Persistence Techniques + - Ransomware + - Ryuk Ransomware + dataset: [] + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - Task_Name + - Description + - Command + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml new file mode 100644 index 0000000000..50e61ff041 --- /dev/null +++ b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml @@ -0,0 +1,12 @@ +name: WinEvent Scheduled Task Created Within Public Path Unit Test +tests: +- name: WinEvent Scheduled Task Created Within Public Path + file: endpoint/winevent_scheduled_task_created_within_public_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 3d839f0f118040efce3401829c01b8f42c6f782e Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 13 Apr 2021 14:08:45 -0600 Subject: [PATCH 03/72] Updated AWS IAM Detections --- .../aws_excessive_list_command_usage.yml | 33 ++++++++++------- .../aws_iam_accessdenied_discovery_events.yml | 37 ++++++++----------- ...aws_iam_assume_role_policy_brute_force.yml | 8 ++-- detections/cloud/aws_iam_delete_policy.yml | 2 +- ...reation_usage_of_access_keys_with_root.yml | 13 +++---- .../cloud/aws_iam_failure_group_deletion.yml | 2 +- detections/cloud/aws_iam_mfa_deactivated.yml | 4 +- .../cloud/aws_iam_root_account_login.yml | 4 +- .../aws_iam_successful_group_deletion.yml | 4 +- ...aws_iam_successful_update_assumed_role.yml | 2 +- 10 files changed, 54 insertions(+), 55 deletions(-) diff --git a/detections/cloud/aws_excessive_list_command_usage.yml b/detections/cloud/aws_excessive_list_command_usage.yml index 4eb046d039..0d68317c22 100644 --- a/detections/cloud/aws_excessive_list_command_usage.yml +++ b/detections/cloud/aws_excessive_list_command_usage.yml @@ -5,26 +5,26 @@ date: '2021-04-05' author: Michael Haag, Splunk type: batch datamodel: -description: UPDATE_DESCRIPTION -search: '`cloudtrail` command=list* userIdentity.type=IAMUser -| bucket _time span=1h -| stats count as total min(_time) as firstTime max(_time) as lastTime , dc(command) as list_command, dc(eventSource) as sources values(command) by src_ip, userName, _time -| where total >= 5 and list_command >= 1 and sources >= 1 -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `aws_excessive_list_command_usage_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +description: The following detection identifies distict list commands ran against the AWS environment over a 1 hour period of time. The idea is that, if a AWS key is lost/stolen, the adversary will begin to perform many list-* queries against the environment to gather further information about the account. +search: '`cloudtrail` (command = List*) user_type=IAMUser (userAgent!=*.amazonaws.com) + | bucket _time span=1h + | stats count min(_time) as firstTime max(_time) as lastTime , dc(command) as distinct_command_count,values(errorCode) as errorCode values(eventSource) as eventSource values(command) as command values(userAgent) as userAgent by src_ip, userName, _time + | where count >= 10 and distinct_command_count > 1 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_excessive_list_command_usage_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: It is possible ther ewill be false positives based on the count numbers used. Tune accordingly based on IP or user associated. From there, tune the values to set an upper limit for your environment. references: + - https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html tags: analytic_story: - - UPDATE_STORY_NAME - dataset: - - UPDATE_DATASET_URL + - AWS IAM Privilege Escalation + dataset: [] kill_chain_phases: - Reconnaissance mitre_attack_id: - - T1003.002 + - T1580 product: - Splunk Enterprise - Splunk Enterprise Security @@ -32,5 +32,10 @@ tags: - Splunk Security Analytics for AWS required_fields: - _time + - eventName + - errorCode + - command + - eventSource + - userAgent security_domain: access diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index 4ac01dfcfb..44d2a462cf 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -5,26 +5,26 @@ date: '2021-04-05' author: Michael Haag, Splunk type: batch datamodel: -description: The following detection identifies excessive AccessDenied events within an hour timeframe -search: '`cloudtrail` errorCode = "AccessDenied" userIdentity.type=IAMUser -| bucket _time span=1h -| stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) by src_ip, userIdentity.arn, _time -| where failures >= 5 and methods >= 1 and sources >= 1 -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `aws_iam_accessdenied_discovery_events_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +description: The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery events. In these instances, the access is not available with the key stolen therefore these events will be generated. +search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) + | bucket _time span=1h + | stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) by src_ip, userIdentity.arn, _time + | where failures >= 5 and methods >= 1 and sources >= 1 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_iam_accessdenied_discovery_events_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives. references: + - https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/ tags: analytic_story: - - UPDATE_STORY_NAME - dataset: - - UPDATE_DATASET_URL + - AWS IAM Privilege Escalation + dataset: [] kill_chain_phases: - Reconnaissance mitre_attack_id: - - T1003 + - T1580 product: - Splunk Enterprise - Splunk Enterprise Security @@ -37,11 +37,4 @@ tags: - userAgent - errorCode - userIdentity.type - security_domain: access - - index=aws_all errorCode = "AccessDenied" -| bucket _time span=1h -| stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(src) by _time, "userIdentity.type", eventSource, errorMessage,errorCode src_ip, userName -| where failures >= 5 -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` \ No newline at end of file + security_domain: access \ No newline at end of file diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 49bcd270ef..dbb6ef3969 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: batch datamodel: [] description: The following detection identifies any malformed policy document exceptions with a status of `failure`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur. -search: '`cloudtrail` errorCode=MalformedPolicyDocumentException status=failure +search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn | where count >= 2 | `security_content_ctime(firstTime)` @@ -17,11 +17,13 @@ known_false_positives: This detection will require tuning to provide high fideli references: - https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html tags: - analytic_story: [] + analytic_story: + - AWS IAM Privilege Escalation dataset: [] kill_chain_phases: - Privilege Escalation - mitre_attack_id: [] + mitre_attack_id: + - T1580 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 141c840ba6..651b132351 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -18,7 +18,7 @@ references: - https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html tags: analytic_story: - - UPDATE_STORY_NAME + - AWS IAM Privilege Escalation dataset: [] kill_chain_phases: - Privilege Escalation diff --git a/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml b/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml index a7a83c3351..ab97353fe2 100644 --- a/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml +++ b/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml @@ -5,25 +5,24 @@ date: '2021-04-01' author: Michael Haag, Splunk type: batch datamodel: [] -description: UPDATE_DESCRIPTION -search: '`cloudtrail` eventName IN (CreateKey, CreateAccessKey) userIdentity.userName=root -| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.userName) as username by src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn -| where username=root +description: THe following detection is aimed at detecting the Root user account creating keys. This is generally not an activity that would be performed after the Root account is locked down. +search: '`cloudtrail` eventName IN (CreateKey, CreateAccessKey) userName=root +| stats count min(_time) as firstTime max(_time) as lastTime values(userName) by src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_detect_creation_usage_of_access_keys_with_root_filter`' how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +known_false_positives: Using the Root account for day to day activity is against best practices. Once Root is no longer used or needed for day to day operations, begin monitoring for usage. references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html tags: analytic_story: - - UPDATE_STORY_NAME + - AWS IAM Privilege Escalation dataset: [] kill_chain_phases: - Privilege Escalation mitre_attack_id: - - T + - T1078.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index 159bf6bda9..c6f02d6a94 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -18,7 +18,7 @@ references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html tags: analytic_story: - - UPDATE_STORY_NAME + - AWS IAM Privilege Escalation dataset: [] kill_chain_phases: - Privilege Escalation diff --git a/detections/cloud/aws_iam_mfa_deactivated.yml b/detections/cloud/aws_iam_mfa_deactivated.yml index 37b6678337..c0e593b9c2 100644 --- a/detections/cloud/aws_iam_mfa_deactivated.yml +++ b/detections/cloud/aws_iam_mfa_deactivated.yml @@ -17,12 +17,12 @@ references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeactivateMFADevice.html tags: analytic_story: - - UPDATE_STORY_NAME + - AWS IAM Privilege Escalation dataset: [] kill_chain_phases: - Privilege Escalation mitre_attack_id: - - T1003.002 + - T1078.004 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/aws_iam_root_account_login.yml b/detections/cloud/aws_iam_root_account_login.yml index b9c12958d0..f5b682f2b1 100644 --- a/detections/cloud/aws_iam_root_account_login.yml +++ b/detections/cloud/aws_iam_root_account_login.yml @@ -16,12 +16,12 @@ known_false_positives: False positives should be limited as the root account sho references: tags: analytic_story: - - UPDATE_STORY_NAME + - AWS IAM Privilege Escalation dataset: [] kill_chain_phases: - Intrusion mitre_attack_id: - - T1003.002 + - T1078.004 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index fa120f884a..1dd2b21fd3 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -7,7 +7,7 @@ type: batch datamodel: [] description: The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner. search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success -| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName) as group_name by src eventName eventSource aws_account_id errorCode errorMessage userAgent eventID awsRegion userIdentity.principalId user_arn +| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName) by src eventName eventSource errorCode user_agent awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_successful_group_deletion_filter`' @@ -18,7 +18,7 @@ references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html tags: analytic_story: - - UPDATE_STORY_NAME + - AWS IAM Privilege Escalation dataset: [] kill_chain_phases: - Denial of Service diff --git a/detections/cloud/aws_iam_successful_update_assumed_role.yml b/detections/cloud/aws_iam_successful_update_assumed_role.yml index a81843950d..e57e40a266 100644 --- a/detections/cloud/aws_iam_successful_update_assumed_role.yml +++ b/detections/cloud/aws_iam_successful_update_assumed_role.yml @@ -19,7 +19,7 @@ references: - https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ tags: analytic_story: - - UPDATE_STORY_NAME + - AWS IAM Privilege Escalation dataset: [] kill_chain_phases: - Privilege Escalation From 8de6aa31a977166ad90ae60a9a67f5a5de1f4360 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 13 Apr 2021 14:11:56 -0600 Subject: [PATCH 04/72] AWS Updates --- detections/cloud/aws_iam_assume_role_policy_brute_force.yml | 2 +- detections/cloud/aws_iam_delete_policy.yml | 2 +- .../aws_iam_detect_creation_usage_of_access_keys_with_root.yml | 2 +- detections/cloud/aws_iam_failure_group_deletion.yml | 2 +- detections/cloud/aws_iam_mfa_deactivated.yml | 2 +- detections/cloud/aws_iam_root_account_login.yml | 2 +- detections/cloud/aws_iam_successful_group_deletion.yml | 2 +- detections/cloud/aws_iam_successful_update_assumed_role.yml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index dbb6ef3969..93fea404cd 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: batch datamodel: [] description: The following detection identifies any malformed policy document exceptions with a status of `failure`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur. -search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure +search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn | where count >= 2 | `security_content_ctime(firstTime)` diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 651b132351..6471ba500e 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: batch datamodel: description: The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy. -search: '`cloudtrail` eventName=DeletePolicy +search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn) as policyArn by src eventName eventSource aws_account_id errorCode errorMessage userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml b/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml index ab97353fe2..38a56ed83e 100644 --- a/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml +++ b/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: batch datamodel: [] description: THe following detection is aimed at detecting the Root user account creating keys. This is generally not an activity that would be performed after the Root account is locked down. -search: '`cloudtrail` eventName IN (CreateKey, CreateAccessKey) userName=root +search: '`cloudtrail` eventName IN (CreateKey, CreateAccessKey) userName=root (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(userName) by src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index c6f02d6a94..5e1c9d02c8 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: batch datamodel: [] description: This detection identifies the inverse of success. We want to identify when a group is attempting to be deleted, but either access is denied, there is a conflict or there is no group. This is indicative of administrators performing an action, but also could be suspicious behavior occurring. Review parallel IAM events - recently added users, new groups and so forth. -search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode IN (NoSuchEntityException,DeleteConflictException, AccessDenied) +search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName) as group_name by src eventName eventSource aws_account_id errorCode errorMessage userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/aws_iam_mfa_deactivated.yml b/detections/cloud/aws_iam_mfa_deactivated.yml index c0e593b9c2..7c670f6920 100644 --- a/detections/cloud/aws_iam_mfa_deactivated.yml +++ b/detections/cloud/aws_iam_mfa_deactivated.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: batch datamodel: description: This detection looks for the successful event of MFA being deactivated on an account. -search: '`cloudtrail` errorCode=DeactivateMFADevice status=success +search: '`cloudtrail` errorCode=DeactivateMFADevice status=success (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/aws_iam_root_account_login.yml b/detections/cloud/aws_iam_root_account_login.yml index f5b682f2b1..e066f2c42b 100644 --- a/detections/cloud/aws_iam_root_account_login.yml +++ b/detections/cloud/aws_iam_root_account_login.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: batch datamodel: [] description: The following detection identifies the use of the account `root` on the given AWS instance. Per AWS best practices, this account should have MFA enabled and not used for day to day activity. -search: '`cloudtrail` eventName=ConsoleLogin eventSource=signin.amazonaws.com userName=root +search: '`cloudtrail` eventName=ConsoleLogin eventSource=signin.amazonaws.com userName=root (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(responseElements.ConsoleLogin) as Console_login by src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 1dd2b21fd3..c7773c4965 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: batch datamodel: [] description: The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner. -search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success +search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName) by src eventName eventSource errorCode user_agent awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/aws_iam_successful_update_assumed_role.yml b/detections/cloud/aws_iam_successful_update_assumed_role.yml index e57e40a266..b9179059dd 100644 --- a/detections/cloud/aws_iam_successful_update_assumed_role.yml +++ b/detections/cloud/aws_iam_successful_update_assumed_role.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: batch datamodel: [] description: The following detection identifies a succesful account assuming a role - receiving access. -search: '`cloudtrail` index="aws-cloudtrail" sourcetype=aws:cloudtrail eventName=UpdateAssumeRolePolicy errorCode=success +search: '`cloudtrail` index="aws-cloudtrail" sourcetype=aws:cloudtrail eventName=UpdateAssumeRolePolicy errorCode=success (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.roleName) as role by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 8a81aee71b927bdeb8299bd061ca6cb194917555 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 14 Apr 2021 21:10:46 -0600 Subject: [PATCH 05/72] AWS Detections --- .../aws_excessive_list_command_usage.yml | 2 +- .../aws_iam_accessdenied_discovery_events.yml | 2 +- ...aws_iam_assume_role_policy_brute_force.yml | 2 + ...reation_usage_of_access_keys_with_root.yml | 5 +++ .../cloud/aws_iam_failure_group_deletion.yml | 2 +- detections/cloud/aws_iam_mfa_deactivated.yml | 2 +- .../cloud/aws_iam_root_account_login.yml | 1 + .../aws_iam_successful_group_deletion.yml | 1 + ...aws_iam_successful_update_assumed_role.yml | 38 ------------------- .../aws_excessive_list_command_usage.test.yml | 11 +++--- ...iam_accessdenied_discovery_events.test.yml | 11 +++--- ...am_assume_role_policy_brute_force.test.yml | 11 +++--- tests/cloud/aws_iam_delete_policy.test.yml | 11 +++--- ...on_usage_of_access_keys_with_root.test.yml | 11 +++--- .../aws_iam_failure_group_deletion.test.yml | 11 +++--- tests/cloud/aws_iam_mfa_deactivated.test.yml | 2 +- .../cloud/aws_iam_root_account_login.test.yml | 11 +++--- ...aws_iam_successful_group_deletion.test.yml | 11 +++--- ...am_successful_update_assumed_role.test.yml | 12 ------ 19 files changed, 62 insertions(+), 95 deletions(-) delete mode 100644 detections/cloud/aws_iam_successful_update_assumed_role.yml delete mode 100644 tests/cloud/aws_iam_successful_update_assumed_role.test.yml diff --git a/detections/cloud/aws_excessive_list_command_usage.yml b/detections/cloud/aws_excessive_list_command_usage.yml index 0d68317c22..ccf0412c51 100644 --- a/detections/cloud/aws_excessive_list_command_usage.yml +++ b/detections/cloud/aws_excessive_list_command_usage.yml @@ -4,7 +4,7 @@ version: 1 date: '2021-04-05' author: Michael Haag, Splunk type: batch -datamodel: +datamodel: [] description: The following detection identifies distict list commands ran against the AWS environment over a 1 hour period of time. The idea is that, if a AWS key is lost/stolen, the adversary will begin to perform many list-* queries against the environment to gather further information about the account. search: '`cloudtrail` (command = List*) user_type=IAMUser (userAgent!=*.amazonaws.com) | bucket _time span=1h diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index 44d2a462cf..d8b8657e4e 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -4,7 +4,7 @@ version: 1 date: '2021-04-05' author: Michael Haag, Splunk type: batch -datamodel: +datamodel: [] description: The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery events. In these instances, the access is not available with the key stolen therefore these events will be generated. search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) | bucket _time span=1h diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 93fea404cd..139ef9838e 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -15,6 +15,7 @@ search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failur how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. Set the `where count` greater than a value to identify suspicious activity in your environment. known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. references: +- https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities - https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html tags: analytic_story: @@ -24,6 +25,7 @@ tags: - Privilege Escalation mitre_attack_id: - T1580 + - T1110 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml b/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml index 38a56ed83e..e2a9cc748e 100644 --- a/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml +++ b/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml @@ -30,4 +30,9 @@ tags: - Splunk Security Analytics for AWS required_fields: - _time + - eventName + - userAgent + - errorCode + - eventSource + - user_arn security_domain: access \ No newline at end of file diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index 5e1c9d02c8..16d3e72343 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -24,7 +24,7 @@ tags: - Privilege Escalation - Denial of Service mitre_attack_id: - - T1069.003 + - T1098 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/aws_iam_mfa_deactivated.yml b/detections/cloud/aws_iam_mfa_deactivated.yml index 7c670f6920..2f5507ea03 100644 --- a/detections/cloud/aws_iam_mfa_deactivated.yml +++ b/detections/cloud/aws_iam_mfa_deactivated.yml @@ -4,7 +4,7 @@ version: 1 date: '2021-04-01' author: Michael Haag, Splunk type: batch -datamodel: +datamodel: [] description: This detection looks for the successful event of MFA being deactivated on an account. search: '`cloudtrail` errorCode=DeactivateMFADevice status=success (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn diff --git a/detections/cloud/aws_iam_root_account_login.yml b/detections/cloud/aws_iam_root_account_login.yml index e066f2c42b..38052dbe3b 100644 --- a/detections/cloud/aws_iam_root_account_login.yml +++ b/detections/cloud/aws_iam_root_account_login.yml @@ -14,6 +14,7 @@ search: '`cloudtrail` eventName=ConsoleLogin eventSource=signin.amazonaws.com us how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. known_false_positives: False positives should be limited as the root account should not be used in day to day activity. The detection may be filtered down based on the `action` field - success / failure. references: +- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html tags: analytic_story: - AWS IAM Privilege Escalation diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index c7773c4965..42db31bac7 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -25,6 +25,7 @@ tags: - Privilege Escalation mitre_attack_id: - T1069.003 + - T1098 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/aws_iam_successful_update_assumed_role.yml b/detections/cloud/aws_iam_successful_update_assumed_role.yml deleted file mode 100644 index b9179059dd..0000000000 --- a/detections/cloud/aws_iam_successful_update_assumed_role.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: AWS IAM Successful Update Assumed Role -id: 63787a0e-9302-11eb-961a-acde48001122 -version: 1 -date: '2021-04-01' -author: Michael Haag, Splunk -type: batch -datamodel: [] -description: The following detection identifies a succesful account assuming a role - receiving access. -search: '`cloudtrail` index="aws-cloudtrail" sourcetype=aws:cloudtrail eventName=UpdateAssumeRolePolicy errorCode=success (userAgent!=*.amazonaws.com) -| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.roleName) as role by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `aws_iam_successful_update_assumed_role_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to grant role access (least privilege). -references: -- https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAssumeRolePolicy.html -- https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities/ -- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ -tags: - analytic_story: - - AWS IAM Privilege Escalation - dataset: [] - kill_chain_phases: - - Privilege Escalation - mitre_attack_id: [] - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - - Splunk Security Analytics for AWS - required_fields: - - _time - - eventName - - userAgent - - errorCode - - requestParameters.roleName - security_domain: access \ No newline at end of file diff --git a/tests/cloud/aws_excessive_list_command_usage.test.yml b/tests/cloud/aws_excessive_list_command_usage.test.yml index 7d26298829..13b5defdda 100644 --- a/tests/cloud/aws_excessive_list_command_usage.test.yml +++ b/tests/cloud/aws_excessive_list_command_usage.test.yml @@ -1,12 +1,13 @@ name: AWS Excessive List Command Usage Unit Test tests: - name: AWS Excessive List Command Usage - file: detections/cloud/aws_excessive_list_command_usage.yml + file: cloud/aws_excessive_list_command_usage.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: aws_iam_excessive_list_command_usage.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_excessive_list_command_usage/aws_iam_excessive_list_command_usage.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml b/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml index a591a32498..2425d8e763 100644 --- a/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml +++ b/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml @@ -1,12 +1,13 @@ name: AWS IAM AccessDenied Discovery Events Unit Test tests: - name: AWS IAM AccessDenied Discovery Events - file: detections/cloud/aws_iam_accessdenied_discovery_events.yml + file: cloud/aws_iam_accessdenied_discovery_events.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: aws_iam_accessdenied_discovery_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml b/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml index 68f5d5c276..72dfdb5b50 100644 --- a/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml +++ b/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml @@ -1,12 +1,13 @@ name: AWS IAM Assume Role Policy Brute Force Unit Test tests: - name: AWS IAM Assume Role Policy Brute Force - file: detections/cloud/aws_iam_assume_role_policy_brute_force.yml + file: cloud/aws_iam_assume_role_policy_brute_force.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: aws_iam_assume_role_policy_brute_force.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/aws_iam_delete_policy.test.yml b/tests/cloud/aws_iam_delete_policy.test.yml index ef7a1f2159..a76ae42664 100644 --- a/tests/cloud/aws_iam_delete_policy.test.yml +++ b/tests/cloud/aws_iam_delete_policy.test.yml @@ -1,12 +1,13 @@ name: AWS IAM Delete Policy Unit Test tests: - name: AWS IAM Delete Policy - file: detections/cloud/aws_iam_delete_policy.yml + file: cloud/aws_iam_delete_policy.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: aws_iam_delete_policy.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml b/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml index 8066f5b5fa..50fefd37b2 100644 --- a/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml +++ b/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml @@ -1,12 +1,13 @@ name: AWS IAM Detect Creation Usage of Access Keys with Root Unit Test tests: - name: AWS IAM Detect Creation Usage of Access Keys with Root - file: detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml + file: cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/aws_iam_failure_group_deletion.test.yml b/tests/cloud/aws_iam_failure_group_deletion.test.yml index 0fa9fb82f2..83f02e7dd3 100644 --- a/tests/cloud/aws_iam_failure_group_deletion.test.yml +++ b/tests/cloud/aws_iam_failure_group_deletion.test.yml @@ -1,12 +1,13 @@ name: AWS IAM Failure Group Deletion Unit Test tests: - name: AWS IAM Failure Group Deletion - file: detections/cloud/aws_iam_failure_group_deletion.yml + file: cloud/aws_iam_failure_group_deletion.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: aws_iam_delete_policy.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/aws_iam_mfa_deactivated.test.yml b/tests/cloud/aws_iam_mfa_deactivated.test.yml index 404f1cee6d..897966e08f 100644 --- a/tests/cloud/aws_iam_mfa_deactivated.test.yml +++ b/tests/cloud/aws_iam_mfa_deactivated.test.yml @@ -1,7 +1,7 @@ name: AWS IAM MFA Deactivated Unit Test tests: - name: AWS IAM MFA Deactivated - file: detections/cloud/aws_iam_mfa_deactivated.yml + file: cloud/aws_iam_mfa_deactivated.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/cloud/aws_iam_root_account_login.test.yml b/tests/cloud/aws_iam_root_account_login.test.yml index 89a575daee..340dfe2b8b 100644 --- a/tests/cloud/aws_iam_root_account_login.test.yml +++ b/tests/cloud/aws_iam_root_account_login.test.yml @@ -1,12 +1,13 @@ name: AWS IAM Root Account Login Unit Test tests: - name: AWS IAM Root Account Login - file: detections/cloud/aws_iam_root_account_login.yml + file: cloud/aws_iam_root_account_login.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True \ No newline at end of file diff --git a/tests/cloud/aws_iam_successful_group_deletion.test.yml b/tests/cloud/aws_iam_successful_group_deletion.test.yml index 3b0d873af5..76767a7f16 100644 --- a/tests/cloud/aws_iam_successful_group_deletion.test.yml +++ b/tests/cloud/aws_iam_successful_group_deletion.test.yml @@ -1,12 +1,13 @@ name: AWS IAM Successful Group Deletion Unit Test tests: - name: AWS IAM Successful Group Deletion - file: detections/cloud/aws_iam_successful_group_deletion.yml + file: cloud/aws_iam_successful_group_deletion.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: aws_iam_successful_group_deletion.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True \ No newline at end of file diff --git a/tests/cloud/aws_iam_successful_update_assumed_role.test.yml b/tests/cloud/aws_iam_successful_update_assumed_role.test.yml deleted file mode 100644 index d0d0f7fdb9..0000000000 --- a/tests/cloud/aws_iam_successful_update_assumed_role.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: AWS IAM Successful Update Assumed Role Unit Test -tests: -- name: AWS IAM Successful Update Assumed Role - file: detections/cloud/aws_iam_successful_update_assumed_role.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From bc572e94fac83c9c337840381373638fcba8d65b Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 14 Apr 2021 21:14:35 -0600 Subject: [PATCH 06/72] Update aws_iam_delete_policy.yml --- detections/cloud/aws_iam_delete_policy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 6471ba500e..f2e1ee0e84 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -4,7 +4,7 @@ version: 1 date: '2021-04-01' author: Michael Haag, Splunk type: batch -datamodel: +datamodel: [] description: The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy. search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn) as policyArn by src eventName eventSource aws_account_id errorCode errorMessage userAgent eventID awsRegion userIdentity.principalId userIdentity.arn From 537be8ede477be8521ac174622aa0a68212facf9 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 14 Apr 2021 21:17:59 -0600 Subject: [PATCH 07/72] Update winevent_scheduled_task_created_within_public_path.yml --- ...winevent_scheduled_task_created_within_public_path.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 24820b2a5c..9d8afe60da 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -11,19 +11,19 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ - The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it's possible a scheduled task is being registered within that process context in memory.\ + The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ - Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review.' + Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' search: '`wineventlog_security` EventCode=4698 | xmlkv Message - | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\windows\\temp*", "*\\Windows\\Tasks\\*", "*\\appdata\\*") + | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. -known_false_positives: False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed. +known_false_positives: False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately. references: - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 From f18542b2142cddeda75cd33ffdc2fc2b0606d6b5 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 14 Apr 2021 21:23:30 -0600 Subject: [PATCH 08/72] Update winevent_scheduled_task_created_within_public_path.yml --- .../winevent_scheduled_task_created_within_public_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 9d8afe60da..e87362699b 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -28,7 +28,7 @@ references: - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ - - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN + - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting analytic_story: - Windows Persistence Techniques - Ransomware From 79bff151de55d9c67262382f12afab141f95fd2c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 14 Apr 2021 21:25:26 -0600 Subject: [PATCH 09/72] Update winevent_scheduled_task_created_within_public_path.yml --- .../winevent_scheduled_task_created_within_public_path.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index e87362699b..a7f5a010da 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -26,9 +26,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately. references: - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ - - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ - - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting analytic_story: - Windows Persistence Techniques - Ransomware From 94eccb2565bcf342d33de2fbef72024605b3601b Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 14 Apr 2021 21:28:49 -0600 Subject: [PATCH 10/72] Update winevent_scheduled_task_created_within_public_path.yml --- .../winevent_scheduled_task_created_within_public_path.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index a7f5a010da..86f9ebd78a 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -13,7 +13,7 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ - Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' + Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via TaskService. Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*") @@ -26,7 +26,10 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately. references: - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ + - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ + - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN +tags: analytic_story: - Windows Persistence Techniques - Ransomware From 453b0acceca043585e443470b05d3e32a6e9995a Mon Sep 17 00:00:00 2001 From: root Date: Thu, 15 Apr 2021 18:13:33 +0000 Subject: [PATCH 11/72] Added detection testing service results inAWS Excessive List Command Usage --- .../aws_excessive_list_command_usage.yml | 30 +++++++++++-------- 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/detections/cloud/aws_excessive_list_command_usage.yml b/detections/cloud/aws_excessive_list_command_usage.yml index ccf0412c51..a71acc784d 100644 --- a/detections/cloud/aws_excessive_list_command_usage.yml +++ b/detections/cloud/aws_excessive_list_command_usage.yml @@ -5,22 +5,28 @@ date: '2021-04-05' author: Michael Haag, Splunk type: batch datamodel: [] -description: The following detection identifies distict list commands ran against the AWS environment over a 1 hour period of time. The idea is that, if a AWS key is lost/stolen, the adversary will begin to perform many list-* queries against the environment to gather further information about the account. +description: The following detection identifies distict list commands ran against + the AWS environment over a 1 hour period of time. The idea is that, if a AWS key + is lost/stolen, the adversary will begin to perform many list-* queries against + the environment to gather further information about the account. search: '`cloudtrail` (command = List*) user_type=IAMUser (userAgent!=*.amazonaws.com) - | bucket _time span=1h - | stats count min(_time) as firstTime max(_time) as lastTime , dc(command) as distinct_command_count,values(errorCode) as errorCode values(eventSource) as eventSource values(command) as command values(userAgent) as userAgent by src_ip, userName, _time - | where count >= 10 and distinct_command_count > 1 - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `aws_excessive_list_command_usage_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: It is possible ther ewill be false positives based on the count numbers used. Tune accordingly based on IP or user associated. From there, tune the values to set an upper limit for your environment. + | bucket _time span=1h | stats count min(_time) as firstTime max(_time) as lastTime + , dc(command) as distinct_command_count,values(errorCode) as errorCode values(eventSource) + as eventSource values(command) as command values(userAgent) as userAgent by src_ip, + userName, _time | where count >= 10 and distinct_command_count > 1 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_excessive_list_command_usage_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize + this data. The search requires AWS Cloudtrail logs. +known_false_positives: It is possible ther ewill be false positives based on the count + numbers used. Tune accordingly based on IP or user associated. From there, tune + the values to set an upper limit for your environment. references: - - https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html +- https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html tags: analytic_story: - AWS IAM Privilege Escalation - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_excessive_list_command_usage/aws_iam_excessive_list_command_usage.json kill_chain_phases: - Reconnaissance mitre_attack_id: @@ -38,4 +44,4 @@ tags: - eventSource - userAgent security_domain: access - + automated_detection_testing: passed From d6a32d4bd53128c19dc019013b8e25661738dcd3 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 15 Apr 2021 18:47:13 +0000 Subject: [PATCH 12/72] Added detection testing service results inAWS IAM AccessDenied Discovery Events --- .../aws_iam_accessdenied_discovery_events.yml | 29 ++++++++++++------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index d8b8657e4e..30a6a756f6 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -5,22 +5,28 @@ date: '2021-04-05' author: Michael Haag, Splunk type: batch datamodel: [] -description: The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery events. In these instances, the access is not available with the key stolen therefore these events will be generated. +description: The following detection identifies excessive AccessDenied events within + an hour timeframe. It is possible that an access key to AWS may have been stolen + and is being misused to perform discovery events. In these instances, the access + is not available with the key stolen therefore these events will be generated. search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) - | bucket _time span=1h - | stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) by src_ip, userIdentity.arn, _time - | where failures >= 5 and methods >= 1 and sources >= 1 - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time) + as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) + by src_ip, userIdentity.arn, _time | where failures >= 5 and methods >= 1 and sources + >= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_accessdenied_discovery_events_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives. +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize + this data. The search requires AWS Cloudtrail logs. +known_false_positives: It is possible to start this detection will need to be tuned + by source IP or user. In addition, change the count values to an upper threshold + to restrict false positives. references: - - https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/ +- https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/ tags: analytic_story: - AWS IAM Privilege Escalation - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json kill_chain_phases: - Reconnaissance mitre_attack_id: @@ -37,4 +43,5 @@ tags: - userAgent - errorCode - userIdentity.type - security_domain: access \ No newline at end of file + security_domain: access + automated_detection_testing: passed From f07a6cd445272d9aab7d09daf58e4e3a074fa4dc Mon Sep 17 00:00:00 2001 From: root Date: Thu, 15 Apr 2021 19:17:21 +0000 Subject: [PATCH 13/72] Added detection testing service results inAWS IAM Assume Role Policy Brute Force --- ...aws_iam_assume_role_policy_brute_force.yml | 30 ++++++++++++------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 139ef9838e..d48b6406bd 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -5,22 +5,29 @@ date: '2021-04-01' author: Michael Haag, Splunk type: batch datamodel: [] -description: The following detection identifies any malformed policy document exceptions with a status of `failure`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur. -search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com) -| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn -| where count >= 2 -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `aws_iam_assume_role_policy_brute_force_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. Set the `where count` greater than a value to identify suspicious activity in your environment. -known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. +description: The following detection identifies any malformed policy document exceptions + with a status of `failure`. Meaning, when an adversary is attempting to identify + a role name, multiple failures will occur. +search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure + (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as + lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource + aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion + userIdentity.principalId user_arn | where count >= 2 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize + this data. The search requires AWS Cloudtrail logs. Set the `where count` greater + than a value to identify suspicious activity in your environment. +known_false_positives: This detection will require tuning to provide high fidelity + detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) + or by groups of users. references: - https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities - https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html tags: analytic_story: - AWS IAM Privilege Escalation - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json kill_chain_phases: - Privilege Escalation mitre_attack_id: @@ -37,4 +44,5 @@ tags: - userAgent - errorCode - requestParameters.policyName - security_domain: access \ No newline at end of file + security_domain: access + automated_detection_testing: passed From 7f30daf3010cb19953454b3fcbee664f1fd065f9 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 15 Apr 2021 19:21:10 +0000 Subject: [PATCH 14/72] Added detection testing service results inAWS IAM Delete Policy --- detections/cloud/aws_iam_delete_policy.yml | 31 +++++++++++++++------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index f2e1ee0e84..7f5ad40d08 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -5,21 +5,31 @@ date: '2021-04-01' author: Michael Haag, Splunk type: batch datamodel: [] -description: The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy. -search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) -| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn) as policyArn by src eventName eventSource aws_account_id errorCode errorMessage userAgent eventID awsRegion userIdentity.principalId userIdentity.arn -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `aws_iam_delete_policy_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only. +description: The following detection identifes when a policy is deleted on AWS. This + does not identify whether successful or failed, but the error messages tell a story + of suspicious attempts. There is a specific process to follow when deleting a policy. + First, detach the policy from all users, groups, and roles that the policy is attached + to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy. +search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats + count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn) + as policyArn by src eventName eventSource aws_account_id errorCode errorMessage + userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize + this data. The search requires AWS Cloudtrail logs. +known_false_positives: This detection will require tuning to provide high fidelity + detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) + or by groups of users. Not every user with AWS access should have permission to + delete policies (least privilege). In addition, this may be saved seperately and + tuned for failed or success attempts only. references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html - https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html tags: analytic_story: - AWS IAM Privilege Escalation - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json kill_chain_phases: - Privilege Escalation mitre_attack_id: @@ -35,4 +45,5 @@ tags: - userAgent - errorCode - requestParameters.policyArn - security_domain: access \ No newline at end of file + security_domain: access + automated_detection_testing: passed From 10d6fccda7becf4c63aa9726ff5f15acc090efed Mon Sep 17 00:00:00 2001 From: root Date: Thu, 15 Apr 2021 19:53:19 +0000 Subject: [PATCH 15/72] Added detection testing service results inAWS IAM Failure Group Deletion --- .../cloud/aws_iam_failure_group_deletion.yml | 33 ++++++++++++------- 1 file changed, 22 insertions(+), 11 deletions(-) diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index 16d3e72343..b550c785fd 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -5,26 +5,36 @@ date: '2021-04-01' author: Michael Haag, Splunk type: batch datamodel: [] -description: This detection identifies the inverse of success. We want to identify when a group is attempting to be deleted, but either access is denied, there is a conflict or there is no group. This is indicative of administrators performing an action, but also could be suspicious behavior occurring. Review parallel IAM events - recently added users, new groups and so forth. -search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com) -| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName) as group_name by src eventName eventSource aws_account_id errorCode errorMessage userAgent eventID awsRegion userIdentity.principalId user_arn -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `aws_iam_failure_group_deletion_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege). +description: This detection identifies the inverse of success. We want to identify + when a group is attempting to be deleted, but either access is denied, there is + a conflict or there is no group. This is indicative of administrators performing + an action, but also could be suspicious behavior occurring. Review parallel IAM + events - recently added users, new groups and so forth. +search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode + IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com) + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName) + as group_name by src eventName eventSource aws_account_id errorCode errorMessage + userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_iam_failure_group_deletion_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize + this data. The search requires AWS Cloudtrail logs. +known_false_positives: This detection will require tuning to provide high fidelity + detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) + or by groups of users. Not every user with AWS access should have permission to + delete groups (least privilege). references: - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html tags: analytic_story: - AWS IAM Privilege Escalation - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json kill_chain_phases: - Privilege Escalation - Denial of Service mitre_attack_id: - - T1098 + - T1098 product: - Splunk Enterprise - Splunk Enterprise Security @@ -36,4 +46,5 @@ tags: - userAgent - errorCode - requestParameters.groupName - security_domain: identity \ No newline at end of file + security_domain: identity + automated_detection_testing: passed From cc38063d6fc5f12692652e0ec09f319884ad04e4 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 15 Apr 2021 20:16:33 +0000 Subject: [PATCH 16/72] Added detection testing service results inAWS IAM Successful Group Deletion --- .../aws_iam_successful_group_deletion.yml | 29 ++++++++++++------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 42db31bac7..4befb51ad1 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -5,21 +5,29 @@ date: '2021-03-31' author: Michael Haag, Splunk type: batch datamodel: [] -description: The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner. -search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success (userAgent!=*.amazonaws.com) -| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName) by src eventName eventSource errorCode user_agent awsRegion userIdentity.principalId user_arn -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `aws_iam_successful_group_deletion_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege). +description: The following query uses IAM events to track the success of a group being + deleted on AWS. This is typically not indicative of malicious behavior, but a precurser + to additional events thay may unfold. Review parallel IAM events - recently added + users, new groups and so forth. Inversely, review failed attempts in a similar manner. +search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success + (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as + lastTime values(requestParameters.groupName) by src eventName eventSource errorCode + user_agent awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_iam_successful_group_deletion_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize + this data. The search requires AWS Cloudtrail logs. +known_false_positives: This detection will require tuning to provide high fidelity + detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) + or by groups of users. Not every user with AWS access should have permission to + delete groups (least privilege). references: - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html tags: analytic_story: - AWS IAM Privilege Escalation - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json kill_chain_phases: - Denial of Service - Privilege Escalation @@ -37,4 +45,5 @@ tags: - userAgent - errorCode - requestParameters.groupName - security_domain: identity \ No newline at end of file + security_domain: identity + automated_detection_testing: passed From a74171d7e394b78852cfe5039296897f88a05812 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 15 Apr 2021 14:25:15 -0600 Subject: [PATCH 17/72] removals --- detections/cloud/aws_iam_mfa_deactivated.yml | 37 -------------------- tests/cloud/aws_iam_mfa_deactivated.test.yml | 12 ------- 2 files changed, 49 deletions(-) delete mode 100644 detections/cloud/aws_iam_mfa_deactivated.yml delete mode 100644 tests/cloud/aws_iam_mfa_deactivated.test.yml diff --git a/detections/cloud/aws_iam_mfa_deactivated.yml b/detections/cloud/aws_iam_mfa_deactivated.yml deleted file mode 100644 index 2f5507ea03..0000000000 --- a/detections/cloud/aws_iam_mfa_deactivated.yml +++ /dev/null @@ -1,37 +0,0 @@ -name: AWS IAM MFA Deactivated -id: 452972ca-930b-11eb-ba0d-acde48001122 -version: 1 -date: '2021-04-01' -author: Michael Haag, Splunk -type: batch -datamodel: [] -description: This detection looks for the successful event of MFA being deactivated on an account. -search: '`cloudtrail` errorCode=DeactivateMFADevice status=success (userAgent!=*.amazonaws.com) -| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` - | `aws_iam_mfa_deactivated_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: False positives should be limited as the ability to disable MFA should be restricted and only used for troubleshooting an account issue. -references: -- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeactivateMFADevice.html -tags: - analytic_story: - - AWS IAM Privilege Escalation - dataset: [] - kill_chain_phases: - - Privilege Escalation - mitre_attack_id: - - T1078.004 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - - Splunk Security Analytics for AWS - required_fields: - - _time - - eventName - - userAgent - - errorCode - - requestParameters.policyName - security_domain: access \ No newline at end of file diff --git a/tests/cloud/aws_iam_mfa_deactivated.test.yml b/tests/cloud/aws_iam_mfa_deactivated.test.yml deleted file mode 100644 index 897966e08f..0000000000 --- a/tests/cloud/aws_iam_mfa_deactivated.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: AWS IAM MFA Deactivated Unit Test -tests: -- name: AWS IAM MFA Deactivated - file: cloud/aws_iam_mfa_deactivated.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 18586f6bb0bc79a38ae04cbe3ae1f54d17f729c4 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 15 Apr 2021 14:54:22 -0600 Subject: [PATCH 18/72] winevents task registered --- ..._scheduled_task_created_to_spawn_shell.yml | 52 +++++++++++++++++++ ...duled_task_created_to_spawn_shell.test.yml | 12 +++++ 2 files changed, 64 insertions(+) create mode 100644 detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml create mode 100644 tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml new file mode 100644 index 0000000000..7425dd1ab2 --- /dev/null +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -0,0 +1,52 @@ +name: WinEvent Scheduled Task Created to Spawn Shell +id: 203ef0ea-9bd8-11eb-8201-acde48001122 +version: 1 +date: '2021-04-12' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a native Windows shell (PowerShell, Cmd, Wscript, Cscript).\ + + The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ + + schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ + + The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ + + Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' +search: '`wineventlog_security` EventCode=4698 + | xmlkv Message + | search Command IN ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*", "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") + | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `winevent_scheduled_task_created_to_spawn_shell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. +known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. +references: + - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ + - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 + - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ + - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN +tags: + analytic_story: + - Windows Persistence Techniques + - Ransomware + - Ryuk Ransomware + dataset: [] + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - Task_Name + - Description + - Command + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml new file mode 100644 index 0000000000..2e69eb23aa --- /dev/null +++ b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml @@ -0,0 +1,12 @@ +name: WinEvent Scheduled Task Created to Spawn Shell Unit Test +tests: +- name: WinEvent Scheduled Task Created to Spawn Shell + file: endpoint/winevent_scheduled_task_created_to_spawn_shell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 5d81ce6926d0f88bca0bdfc6b99f5a8b2dcc50e6 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 15 Apr 2021 15:14:50 -0600 Subject: [PATCH 19/72] winevent public path --- .../winevent_scheduled_task_created_within_public_path.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 86f9ebd78a..fcdd2e179c 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -29,6 +29,7 @@ references: - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN + - https://app.any.run/tasks/e26f1b2e-befa-483b-91d2-e18636e2faf3/ tags: analytic_story: - Windows Persistence Techniques From ac370189eee58739272005f3707bddd1db1681c8 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 19 Apr 2021 10:39:42 -0600 Subject: [PATCH 20/72] winevent fix --- .../winevent_scheduled_task_created_to_spawn_shell.test.yml | 5 +++-- ...nevent_scheduled_task_created_within_public_path.test.yml | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml index 2e69eb23aa..aa437550ae 100644 --- a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml +++ b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml @@ -8,5 +8,6 @@ tests: attack_data: - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml index 50e61ff041..8bbd7f609d 100644 --- a/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml +++ b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml @@ -8,5 +8,6 @@ tests: attack_data: - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True \ No newline at end of file From 8f119308ccec51c3ee45da6f384c894fd27eacc2 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 19 Apr 2021 16:58:36 +0000 Subject: [PATCH 21/72] Added detection testing service results inWinEvent Scheduled Task Created Within Public Path --- ...eduled_task_created_within_public_path.yml | 59 +++++++++++-------- 1 file changed, 36 insertions(+), 23 deletions(-) diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index fcdd2e179c..761ff77e10 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -5,37 +5,49 @@ date: '2021-04-08' author: Michael Haag, Splunk type: batch datamodel: [] -description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed from a user writeable file path.\ - - The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ +description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled + task was created`, to identify suspicious tasks registered on Windows either via + schtasks.exe OR TaskService with a command to be executed from a user writeable + file path.\ - schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ + The search will return the first time and last time the task was registered, as + well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether + it is `Hidden` or not.\ - The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ - - Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via TaskService. Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -search: '`wineventlog_security` EventCode=4698 - | xmlkv Message - | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*") - | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `winevent_scheduled_task_created_within_public_path_filter`' + schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ + + The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. + If found loaded by another process, it is possible a scheduled task is being registered + within that process context in memory.\ + + Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via + TaskService. Review the job created and the Command to be executed. Capture any + artifacts on disk and review. Identify any parallel processes within the same timeframe + to identify source.' +search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN + ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", + "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by + dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. -known_false_positives: False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately. + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also + required. +known_false_positives: False positives are possible if legitimate applications are + allowed to register tasks in public paths. Filter as needed based on paths that + are used legitimately. references: - - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ - - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 - - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ - - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN - - https://app.any.run/tasks/e26f1b2e-befa-483b-91d2-e18636e2faf3/ +- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ +- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 +- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ +- https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN +- https://app.any.run/tasks/e26f1b2e-befa-483b-91d2-e18636e2faf3/ tags: analytic_story: - Windows Persistence Techniques - Ransomware - Ryuk Ransomware - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log kill_chain_phases: - Privilege Escalation mitre_attack_id: @@ -50,4 +62,5 @@ tags: - Task_Name - Description - Command - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From b2dc2449202e758ce27511f968cc4d329a2eb26e Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 19 Apr 2021 11:21:05 -0600 Subject: [PATCH 22/72] rundll32 --- ...no_command_line_arguments_with_network.yml | 57 +++++++++++++++++++ ...mmand_line_arguments_with_network.test.yml | 12 ++++ 2 files changed, 69 insertions(+) create mode 100644 detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml create mode 100644 tests/endpoint/rundll32_with_no_command_line_arguments_with_network.test.yml diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml new file mode 100644 index 0000000000..3bb5bec1bb --- /dev/null +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -0,0 +1,57 @@ +name: Rundll32 with no Command Line Arguments with Network +id: 35307032-a12d-11eb-835f-acde48001122 +version: 1 +date: '2021-04-19' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. + It is unusual for rundll32.exe to execute with no command line arguments present. + This particular behavior is common with malicious software, including Cobalt Strike. + During investigation, triage any network connections and parallel processes. Identify + any suspicious module loads related to credential dumping or file writes. Rundll32.exe + is natively found in C:\Windows\system32 and C:\Windows\syswow64. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=rundll32.exe by _time span=1h Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | regex process="(rundll32\.exe.{0,4}$)" + | join process_id + [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process_id connection_to_CNC dest_port + | `rundll32_with_no_command_line_arguments_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. +known_false_positives: Although unlikely, some legitimate applications may use a moved + copy of rundll32, triggering a false positive. +references: + - https://attack.mitre.org/techniques/T1218/011/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md + - https://lolbas-project.github.io/lolbas/Binaries/Rundll32 + - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ +tags: + analytic_story: + - Suspicious Rundll32 Activity + - Cobalt Strike + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - process_id + - parent_process_name + - dest_port + - process_path + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/rundll32_with_no_command_line_arguments_with_network.test.yml b/tests/endpoint/rundll32_with_no_command_line_arguments_with_network.test.yml new file mode 100644 index 0000000000..1c1018afd1 --- /dev/null +++ b/tests/endpoint/rundll32_with_no_command_line_arguments_with_network.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 with no Command Line Arguments with Network Unit Test +tests: +- name: Rundll32 with no Command Line Arguments with Network + file: endpoint/rundll32_with_no_command_line_arguments_with_network.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 9579f2d7086e4c7c76a4652b02f61900c18e26e1 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 19 Apr 2021 11:57:51 -0600 Subject: [PATCH 23/72] Update rundll32_with_no_command_line_arguments_with_network.test.yml --- ...undll32_with_no_command_line_arguments_with_network.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/rundll32_with_no_command_line_arguments_with_network.test.yml b/tests/endpoint/rundll32_with_no_command_line_arguments_with_network.test.yml index 1c1018afd1..bc148862c9 100644 --- a/tests/endpoint/rundll32_with_no_command_line_arguments_with_network.test.yml +++ b/tests/endpoint/rundll32_with_no_command_line_arguments_with_network.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From b9d4c096b99bbf570eff1852c1a3768fa0955aa9 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 19 Apr 2021 18:17:41 +0000 Subject: [PATCH 24/72] Added detection testing service results inRundll32 with no Command Line Arguments with Network --- ...no_command_line_arguments_with_network.yml | 45 ++++++++++--------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 3bb5bec1bb..13a49f5d9e 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -6,38 +6,38 @@ author: Michael Haag, Splunk type: batch datamodel: - Endpoint -description: The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. - It is unusual for rundll32.exe to execute with no command line arguments present. - This particular behavior is common with malicious software, including Cobalt Strike. - During investigation, triage any network connections and parallel processes. Identify - any suspicious module loads related to credential dumping or file writes. Rundll32.exe - is natively found in C:\Windows\system32 and C:\Windows\syswow64. +description: The following analytic identifies rundll32.exe with no command line arguments + and performing a network connection. It is unusual for rundll32.exe to execute with + no command line arguments present. This particular behavior is common with malicious + software, including Cobalt Strike. During investigation, triage any network connections + and parallel processes. Identify any suspicious module loads related to credential + dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and + C:\Windows\syswow64. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=rundll32.exe by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | regex process="(rundll32\.exe.{0,4}$)" - | join process_id - [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process_id connection_to_CNC dest_port - | `rundll32_with_no_command_line_arguments_with_network_filter`' + where Processes.process_name=rundll32.exe by _time span=1h Processes.process_id + Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(rundll32\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id + Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process_id connection_to_CNC + dest_port | `rundll32_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. known_false_positives: Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. references: - - https://attack.mitre.org/techniques/T1218/011/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md - - https://lolbas-project.github.io/lolbas/Binaries/Rundll32 - - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ +- https://attack.mitre.org/techniques/T1218/011/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md +- https://lolbas-project.github.io/lolbas/Binaries/Rundll32 +- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ tags: analytic_story: - Suspicious Rundll32 Activity - Cobalt Strike - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -54,4 +54,5 @@ tags: - parent_process_name - dest_port - process_path - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From c143c99ad8b9b4de9c949f509ebd44bb238d0abe Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 19 Apr 2021 12:37:35 -0600 Subject: [PATCH 25/72] Update winevent_scheduled_task_created_to_spawn_shell.test.yml --- .../winevent_scheduled_task_created_to_spawn_shell.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml index aa437550ae..316980bb0d 100644 --- a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml +++ b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog update_timestamp: True \ No newline at end of file From 5daf227b3fb04982fc4d40c7420f051fbbb875cf Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 19 Apr 2021 12:58:24 -0600 Subject: [PATCH 26/72] gpupdate --- ...no_command_line_arguments_with_network.yml | 53 +++++++++++++++++++ ...mand_line_arguements_with_network.test.yml | 12 +++++ 2 files changed, 65 insertions(+) create mode 100644 detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml create mode 100644 tests/endpoint/gpupdate_with_no_command_line_arguements_with_network.test.yml diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml new file mode 100644 index 0000000000..074130b5cc --- /dev/null +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -0,0 +1,53 @@ +name: GPUpdate with no Command Line Arguments with Network +id: 2c853856-a140-11eb-a5b5-acde48001122 +version: 1 +date: '2021-04-19' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies gpupdate.exe with no command line arguments and with a network connection. + It is unusual for gpupdate.exe to execute with no command line arguments present. + This particular behavior is common with malicious software, including Cobalt Strike. + During investigation, triage any network connections and parallel processes. Identify + any suspicious module loads related to credential dumping or file writes. gpupdate.exe + is natively found in C:\Windows\system32 and C:\Windows\syswow64. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | regex process="(gpupdate\.exe.{0,4}$)" + | join process_id + [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process_id connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives may be present in small environments. + Tuning may be required based on parent process. +references: + - https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile + - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ +tags: + analytic_story: + - Cobalt Strike + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - process_id + - parent_process_name + - dest_port + - process_path + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/gpupdate_with_no_command_line_arguements_with_network.test.yml b/tests/endpoint/gpupdate_with_no_command_line_arguements_with_network.test.yml new file mode 100644 index 0000000000..71325e2495 --- /dev/null +++ b/tests/endpoint/gpupdate_with_no_command_line_arguements_with_network.test.yml @@ -0,0 +1,12 @@ +name: GPUpdate with no Command Line Arguments with Network Unit Test +tests: +- name: GPUpdate with no Command Line Arguments with Network + file: endpoint/gpupdate_with_no_command_line_arguments_with_network.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From b8e07910a447876a3b3e2a7961af90f0b7b191a0 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 19 Apr 2021 19:00:07 +0000 Subject: [PATCH 27/72] Added detection testing service results inWinEvent Scheduled Task Created to Spawn Shell --- ..._scheduled_task_created_to_spawn_shell.yml | 56 ++++++++++++------- 1 file changed, 35 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 7425dd1ab2..cf38cd77e5 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -5,36 +5,49 @@ date: '2021-04-12' author: Michael Haag, Splunk type: batch datamodel: [] -description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a native Windows shell (PowerShell, Cmd, Wscript, Cscript).\ - - The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ +description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled + task was created`, to identify suspicious tasks registered on Windows either via + schtasks.exe OR TaskService with a command to be executed with a native Windows + shell (PowerShell, Cmd, Wscript, Cscript).\ - schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ + The search will return the first time and last time the task was registered, as + well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether + it is `Hidden` or not.\ - The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ - - Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -search: '`wineventlog_security` EventCode=4698 - | xmlkv Message - | search Command IN ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*", "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") - | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ + + The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. + If found loaded by another process, it is possible a scheduled task is being registered + within that process context in memory.\ + + Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? + Review the job created and the Command to be executed. Capture any artifacts on + disk and review. Identify any parallel processes within the same timeframe to identify + source.' +search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN + ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*", + "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") | stats count + min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, + Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_to_spawn_shell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. -known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also + required. +known_false_positives: False positives are possible if legitimate applications are + allowed to register tasks that call a shell to be spawned. Filter as needed based + on command-line or processes that are used legitimately. references: - - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ - - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 - - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ - - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN +- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ +- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 +- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ +- https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN tags: analytic_story: - Windows Persistence Techniques - Ransomware - Ryuk Ransomware - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log kill_chain_phases: - Privilege Escalation mitre_attack_id: @@ -49,4 +62,5 @@ tags: - Task_Name - Description - Command - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From 1d6c20d5870e9b1c58e5e92b34f89cc12190af8f Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 19 Apr 2021 13:08:04 -0600 Subject: [PATCH 28/72] dllhost and gpupdate fix --- ...o_command_line_arguements_with_network.yml | 54 +++++++++++++++++++ ...mmand_line_arguments_with_network.test.yml | 12 +++++ ...mand_line_arguments_with_network.test.yml} | 0 3 files changed, 66 insertions(+) create mode 100644 detections/endpoint/dllhost_with_no_command_line_arguements_with_network.yml create mode 100644 tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml rename tests/endpoint/{gpupdate_with_no_command_line_arguements_with_network.test.yml => gpupdate_with_no_command_line_arguments_with_network.test.yml} (100%) diff --git a/detections/endpoint/dllhost_with_no_command_line_arguements_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguements_with_network.yml new file mode 100644 index 0000000000..254d50ed50 --- /dev/null +++ b/detections/endpoint/dllhost_with_no_command_line_arguements_with_network.yml @@ -0,0 +1,54 @@ +name: DLLHost with no Command Line Arguements with Network +id: f1c07594-a141-11eb-8407-acde48001122 +version: 1 +date: '2021-04-19' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies DLLHost.exe with no command line arguments with a network connection. + It is unusual for DLLHost.exe to execute with no command line arguments present. + This particular behavior is common with malicious software, including Cobalt Strike. + During investigation, triage any network connections and parallel processes. Identify + any suspicious module loads related to credential dumping or file writes. DLLHost.exe + is natively found in C:\Windows\system32 and C:\Windows\syswow64. +search: ' | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | regex process="(dllhost\.exe.{0,4}$)" + | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port + | `drop_dm_object_name(Ports)` + | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process_id connection_to_CNC dest_port | `dllhost_with_no_command_line_arguements_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. +known_false_positives: Although unlikely, some legitimate third party applications may use a moved + copy of dllhost, triggering a false positive. +references: + - https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile + - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ +tags: + analytic_story: + - Cobalt Strike + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - process_id + - parent_process_name + - dest_port + - process_path + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml new file mode 100644 index 0000000000..eaee9a37b4 --- /dev/null +++ b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml @@ -0,0 +1,12 @@ +name: DLLHost with no Command Line Arguments with Network Unit Test +tests: +- name: DLLHost with no Command Line Arguments with Network + file: detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/gpupdate_with_no_command_line_arguements_with_network.test.yml b/tests/endpoint/gpupdate_with_no_command_line_arguments_with_network.test.yml similarity index 100% rename from tests/endpoint/gpupdate_with_no_command_line_arguements_with_network.test.yml rename to tests/endpoint/gpupdate_with_no_command_line_arguments_with_network.test.yml From 962aa311d282c0d606b5762c2a151ec87740529d Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 19 Apr 2021 13:10:15 -0600 Subject: [PATCH 29/72] Update dllhost_with_no_command_line_arguments_with_network.test.yml --- ...dllhost_with_no_command_line_arguments_with_network.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml index eaee9a37b4..64fcaac42d 100644 --- a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml +++ b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml @@ -1,7 +1,7 @@ name: DLLHost with no Command Line Arguments with Network Unit Test tests: - name: DLLHost with no Command Line Arguments with Network - file: detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml + file: endpoint/dllhost_with_no_command_line_arguments_with_network.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 4925bae6b5f155251c025d267e71223431ebda24 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 19 Apr 2021 13:13:17 -0600 Subject: [PATCH 30/72] typo --- ...> dllhost_with_no_command_line_arguments_with_network.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{dllhost_with_no_command_line_arguements_with_network.yml => dllhost_with_no_command_line_arguments_with_network.yml} (95%) diff --git a/detections/endpoint/dllhost_with_no_command_line_arguements_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml similarity index 95% rename from detections/endpoint/dllhost_with_no_command_line_arguements_with_network.yml rename to detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 254d50ed50..e7b66868ae 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguements_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -1,4 +1,4 @@ -name: DLLHost with no Command Line Arguements with Network +name: DLLHost with no Command Line Arguments with Network id: f1c07594-a141-11eb-8407-acde48001122 version: 1 date: '2021-04-19' @@ -22,7 +22,7 @@ search: ' | tstats `security_content_summariesonly` count FROM datamodel=Endpoi | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process_id connection_to_CNC dest_port | `dllhost_with_no_command_line_arguements_with_network_filter`' + | table _time dest parent_process_name process_name process_path process_id connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. From 64288e39c74e9effc7440261dada90743d78bed0 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 19 Apr 2021 13:41:41 -0600 Subject: [PATCH 31/72] searchprotocolhost --- ...host_with_no_command_line_with_network.yml | 54 +++++++++++++++++++ ...with_no_command_line_with_network.test.yml | 12 +++++ 2 files changed, 66 insertions(+) create mode 100644 detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml create mode 100644 tests/endpoint/searchprotocolhost_with_no_command_line_with_network.test.yml diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml new file mode 100644 index 0000000000..1786c354e6 --- /dev/null +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -0,0 +1,54 @@ +name: SearchProtocolHost with no Command Line with Network +id: b690df8c-a145-11eb-a38b-acde48001122 +version: 1 +date: '2021-04-19' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies searchprotocolhost.exe with no command + line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command + line arguments present. This particular behavior is common with malicious software, + including Cobalt Strike. During investigation, identify any network connections + and parallel processes. Identify any suspicious module loads related to credential + dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 + and C:\Windows\syswow64. +search: ' | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | regex process="(searchprotocolhost\.exe.{0,4}$)" + | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port + | `drop_dm_object_name(Ports)` + | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process_id connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node. +known_false_positives: Limited false positives may be present in small environments. + Tuning may be required based on parent process. +references: +- https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc +tags: + analytic_story: + - Cobalt Strike + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - process_id + - parent_process_name + - dest_port + - process_path + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/searchprotocolhost_with_no_command_line_with_network.test.yml b/tests/endpoint/searchprotocolhost_with_no_command_line_with_network.test.yml new file mode 100644 index 0000000000..b9623222ea --- /dev/null +++ b/tests/endpoint/searchprotocolhost_with_no_command_line_with_network.test.yml @@ -0,0 +1,12 @@ +name: SearchProtocolHost with no Command Line with Network Unit Test +tests: +- name: SearchProtocolHost with no Command Line with Network + file: endpoint/searchprotocolhost_with_no_command_line_with_network.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 868af21f74f4601cb5c8673b48cd1cb464c7d293 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 19 Apr 2021 21:30:03 +0000 Subject: [PATCH 32/72] Added detection testing service results inGPUpdate with no Command Line Arguments with Network --- ...no_command_line_arguments_with_network.yml | 40 ++++++++++--------- 1 file changed, 21 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index 074130b5cc..d73dcc1742 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -6,34 +6,35 @@ author: Michael Haag, Splunk type: batch datamodel: - Endpoint -description: The following analytic identifies gpupdate.exe with no command line arguments and with a network connection. - It is unusual for gpupdate.exe to execute with no command line arguments present. - This particular behavior is common with malicious software, including Cobalt Strike. - During investigation, triage any network connections and parallel processes. Identify - any suspicious module loads related to credential dumping or file writes. gpupdate.exe - is natively found in C:\Windows\system32 and C:\Windows\syswow64. +description: The following analytic identifies gpupdate.exe with no command line arguments + and with a network connection. It is unusual for gpupdate.exe to execute with no + command line arguments present. This particular behavior is common with malicious + software, including Cobalt Strike. During investigation, triage any network connections + and parallel processes. Identify any suspicious module loads related to credential + dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and + C:\Windows\syswow64. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | regex process="(gpupdate\.exe.{0,4}$)" - | join process_id - [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process_id connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter`' + where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id + Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(gpupdate\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id + Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process_id connection_to_CNC + dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process. references: - - https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile - - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ +- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile +- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ tags: analytic_story: - Cobalt Strike - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -50,4 +51,5 @@ tags: - parent_process_name - dest_port - process_path - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From 0a55bf791f9dad0cdd16a4e252c9b6b62ace358e Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 20 Apr 2021 13:05:11 -0600 Subject: [PATCH 33/72] updated queries --- .../dllhost_with_no_command_line_arguments_with_network.yml | 3 ++- .../gpupdate_with_no_command_line_arguments_with_network.yml | 2 +- .../rundll32_with_no_command_line_arguments_with_network.yml | 2 +- .../searchprotocolhost_with_no_command_line_with_network.yml | 5 +++-- ...host_with_no_command_line_arguments_with_network.test.yml | 2 +- 5 files changed, 8 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index e7b66868ae..12a6c28b9d 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -22,7 +22,8 @@ search: ' | tstats `security_content_summariesonly` count FROM datamodel=Endpoi | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process_id connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter`' + | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC + dest_port | `dllhost_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index d73dcc1742..202fe2959e 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint | regex process="(gpupdate\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process_id connection_to_CNC + | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 13a49f5d9e..d1a9416df2 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint | regex process="(rundll32\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process_id connection_to_CNC + | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC dest_port | `rundll32_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 1786c354e6..21eb49d9a8 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -13,7 +13,7 @@ description: The following analytic identifies searchprotocolhost.exe with no co and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -search: ' | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` @@ -23,7 +23,8 @@ search: ' | tstats `security_content_summariesonly` count FROM datamodel=Endpoi | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process_id connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`' + | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC + dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node. diff --git a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml index 64fcaac42d..bcd7fb2a54 100644 --- a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml +++ b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 310bbc8884d61f636558a9c08d47f36d6da47b15 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 20 Apr 2021 15:16:14 -0600 Subject: [PATCH 34/72] Update dllhost_with_no_command_line_arguments_with_network.test.yml --- ...dllhost_with_no_command_line_arguments_with_network.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml index bcd7fb2a54..9a52747583 100644 --- a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml +++ b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: windows-sysmon.log + - file_name: windows-sysmon_dllhost.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 2efc199543f46a695cb282a9681ddf508a895f97 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 20 Apr 2021 17:44:12 -0400 Subject: [PATCH 35/72] fixing minor doc gen bug --- bin/jinja2_templates/doc_detections_markdown.j2 | 2 ++ bin/jinja2_templates/doc_detections_wiki.j2 | 2 ++ 2 files changed, 4 insertions(+) diff --git a/bin/jinja2_templates/doc_detections_markdown.j2 b/bin/jinja2_templates/doc_detections_markdown.j2 index 88db5af004..91bedbae2d 100644 --- a/bin/jinja2_templates/doc_detections_markdown.j2 +++ b/bin/jinja2_templates/doc_detections_markdown.j2 @@ -108,9 +108,11 @@ All the detections shipped to different Splunk products. Below is a breakdown by {{ detection.known_false_positives}} #### Reference +{% if detection.references %} {% for reference in detection.references %} * {{ reference }} {% endfor %} +{% endif %} #### Test Dataset {% for dataset in detection.tags.dataset %} diff --git a/bin/jinja2_templates/doc_detections_wiki.j2 b/bin/jinja2_templates/doc_detections_wiki.j2 index e69a4a14b4..1c64ccdefb 100644 --- a/bin/jinja2_templates/doc_detections_wiki.j2 +++ b/bin/jinja2_templates/doc_detections_wiki.j2 @@ -57,9 +57,11 @@ All the detections shipped to different Splunk products. Below is a breakdown by {{ detection.known_false_positives}} ====Reference==== +{% if detection.references %} {% for reference in detection.references %} * {{ reference }} {% endfor %} +{% endif %} ====Test Dataset==== {% for dataset in detection.tags.dataset %} From c829a64ddd6e299bb2e45518ab9eb38961dde81b Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 20 Apr 2021 17:55:06 -0400 Subject: [PATCH 36/72] updating reqs with latest pyattck --- requirements.txt | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/requirements.txt b/requirements.txt index d3f1f5a28e..6ece5919e5 100644 --- a/requirements.txt +++ b/requirements.txt @@ -35,14 +35,14 @@ pathlib2==2.3.5 pendulum==1.2.5 pep517==0.8.2 Pillow==8.1.2 -progress==1.5 -pyattck==2.1.3 -pyfiglet==0.8.post1 -pyparsing==2.4.6 pre-commit==2.11.1 +progress==1.5 prompt-toolkit==1.0.14 +pyattck==3.0.1 +pyfiglet==0.8.post1 Pygments==2.8.1 PyInquirer==1.0.3 +pyparsing==2.4.6 pyrsistent==0.17.3 python-dateutil==2.8.1 pytoml==0.1.21 @@ -62,11 +62,11 @@ stix2==2.1.0 stix2-patterns==1.2.1 taxii2-client==2.3.0 termcolor==1.1.0 +toml==0.10.2 typing==3.7.4.3 tzlocal==2.1 urllib3==1.26.4 virtualenv==20.4.3 wcwidth==0.2.5 webencodings==0.5.1 -toml==0.10.2 zipp==3.4.1 From e040c8bc04d11d8c7c0e31655a6ad0f3c6daa0ef Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Apr 2021 10:04:40 -0600 Subject: [PATCH 37/72] rename phishing payloads to spearphishing attachments --- .../{phishing_payloads.yml => spearphishing_attachments.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename stories/{phishing_payloads.yml => spearphishing_attachments.yml} (97%) diff --git a/stories/phishing_payloads.yml b/stories/spearphishing_attachments.yml similarity index 97% rename from stories/phishing_payloads.yml rename to stories/spearphishing_attachments.yml index bb02015adf..ee7ef3b1bc 100644 --- a/stories/phishing_payloads.yml +++ b/stories/spearphishing_attachments.yml @@ -1,4 +1,4 @@ -name: Phishing Payloads +name: Spearphishing Attachments id: 57226b40-94f3-4ce5-b101-a75f67759c27 version: 1 date: '2019-04-29' @@ -46,7 +46,7 @@ narrative: 'Despite its simplicity, phishing remains the most pervasive and dang references: - https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html tags: - analytic_story: Phishing Payloads + analytic_story: Spearphishing Attachments category: - Adversary Tactics product: From dc319b6edad2e53728e6aee02a50cbd00b24bb15 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Apr 2021 10:16:49 -0600 Subject: [PATCH 38/72] Spearphishing Attachments detections --- .../endpoint/office_application_spawn_rundll32_process.yml | 2 +- .../endpoint/office_document_creating_schedule_task.yml | 2 +- .../endpoint/office_document_executing_macro_code.yml | 2 +- .../office_document_spawned_child_process_to_download.yml | 2 +- .../process_creating_lnk_file_in_suspicious_location.yml | 2 +- ...p_file.yml => detect_outlook_exe_writing_a_zip_file.yml} | 6 +++--- 6 files changed, 8 insertions(+), 8 deletions(-) rename detections/experimental/endpoint/{detect_oulook_exe_writing_a__zip_file.yml => detect_outlook_exe_writing_a_zip_file.yml} (94%) diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 18f6283ebc..a7942cf80e 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -28,7 +28,7 @@ references: - https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe tags: analytic_story: - - Phishing Payloads + - Spearphishing Attachments kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index e19c0b7cb7..35e8c79559 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -34,7 +34,7 @@ references: - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ tags: analytic_story: - - Phishing Payloads + - Spearphishing Attachments kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index da2b5c9f3d..cd5b8965c2 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -27,7 +27,7 @@ references: - https://www.joesandbox.com/analysis/386500/0/html tags: analytic_story: - - Phishing Payloads + - Spearphishing Attachments kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index b76f07bf38..e6b0c896b5 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -26,7 +26,7 @@ references: - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/# tags: analytic_story: - - Phishing Payloads + - Spearphishing Attachments kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index bd62631195..1ac2e4fbcf 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -30,7 +30,7 @@ references: - https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html tags: analytic_story: - - Phishing Payloads + - Spearphishing Attachments asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml b/detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml similarity index 94% rename from detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml rename to detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml index 546b1ca211..6ae32a93c3 100644 --- a/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml +++ b/detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml @@ -1,4 +1,4 @@ -name: Detect Oulook exe writing a zip file +name: Detect Outlook exe writing a zip file id: a51bfe1a-94f0-4822-b1e4-16ae10145893 version: 3 date: '2020-07-21' @@ -22,7 +22,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max( | rename process_id as malicious_id| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] | table firstTime lastTime user malicious_id outlook_id process_name parent_process_name file_name file_path | where file_name - != "" | `detect_oulook_exe_writing_a__zip_file_filter` ' + != "" | `detect_outlook_exe_writing_a_zip_file_filter` ' how_to_implement: You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data @@ -32,7 +32,7 @@ known_false_positives: It is not uncommon for outlook to write legitimate zip fi references: [] tags: analytic_story: - - Phishing Payloads + - Spearphishing Attachments asset_type: Endpoint cis20: - CIS 7 From c2306af1c230abd02ec9984dd6e9a4401e3a6349 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Apr 2021 10:51:30 -0600 Subject: [PATCH 39/72] Update searchprotocolhost_with_no_command_line_with_network.yml --- .../searchprotocolhost_with_no_command_line_with_network.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 21eb49d9a8..ce6bcf4eb6 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -46,7 +46,6 @@ tags: - Splunk Cloud required_fields: - _time - - EventID - process_name - process_id - parent_process_name From 86a0a2e1170e8db6c7419e6e932857c9e83592bc Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Apr 2021 10:52:23 -0600 Subject: [PATCH 40/72] Winword spawning powershell --- .../endpoint/winword_spawning_powershell.yml | 43 +++++++++++++++++++ .../winword_spawning_powershell.test.yml | 12 ++++++ 2 files changed, 55 insertions(+) create mode 100644 detections/endpoint/winword_spawning_powershell.yml create mode 100644 tests/endpoint/winword_spawning_powershell.test.yml diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml new file mode 100644 index 0000000000..09465f031a --- /dev/null +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -0,0 +1,43 @@ +name: Winword Spawning PowerShell +id: b2c950b8-9be2-11eb-8658-acde48001122 +version: 1 +date: '2021-04-12' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. + Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. + During triage, review parallel processes and identify any files that may have been written. +search: '| tstats `security_content_summariesonly` count values(Processes.process) + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name="winword.exe" Processes.process_name IN ("powershell.exe", "pwsh.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `winword_spawning_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited, but if any are present, filter as needed. +references: + - https://redcanary.com/threat-detection-report/techniques/powershell/ + - https://attack.mitre.org/techniques/T1566/001/ + - https://app.any.run/tasks/b79fa381-f35c-4b3e-8d02-507e7ee7342f/ +tags: + analytic_story: + - Spearphishing Attachments + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest_port + - process_path + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/winword_spawning_powershell.test.yml b/tests/endpoint/winword_spawning_powershell.test.yml new file mode 100644 index 0000000000..01f8ac3315 --- /dev/null +++ b/tests/endpoint/winword_spawning_powershell.test.yml @@ -0,0 +1,12 @@ +name: Winword Spawning PowerShell Unit Test +tests: +- name: Winword Spawning PowerShell + file: detections/endpoint/winword_spawning_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From a386c06827484f3e6e83e517930eea9949d12d08 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Apr 2021 10:55:51 -0600 Subject: [PATCH 41/72] Update winword_spawning_powershell.test.yml --- tests/endpoint/winword_spawning_powershell.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/winword_spawning_powershell.test.yml b/tests/endpoint/winword_spawning_powershell.test.yml index 01f8ac3315..db6526a36f 100644 --- a/tests/endpoint/winword_spawning_powershell.test.yml +++ b/tests/endpoint/winword_spawning_powershell.test.yml @@ -1,7 +1,7 @@ name: Winword Spawning PowerShell Unit Test tests: - name: Winword Spawning PowerShell - file: detections/endpoint/winword_spawning_powershell.yml + file: endpoint/winword_spawning_powershell.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From a22e361f72e6b5dc3fc4ffd8fe459661fd7e01d3 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Apr 2021 11:19:30 -0600 Subject: [PATCH 42/72] Update dllhost_with_no_command_line_arguments_with_network.test.yml --- ...lhost_with_no_command_line_arguments_with_network.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml index 9a52747583..64fcaac42d 100644 --- a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml +++ b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: windows-sysmon_dllhost.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 5d51234deca6f7672ea993e2b9c1dce3b1252bf7 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Apr 2021 11:34:42 -0600 Subject: [PATCH 43/72] Update winword_spawning_powershell.yml --- .../endpoint/winword_spawning_powershell.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index 09465f031a..6da9abb29b 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -9,10 +9,11 @@ datamodel: description: The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. -search: '| tstats `security_content_summariesonly` count values(Processes.process) - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process_name="winword.exe" Processes.process_name IN ("powershell.exe", "pwsh.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `winword_spawning_powershell_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" Processes.process_name IN ("powershell.exe", "pwsh.exe") by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `winword_spawning_powershell_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -38,6 +39,7 @@ tags: - process_name - process_id - parent_process_name - - dest_port - - process_path + - dest + - user + - parent_process_id security_domain: endpoint \ No newline at end of file From ae87327c98f2e2058fbef10a3abc7eb97942bc03 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Apr 2021 11:55:18 -0600 Subject: [PATCH 44/72] dllhost test again --- .../dllhost_with_no_command_line_arguments_with_network.yml | 2 +- ...dllhost_with_no_command_line_arguments_with_network.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 12a6c28b9d..a77a8836d4 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -12,7 +12,7 @@ description: The following analytic identifies DLLHost.exe with no command line During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -search: ' | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` diff --git a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml index 64fcaac42d..bcd7fb2a54 100644 --- a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml +++ b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From b6ad8f0efbe596b1be127417d903bd7481bdf587 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 21 Apr 2021 17:56:41 +0000 Subject: [PATCH 45/72] Added detection testing service results inWinword Spawning PowerShell --- .../endpoint/winword_spawning_powershell.yml | 34 ++++++++++++------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index 6da9abb29b..9aab36b3f2 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -6,26 +6,33 @@ author: Michael Haag, Splunk type: batch datamodel: - Endpoint -description: The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. - Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. - During triage, review parallel processes and identify any files that may have been written. +description: The following detection identifies Microsoft Word spawning PowerShell. + Typically, this is not common behavior and not default with winword.exe. Winword.exe + will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` + (version will vary). PowerShell spawning from winword.exe is common for a spearphishing + attachment and is actively used. Albeit, the command executed will most likely be + encoded and captured via another detection. During triage, review parallel processes + and identify any files that may have been written. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" Processes.process_name IN ("powershell.exe", "pwsh.exe") by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `winword_spawning_powershell_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" + Processes.process_name IN ("powershell.exe", "pwsh.exe") by Processes.dest Processes.user + Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `winword_spawning_powershell_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: False positives should be limited, but if any are present, filter as needed. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. references: - - https://redcanary.com/threat-detection-report/techniques/powershell/ - - https://attack.mitre.org/techniques/T1566/001/ - - https://app.any.run/tasks/b79fa381-f35c-4b3e-8d02-507e7ee7342f/ +- https://redcanary.com/threat-detection-report/techniques/powershell/ +- https://attack.mitre.org/techniques/T1566/001/ +- https://app.any.run/tasks/b79fa381-f35c-4b3e-8d02-507e7ee7342f/ tags: analytic_story: - Spearphishing Attachments - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -42,4 +49,5 @@ tags: - dest - user - parent_process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From 94df7ff6659ab681c992bba1d0f945abf5958861 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 21 Apr 2021 18:14:25 +0000 Subject: [PATCH 46/72] Added detection testing service results inDLLHost with no Command Line Arguments with Network --- ...no_command_line_arguments_with_network.yml | 45 +++++++++---------- 1 file changed, 22 insertions(+), 23 deletions(-) diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index a77a8836d4..f0704f8f1e 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -6,36 +6,34 @@ author: Michael Haag, Splunk type: batch datamodel: - Endpoint -description: The following analytic identifies DLLHost.exe with no command line arguments with a network connection. - It is unusual for DLLHost.exe to execute with no command line arguments present. - This particular behavior is common with malicious software, including Cobalt Strike. - During investigation, triage any network connections and parallel processes. Identify - any suspicious module loads related to credential dumping or file writes. DLLHost.exe - is natively found in C:\Windows\system32 and C:\Windows\syswow64. +description: The following analytic identifies DLLHost.exe with no command line arguments + with a network connection. It is unusual for DLLHost.exe to execute with no command + line arguments present. This particular behavior is common with malicious software, + including Cobalt Strike. During investigation, triage any network connections and + parallel processes. Identify any suspicious module loads related to credential dumping + or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | regex process="(dllhost\.exe.{0,4}$)" - | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port - | `drop_dm_object_name(Ports)` - | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC - dest_port | `dllhost_with_no_command_line_arguments_with_network_filter`' + where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id + Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(dllhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id + Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process process_id + connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. -known_false_positives: Although unlikely, some legitimate third party applications may use a moved - copy of dllhost, triggering a false positive. +known_false_positives: Although unlikely, some legitimate third party applications + may use a moved copy of dllhost, triggering a false positive. references: - - https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile - - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ +- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile +- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ tags: analytic_story: - Cobalt Strike - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -52,4 +50,5 @@ tags: - parent_process_name - dest_port - process_path - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From 59b1f289d7b61487af6f05c39b992767704a055f Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Apr 2021 13:11:40 -0600 Subject: [PATCH 47/72] Excel posh --- .../endpoint/excel_spawning_powershell.yml | 46 +++++++++++++++++++ .../excel_spawning_powershell.test.yml | 12 +++++ 2 files changed, 58 insertions(+) create mode 100644 detections/endpoint/excel_spawning_powershell.yml create mode 100644 tests/endpoint/excel_spawning_powershell.test.yml diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml new file mode 100644 index 0000000000..a515e2801f --- /dev/null +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -0,0 +1,46 @@ +name: Excel Spawning PowerShell +id: 42d40a22-9be3-11eb-8f08-acde48001122 +version: 1 +date: '2021-04-12' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies Microsoft Excel spawning PowerShell. + Typically, this is not common behavior and not default with Excel.exe. Excel.exe + will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` + (version will vary). PowerShell spawning from Excel.exe is common for a spearphishing + attachment and is actively used. Albeit, the command executed will most likely be + encoded and captured via another detection. During triage, review parallel processes + and identify any files that may have been written. +search: '| tstats `security_content_summariesonly` count values(Processes.process) + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name="excel.exe" Processes.process_name IN ("powershell.exe", "pwsh.exe") by Processes.parent_process Processes.process_name + Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `excel_spawning_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: +tags: + analytic_story: + - Spearphishing Attachments + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/excel_spawning_powershell.test.yml b/tests/endpoint/excel_spawning_powershell.test.yml new file mode 100644 index 0000000000..c727cd2f58 --- /dev/null +++ b/tests/endpoint/excel_spawning_powershell.test.yml @@ -0,0 +1,12 @@ +name: Excel Spawning PowerShell Unit Test +tests: +- name: Excel Spawning PowerShell + file: endpoint/excel_spawning_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From 93bde1eceab4f38acccc6a01730dd88420814470 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 21 Apr 2021 13:13:37 -0600 Subject: [PATCH 48/72] Update excel_spawning_powershell.yml --- detections/endpoint/excel_spawning_powershell.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index a515e2801f..83b11858fb 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -23,6 +23,8 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives should be limited, but if any are present, filter as needed. references: + - https://redcanary.com/threat-detection-report/techniques/powershell/ + - https://attack.mitre.org/techniques/T1566/001/ tags: analytic_story: - Spearphishing Attachments From c0835e27c408f428f8701fbbee1c2ee43d80f044 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 21 Apr 2021 19:42:18 +0000 Subject: [PATCH 49/72] Added detection testing service results inExcel Spawning PowerShell --- .../endpoint/excel_spawning_powershell.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index 83b11858fb..5c4cbf45b5 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -15,20 +15,23 @@ description: The following detection identifies Microsoft Excel spawning PowerSh and identify any files that may have been written. search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process_name="excel.exe" Processes.process_name IN ("powershell.exe", "pwsh.exe") by Processes.parent_process Processes.process_name - Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `excel_spawning_powershell_filter`' + where Processes.parent_process_name="excel.exe" Processes.process_name IN ("powershell.exe", + "pwsh.exe") by Processes.parent_process Processes.process_name Processes.user Processes.dest + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + | `excel_spawning_powershell_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: False positives should be limited, but if any are present, filter as needed. references: - - https://redcanary.com/threat-detection-report/techniques/powershell/ - - https://attack.mitre.org/techniques/T1566/001/ +- https://redcanary.com/threat-detection-report/techniques/powershell/ +- https://attack.mitre.org/techniques/T1566/001/ tags: analytic_story: - Spearphishing Attachments - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,4 +48,5 @@ tags: - dest - user - parent_process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From 5f85f5e7e9577ddcd5432d4e6bf9ee4c2ba1de91 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Apr 2021 07:38:08 -0600 Subject: [PATCH 50/72] Excel WSH --- .../excel_spawning_windows_script_host.yml | 48 +++++++++++++++++++ ...xcel_spawning_windows_script_host.test.yml | 12 +++++ 2 files changed, 60 insertions(+) create mode 100644 detections/endpoint/excel_spawning_windows_script_host.yml create mode 100644 tests/endpoint/excel_spawning_windows_script_host.test.yml diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml new file mode 100644 index 0000000000..7c6f04f3ec --- /dev/null +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -0,0 +1,48 @@ +name: Excel Spawning Windows Script Host +id: 57fe880a-9be3-11eb-9bf3-acde48001122 +version: 1 +date: '2021-04-12' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies Microsoft Excel spawning Windows Script Host - `cscript.exe` or `wscript.exe`. + Typically, this is not common behavior and not default with Excel.exe. Excel.exe + will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` + (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`. `cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing + attachment and is actively used. Albeit, the command-line executed will most likely be + obfuscated and captured via another detection. During triage, review parallel processes + and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. +search: '| tstats `security_content_summariesonly` count values(Processes.process) + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name="excel.exe" Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.parent_process Processes.process_name + Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `excel_spawning_windows_script_host_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. In some instances, `cscript.exe` is used for legitimate business practices. +references: +- https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/ +- https://attack.mitre.org/techniques/T1566/001/ +tags: + analytic_story: + - Spearphishing Attachments + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/excel_spawning_windows_script_host.test.yml b/tests/endpoint/excel_spawning_windows_script_host.test.yml new file mode 100644 index 0000000000..9f3e80bd51 --- /dev/null +++ b/tests/endpoint/excel_spawning_windows_script_host.test.yml @@ -0,0 +1,12 @@ +name: Excel Spawning Windows Script Host Unit Test +tests: +- name: Excel Spawning Windows Script Host + file: endpoint/excel_spawning_windows_script_host.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 28a498daa7d1d5da525d89231640cfa98a7bd0e7 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 22 Apr 2021 14:01:17 +0000 Subject: [PATCH 51/72] Added detection testing service results inExcel Spawning Windows Script Host --- .../excel_spawning_windows_script_host.yml | 32 ++++++++++++------- 1 file changed, 20 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index 7c6f04f3ec..ece7424791 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -6,29 +6,36 @@ author: Michael Haag, Splunk type: batch datamodel: - Endpoint -description: The following detection identifies Microsoft Excel spawning Windows Script Host - `cscript.exe` or `wscript.exe`. - Typically, this is not common behavior and not default with Excel.exe. Excel.exe - will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` - (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`. `cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing - attachment and is actively used. Albeit, the command-line executed will most likely be - obfuscated and captured via another detection. During triage, review parallel processes - and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. +description: The following detection identifies Microsoft Excel spawning Windows Script + Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and + not default with Excel.exe. Excel.exe will generally be found in the following path + `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` + or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`. + `cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing + attachment and is actively used. Albeit, the command-line executed will most likely + be obfuscated and captured via another detection. During triage, review parallel + processes and identify any files that may have been written. Review the reputation + of the remote destination and block accordingly. search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process_name="excel.exe" Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.parent_process Processes.process_name - Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `excel_spawning_windows_script_host_filter`' + where Processes.parent_process_name="excel.exe" Processes.process_name IN ("cscript.exe", + "wscript.exe") by Processes.parent_process Processes.process_name Processes.user + Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + | `excel_spawning_windows_script_host_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: False positives should be limited, but if any are present, - filter as needed. In some instances, `cscript.exe` is used for legitimate business practices. + filter as needed. In some instances, `cscript.exe` is used for legitimate business + practices. references: - https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/ - https://attack.mitre.org/techniques/T1566/001/ tags: analytic_story: - Spearphishing Attachments - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,4 +52,5 @@ tags: - dest - user - parent_process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From 6973e3029006ef2a3812a2168e69ecdbdf5bb7e1 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Apr 2021 09:23:46 -0600 Subject: [PATCH 52/72] winword wsh --- .../endpoint/winword_spawning_powershell.yml | 1 + .../winword_spawning_windows_script_host.yml | 51 +++++++++++++++++++ ...word_spawning_windows_script_host.test.yml | 12 +++++ 3 files changed, 64 insertions(+) create mode 100644 detections/endpoint/winword_spawning_windows_script_host.yml create mode 100644 tests/endpoint/winword_spawning_windows_script_host.test.yml diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index 9aab36b3f2..938e19c154 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -28,6 +28,7 @@ references: - https://redcanary.com/threat-detection-report/techniques/powershell/ - https://attack.mitre.org/techniques/T1566/001/ - https://app.any.run/tasks/b79fa381-f35c-4b3e-8d02-507e7ee7342f/ +- https://app.any.run/tasks/181ac90b-0898-4631-8701-b778a30610ad/ tags: analytic_story: - Spearphishing Attachments diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml new file mode 100644 index 0000000000..f3e509862d --- /dev/null +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -0,0 +1,51 @@ +name: Winword Spawning Windows Script Host +id: 637e1b5c-9be1-11eb-9c32-acde48001122 +version: 1 +date: '2021-04-12' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies Microsoft Winword.exe spawning Windows Script + Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and + not default with Winword.exe. Winword.exe will generally be found in the following path + `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` + or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64\`. + `cscript.exe` or `wscript.exe` spawning from Winword.exe is common for a spearphishing + attachment and is actively used. Albeit, the command-line executed will most likely + be obfuscated and captured via another detection. During triage, review parallel + processes and identify any files that may have been written. Review the reputation + of the remote destination and block accordingly. +search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `winword_spawning_windows_script_host_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: There will be limited false positives and it will be different for every environment. Tune by child process or command-line as needed. +references: + - https://attack.mitre.org/techniques/T1566/001/ +tags: + analytic_story: + - Spearphishing Attachment + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/winword_spawning_windows_script_host.test.yml b/tests/endpoint/winword_spawning_windows_script_host.test.yml new file mode 100644 index 0000000000..b86e113fa5 --- /dev/null +++ b/tests/endpoint/winword_spawning_windows_script_host.test.yml @@ -0,0 +1,12 @@ +name: Winword Spawning Windows Script Host Unit Test +tests: +- name: Winword Spawning Windows Script Host + file: endpoint/winword_spawning_windows_script_host.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From c00de66c2f576ccc656bd7091a3a806e83211ceb Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Apr 2021 09:50:32 -0600 Subject: [PATCH 53/72] winword cmd --- detections/endpoint/winword_spawning_cmd.yml | 49 ++++++++++++++++++++ tests/endpoint/winword_spawning_cmd.test.yml | 12 +++++ 2 files changed, 61 insertions(+) create mode 100644 detections/endpoint/winword_spawning_cmd.yml create mode 100644 tests/endpoint/winword_spawning_cmd.test.yml diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml new file mode 100644 index 0000000000..38ddb879a3 --- /dev/null +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -0,0 +1,49 @@ +name: Winword Spawning Cmd +id: 6fcbaedc-a37b-11eb-956b-acde48001122 +version: 1 +date: '2021-04-22' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies Microsoft Word spawning `cmd.exe`. + Typically, this is not common behavior and not default with winword.exe. Winword.exe + will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` + (version will vary). Cmd.exe spawning from winword.exe is common for a spearphishing + attachment and is actively used. Albeit, the command-line will indicate what is being executed. + During triage, review parallel processes and identify any files that may have been written. It is possible that COM is utilized to trampoline the child process to `explorer.exe` or `wmiprvse.exe`. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winword.exe + Processes.process_name=cmd.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `winword_spawning_cmd_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: + - https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/ +tags: + analytic_story: + - Spearphishing Attachments + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/winword_spawning_cmd.test.yml b/tests/endpoint/winword_spawning_cmd.test.yml new file mode 100644 index 0000000000..09bc7b9d04 --- /dev/null +++ b/tests/endpoint/winword_spawning_cmd.test.yml @@ -0,0 +1,12 @@ +name: Winword Spawning Cmd Unit Test +tests: +- name: Winword Spawning Cmd + file: detections/endpoint/winword_spawning_cmd.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From b86ece00d898b1e8575665a7dd7b3fcd2310306c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Apr 2021 09:52:23 -0600 Subject: [PATCH 54/72] Update winword_spawning_cmd.test.yml --- tests/endpoint/winword_spawning_cmd.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/winword_spawning_cmd.test.yml b/tests/endpoint/winword_spawning_cmd.test.yml index 09bc7b9d04..d4690cf41c 100644 --- a/tests/endpoint/winword_spawning_cmd.test.yml +++ b/tests/endpoint/winword_spawning_cmd.test.yml @@ -1,7 +1,7 @@ name: Winword Spawning Cmd Unit Test tests: - name: Winword Spawning Cmd - file: detections/endpoint/winword_spawning_cmd.yml + file: endpoint/winword_spawning_cmd.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 029c463ce8ce9f82c44710b58342ec962248d412 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Apr 2021 10:00:32 -0600 Subject: [PATCH 55/72] Update searchprotocolhost_with_no_command_line_with_network.test.yml --- ...earchprotocolhost_with_no_command_line_with_network.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/searchprotocolhost_with_no_command_line_with_network.test.yml b/tests/endpoint/searchprotocolhost_with_no_command_line_with_network.test.yml index b9623222ea..f585781bed 100644 --- a/tests/endpoint/searchprotocolhost_with_no_command_line_with_network.test.yml +++ b/tests/endpoint/searchprotocolhost_with_no_command_line_with_network.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 88688f9960b123530a5500ca09c1736ff3ba2fbe Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Apr 2021 10:10:47 -0600 Subject: [PATCH 56/72] duplicate detection --- .../aws_excessive_list_command_usage.yml | 47 ------------------- .../aws_excessive_list_command_usage.test.yml | 13 ----- 2 files changed, 60 deletions(-) delete mode 100644 detections/cloud/aws_excessive_list_command_usage.yml delete mode 100644 tests/cloud/aws_excessive_list_command_usage.test.yml diff --git a/detections/cloud/aws_excessive_list_command_usage.yml b/detections/cloud/aws_excessive_list_command_usage.yml deleted file mode 100644 index a71acc784d..0000000000 --- a/detections/cloud/aws_excessive_list_command_usage.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: AWS Excessive List Command Usage -id: d1767712-9650-11eb-a8e6-acde48001122 -version: 1 -date: '2021-04-05' -author: Michael Haag, Splunk -type: batch -datamodel: [] -description: The following detection identifies distict list commands ran against - the AWS environment over a 1 hour period of time. The idea is that, if a AWS key - is lost/stolen, the adversary will begin to perform many list-* queries against - the environment to gather further information about the account. -search: '`cloudtrail` (command = List*) user_type=IAMUser (userAgent!=*.amazonaws.com) - | bucket _time span=1h | stats count min(_time) as firstTime max(_time) as lastTime - , dc(command) as distinct_command_count,values(errorCode) as errorCode values(eventSource) - as eventSource values(command) as command values(userAgent) as userAgent by src_ip, - userName, _time | where count >= 10 and distinct_command_count > 1 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `aws_excessive_list_command_usage_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize - this data. The search requires AWS Cloudtrail logs. -known_false_positives: It is possible ther ewill be false positives based on the count - numbers used. Tune accordingly based on IP or user associated. From there, tune - the values to set an upper limit for your environment. -references: -- https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html -tags: - analytic_story: - - AWS IAM Privilege Escalation - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_excessive_list_command_usage/aws_iam_excessive_list_command_usage.json - kill_chain_phases: - - Reconnaissance - mitre_attack_id: - - T1580 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - - Splunk Security Analytics for AWS - required_fields: - - _time - - eventName - - errorCode - - command - - eventSource - - userAgent - security_domain: access - automated_detection_testing: passed diff --git a/tests/cloud/aws_excessive_list_command_usage.test.yml b/tests/cloud/aws_excessive_list_command_usage.test.yml deleted file mode 100644 index 13b5defdda..0000000000 --- a/tests/cloud/aws_excessive_list_command_usage.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: AWS Excessive List Command Usage Unit Test -tests: -- name: AWS Excessive List Command Usage - file: cloud/aws_excessive_list_command_usage.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: aws_iam_excessive_list_command_usage.json - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_excessive_list_command_usage/aws_iam_excessive_list_command_usage.json - sourcetype: aws:cloudtrail - source: aws_cloudtrail - update_timestamp: True From 2b40cfec8bf79c02cabc7fdc906ce1e831525e2a Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Apr 2021 10:21:36 -0600 Subject: [PATCH 57/72] remove root aws detections and update aws detection --- ...aws_iam_assume_role_policy_brute_force.yml | 5 ++- ...reation_usage_of_access_keys_with_root.yml | 38 ------------------- .../cloud/aws_iam_failure_group_deletion.yml | 2 +- ...on_usage_of_access_keys_with_root.test.yml | 13 ------- 4 files changed, 4 insertions(+), 54 deletions(-) delete mode 100644 detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml delete mode 100644 tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index d48b6406bd..79a04c16f2 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -6,8 +6,8 @@ author: Michael Haag, Splunk type: batch datamodel: [] description: The following detection identifies any malformed policy document exceptions - with a status of `failure`. Meaning, when an adversary is attempting to identify - a role name, multiple failures will occur. + with a status of `failure`. A malformed policy document exception occurs in instances where roles are attempted to be assumed, or brute forced. In a brute force attempt, using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`. Meaning, when an adversary is attempting to identify + a role name, multiple failures will occur. This detection focuses on the errors of a remote attempt that is failing. search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource @@ -22,6 +22,7 @@ known_false_positives: This detection will require tuning to provide high fideli or by groups of users. references: - https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities +- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ - https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html tags: analytic_story: diff --git a/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml b/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml deleted file mode 100644 index e2a9cc748e..0000000000 --- a/detections/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: AWS IAM Detect Creation Usage of Access Keys with Root -id: 42528528-9329-11eb-9fe1-acde48001122 -version: 1 -date: '2021-04-01' -author: Michael Haag, Splunk -type: batch -datamodel: [] -description: THe following detection is aimed at detecting the Root user account creating keys. This is generally not an activity that would be performed after the Root account is locked down. -search: '`cloudtrail` eventName IN (CreateKey, CreateAccessKey) userName=root (userAgent!=*.amazonaws.com) -| stats count min(_time) as firstTime max(_time) as lastTime values(userName) by src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `aws_iam_detect_creation_usage_of_access_keys_with_root_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: Using the Root account for day to day activity is against best practices. Once Root is no longer used or needed for day to day operations, begin monitoring for usage. -references: -- https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html -tags: - analytic_story: - - AWS IAM Privilege Escalation - dataset: [] - kill_chain_phases: - - Privilege Escalation - mitre_attack_id: - - T1078.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - - Splunk Security Analytics for AWS - required_fields: - - _time - - eventName - - userAgent - - errorCode - - eventSource - - user_arn - security_domain: access \ No newline at end of file diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index b550c785fd..e9838fea92 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -5,7 +5,7 @@ date: '2021-04-01' author: Michael Haag, Splunk type: batch datamodel: [] -description: This detection identifies the inverse of success. We want to identify +description: This detection identifies failure attempts to delete groups. We want to identify when a group is attempting to be deleted, but either access is denied, there is a conflict or there is no group. This is indicative of administrators performing an action, but also could be suspicious behavior occurring. Review parallel IAM diff --git a/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml b/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml deleted file mode 100644 index 50fefd37b2..0000000000 --- a/tests/cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: AWS IAM Detect Creation Usage of Access Keys with Root Unit Test -tests: -- name: AWS IAM Detect Creation Usage of Access Keys with Root - file: cloud/aws_iam_detect_creation_usage_of_access_keys_with_root.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: aws_cloudtrail_events.json - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json - sourcetype: aws:cloudtrail - source: aws_cloudtrail - update_timestamp: True From 48acf3704584b922987b73cfd01ab875eb4459cb Mon Sep 17 00:00:00 2001 From: root Date: Thu, 22 Apr 2021 16:22:45 +0000 Subject: [PATCH 58/72] Added detection testing service results inSearchProtocolHost with no Command Line with Network --- ...host_with_no_command_line_with_network.yml | 37 +++++++++---------- 1 file changed, 18 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index ce6bcf4eb6..7f033adf73 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -7,24 +7,21 @@ type: batch datamodel: - Endpoint description: The following analytic identifies searchprotocolhost.exe with no command - line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command - line arguments present. This particular behavior is common with malicious software, - including Cobalt Strike. During investigation, identify any network connections - and parallel processes. Identify any suspicious module loads related to credential - dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 - and C:\Windows\syswow64. + line arguments and with a network connection. It is unusual for searchprotocolhost.exe + to execute with no command line arguments present. This particular behavior is common + with malicious software, including Cobalt Strike. During investigation, identify + any network connections and parallel processes. Identify any suspicious module loads + related to credential dumping or file writes. searchprotocolhost.exe is natively + found in C:\Windows\system32 and C:\Windows\syswow64. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | regex process="(searchprotocolhost\.exe.{0,4}$)" - | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port - | `drop_dm_object_name(Ports)` - | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC - dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`' + where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id + Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats + `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port + !="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` + | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name + process_path process process_id connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node. @@ -35,7 +32,8 @@ references: tags: analytic_story: - Cobalt Strike - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -51,4 +49,5 @@ tags: - parent_process_name - dest_port - process_path - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From ddf4aaf21018e3ac9f15a5071601cb8a34c8bd2d Mon Sep 17 00:00:00 2001 From: root Date: Thu, 22 Apr 2021 16:40:19 +0000 Subject: [PATCH 59/72] Added detection testing service results inWinword Spawning Cmd --- detections/endpoint/winword_spawning_cmd.yml | 23 +++++++++++--------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml index 38ddb879a3..87fd2c182c 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -10,26 +10,28 @@ description: The following detection identifies Microsoft Word spawning `cmd.exe Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). Cmd.exe spawning from winword.exe is common for a spearphishing - attachment and is actively used. Albeit, the command-line will indicate what is being executed. - During triage, review parallel processes and identify any files that may have been written. It is possible that COM is utilized to trampoline the child process to `explorer.exe` or `wmiprvse.exe`. + attachment and is actively used. Albeit, the command-line will indicate what is + being executed. During triage, review parallel processes and identify any files + that may have been written. It is possible that COM is utilized to trampoline the + child process to `explorer.exe` or `wmiprvse.exe`. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winword.exe - Processes.process_name=cmd.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `winword_spawning_cmd_filter`' + Processes.process_name=cmd.exe by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `winword_spawning_cmd_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: False positives should be limited, but if any are present, filter as needed. references: - - https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/ +- https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/ tags: analytic_story: - Spearphishing Attachments - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -46,4 +48,5 @@ tags: - dest - user - parent_process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From 77d1364c16c9f4674b52362a8b2308c786655fb1 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Apr 2021 11:20:45 -0600 Subject: [PATCH 60/72] Office Product Spawning Rundll32 with no DLL --- ..._product_spawning_rundll32_with_no_dll.yml | 47 +++++++++++++++++++ ...uct_spawning_rundll32_with_no_dll.test.yml | 12 +++++ 2 files changed, 59 insertions(+) create mode 100644 detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml create mode 100644 tests/endpoint/office_product_spawning_rundll32_with_no_dll.test.yml diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml new file mode 100644 index 0000000000..73e6478a38 --- /dev/null +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -0,0 +1,47 @@ +name: Office Product Spawning Rundll32 with no DLL +id: c661f6be-a38c-11eb-be57-acde48001122 +version: 1 +date: '2021-04-22' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies the latest behavior utilized by IcedID malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. + In addition, Threat Research has released a detection identifying the use of `DllRegisterServer` on the command-line of `rundll32.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. + During triage, review all file modifications. Capture and analyze the `DLL` that was dropped to disk. The Office Product will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=rundll32.exe + (Processes.process!=*.dll*) by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_rundll32_with_no_dll_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: + - https://www.joesandbox.com/analysis/395471/0/html + - https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/ + - https://any.run/malware-trends/icedid +tags: + analytic_story: + - Spearphishing Attachments + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/office_product_spawning_rundll32_with_no_dll.test.yml b/tests/endpoint/office_product_spawning_rundll32_with_no_dll.test.yml new file mode 100644 index 0000000000..bd2950c9c2 --- /dev/null +++ b/tests/endpoint/office_product_spawning_rundll32_with_no_dll.test.yml @@ -0,0 +1,12 @@ +name: Office Product Spawning Rundll32 with no DLL Unit Test +tests: +- name: Office Product Spawning Rundll32 with no DLL + file: endpoint/office_product_spawning_rundll32_with_no_dll.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_icedid.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From 56c645560aecb1ac3a71994188693bc7627fef75 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Apr 2021 11:29:59 -0600 Subject: [PATCH 61/72] Update winword_spawning_windows_script_host.test.yml --- tests/endpoint/winword_spawning_windows_script_host.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/winword_spawning_windows_script_host.test.yml b/tests/endpoint/winword_spawning_windows_script_host.test.yml index b86e113fa5..0739cfebc7 100644 --- a/tests/endpoint/winword_spawning_windows_script_host.test.yml +++ b/tests/endpoint/winword_spawning_windows_script_host.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From 621a5ec81be301ffb13a1f8cc381d9d375d140f9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Apr 2021 10:41:02 -0700 Subject: [PATCH 62/72] Update aws_iam_accessdenied_discovery_events.yml --- detections/cloud/aws_iam_accessdenied_discovery_events.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index 30a6a756f6..fc6c5ac56a 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -24,7 +24,7 @@ references: - https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/ tags: analytic_story: - - AWS IAM Privilege Escalation + - Suspicious Cloud User Activities dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json kill_chain_phases: From 47212a6443b086a2814829191f0931a8de8f6198 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Apr 2021 10:42:12 -0700 Subject: [PATCH 63/72] Update aws_iam_root_account_login.yml --- detections/cloud/aws_iam_root_account_login.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_iam_root_account_login.yml b/detections/cloud/aws_iam_root_account_login.yml index 38052dbe3b..73d01a3fce 100644 --- a/detections/cloud/aws_iam_root_account_login.yml +++ b/detections/cloud/aws_iam_root_account_login.yml @@ -17,7 +17,7 @@ references: - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html tags: analytic_story: - - AWS IAM Privilege Escalation + - Suspicious Cloud Authentication Activities dataset: [] kill_chain_phases: - Intrusion @@ -33,4 +33,4 @@ tags: - eventName - userAgent - errorCode - security_domain: access \ No newline at end of file + security_domain: access From 102ccc889b1d31200926d7507d2fe39d969b3e0f Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Apr 2021 10:44:02 -0700 Subject: [PATCH 64/72] Update aws_iam_root_account_login.yml --- detections/cloud/aws_iam_root_account_login.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_iam_root_account_login.yml b/detections/cloud/aws_iam_root_account_login.yml index 73d01a3fce..b414753215 100644 --- a/detections/cloud/aws_iam_root_account_login.yml +++ b/detections/cloud/aws_iam_root_account_login.yml @@ -20,7 +20,7 @@ tags: - Suspicious Cloud Authentication Activities dataset: [] kill_chain_phases: - - Intrusion + - Exploitation mitre_attack_id: - T1078.004 product: From fbb1986114ede21d07c0c9682d4924940e77c5f6 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Apr 2021 10:44:46 -0700 Subject: [PATCH 65/72] Update aws_iam_successful_group_deletion.yml --- detections/cloud/aws_iam_successful_group_deletion.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 4befb51ad1..e1461bb777 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -29,8 +29,7 @@ tags: dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json kill_chain_phases: - - Denial of Service - - Privilege Escalation + - Actions on Objectives mitre_attack_id: - T1069.003 - T1098 From 69debe6e26f56c38af5080aae02594bd23344ee0 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Apr 2021 10:46:16 -0700 Subject: [PATCH 66/72] Update aws_iam_assume_role_policy_brute_force.yml --- detections/cloud/aws_iam_assume_role_policy_brute_force.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 79a04c16f2..103b328646 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -30,7 +30,7 @@ tags: dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json kill_chain_phases: - - Privilege Escalation + - Reconnaissance mitre_attack_id: - T1580 - T1110 From 60842e5dc99d649be84a896f4095d26f5fa6904b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Apr 2021 10:46:57 -0700 Subject: [PATCH 67/72] Update aws_iam_delete_policy.yml --- detections/cloud/aws_iam_delete_policy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 7f5ad40d08..3321a6f6bb 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -31,7 +31,7 @@ tags: dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json kill_chain_phases: - - Privilege Escalation + - Actions on Objectives mitre_attack_id: - T1098 product: From cf41087f7b9b7279417cd7a064231011796b955f Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Apr 2021 10:47:38 -0700 Subject: [PATCH 68/72] Update aws_iam_failure_group_deletion.yml --- detections/cloud/aws_iam_failure_group_deletion.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index e9838fea92..e07daaf11c 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -31,8 +31,7 @@ tags: dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json kill_chain_phases: - - Privilege Escalation - - Denial of Service + - Actions on Objectives mitre_attack_id: - T1098 product: From 9c7965ed1f4fe0dce9a143178a06dca9092c830a Mon Sep 17 00:00:00 2001 From: root Date: Thu, 22 Apr 2021 17:49:23 +0000 Subject: [PATCH 69/72] Added detection testing service results inOffice Product Spawning Rundll32 with no DLL --- ..._product_spawning_rundll32_with_no_dll.yml | 36 ++++++++++++------- 1 file changed, 23 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index 73e6478a38..e5872af928 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -6,28 +6,37 @@ author: Michael Haag, Splunk type: batch datamodel: - Endpoint -description: The following detection identifies the latest behavior utilized by IcedID malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. - In addition, Threat Research has released a detection identifying the use of `DllRegisterServer` on the command-line of `rundll32.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. - During triage, review all file modifications. Capture and analyze the `DLL` that was dropped to disk. The Office Product will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. +description: The following detection identifies the latest behavior utilized by IcedID + malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` + without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` + will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. In addition, Threat + Research has released a detection identifying the use of `DllRegisterServer` on + the command-line of `rundll32.exe`. In this instance, we narrow our detection down + to the Office suite as a parent process. During triage, review all file modifications. + Capture and analyze the `DLL` that was dropped to disk. The Office Product will + have reached out to a remote destination, capture and block the IPs or domain. Review + additional parallel processes for further activity. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=rundll32.exe - (Processes.process!=*.dll*) by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_rundll32_with_no_dll_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=rundll32.exe + (Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `office_product_spawning_rundll32_with_no_dll_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: False positives should be limited, but if any are present, filter as needed. references: - - https://www.joesandbox.com/analysis/395471/0/html - - https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/ - - https://any.run/malware-trends/icedid +- https://www.joesandbox.com/analysis/395471/0/html +- https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/ +- https://any.run/malware-trends/icedid tags: analytic_story: - Spearphishing Attachments - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -44,4 +53,5 @@ tags: - dest - user - parent_process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From aa62997e600c4977e17969e23e26469317c3528a Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Apr 2021 11:52:20 -0600 Subject: [PATCH 70/72] removed detections --- .../cloud/aws_iam_root_account_login.yml | 36 ------------------- .../cloud/aws_iam_root_account_login.test.yml | 13 ------- 2 files changed, 49 deletions(-) delete mode 100644 detections/cloud/aws_iam_root_account_login.yml delete mode 100644 tests/cloud/aws_iam_root_account_login.test.yml diff --git a/detections/cloud/aws_iam_root_account_login.yml b/detections/cloud/aws_iam_root_account_login.yml deleted file mode 100644 index b414753215..0000000000 --- a/detections/cloud/aws_iam_root_account_login.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: AWS IAM Root Account Login -id: c2f7330e-9315-11eb-b1d0-acde48001122 -version: 1 -date: '2021-04-01' -author: Michael Haag, Splunk -type: batch -datamodel: [] -description: The following detection identifies the use of the account `root` on the given AWS instance. Per AWS best practices, this account should have MFA enabled and not used for day to day activity. -search: '`cloudtrail` eventName=ConsoleLogin eventSource=signin.amazonaws.com userName=root (userAgent!=*.amazonaws.com) -| stats count min(_time) as firstTime max(_time) as lastTime values(responseElements.ConsoleLogin) as Console_login by src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `aws_iam_root_account_login_filter`' -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: False positives should be limited as the root account should not be used in day to day activity. The detection may be filtered down based on the `action` field - success / failure. -references: -- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html -tags: - analytic_story: - - Suspicious Cloud Authentication Activities - dataset: [] - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1078.004 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - - Splunk Security Analytics for AWS - required_fields: - - _time - - eventName - - userAgent - - errorCode - security_domain: access diff --git a/tests/cloud/aws_iam_root_account_login.test.yml b/tests/cloud/aws_iam_root_account_login.test.yml deleted file mode 100644 index 340dfe2b8b..0000000000 --- a/tests/cloud/aws_iam_root_account_login.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: AWS IAM Root Account Login Unit Test -tests: -- name: AWS IAM Root Account Login - file: cloud/aws_iam_root_account_login.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: aws_cloudtrail_events.json - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json - sourcetype: aws:cloudtrail - source: aws_cloudtrail - update_timestamp: True \ No newline at end of file From 8491518f0838bb08bbdccdb6e15e10fdd37a9119 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 22 Apr 2021 11:59:19 -0600 Subject: [PATCH 71/72] Update winword_spawning_windows_script_host.yml --- detections/endpoint/winword_spawning_windows_script_host.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index f3e509862d..e1e31fb288 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -16,7 +16,7 @@ description: The following detection identifies Microsoft Winword.exe spawning W be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. -search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` From 825cab7da1027e9b860bfb167d206806040c2a6a Mon Sep 17 00:00:00 2001 From: root Date: Thu, 22 Apr 2021 18:20:10 +0000 Subject: [PATCH 72/72] Added detection testing service results inWinword Spawning Windows Script Host --- .../winword_spawning_windows_script_host.yml | 27 ++++++++++--------- 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index e1e31fb288..fcfd73ff5b 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -6,10 +6,10 @@ author: Michael Haag, Splunk type: batch datamodel: - Endpoint -description: The following detection identifies Microsoft Winword.exe spawning Windows Script - Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and - not default with Winword.exe. Winword.exe will generally be found in the following path - `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` +description: The following detection identifies Microsoft Winword.exe spawning Windows + Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior + and not default with Winword.exe. Winword.exe will generally be found in the following + path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64\`. `cscript.exe` or `wscript.exe` spawning from Winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line executed will most likely @@ -17,21 +17,23 @@ description: The following detection identifies Microsoft Winword.exe spawning W processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" + Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.dest Processes.user + Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winword_spawning_windows_script_host_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: There will be limited false positives and it will be different for every environment. Tune by child process or command-line as needed. +known_false_positives: There will be limited false positives and it will be different + for every environment. Tune by child process or command-line as needed. references: - - https://attack.mitre.org/techniques/T1566/001/ +- https://attack.mitre.org/techniques/T1566/001/ tags: analytic_story: - Spearphishing Attachment - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -48,4 +50,5 @@ tags: - dest - user - parent_process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed