admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' of github.com:splunk/security-content into tf23

Browse Source
This commit is contained in:
Xiao Lin
2021-06-27 22:55:23 -07:00
parent fcf426e866 8ab5325de6
commit a5eab04560
142 changed files with 97938 additions and 86834 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.circleci/config.yml
+8 -17
View File
@@ -24,23 +24,11 @@ apt-run: &apt-install
command: |
sudo apt update -qq
sudo apt install -y python-dev python3-dev jq -qq
# install go for other testing tools
# but first lets clean up the env
if [ -f goinstall.sh ]; then
rm goinstall.sh
fi
if [ -d ~/.go ]; then
rm -rf ~/.go
fi
wget https://raw.githubusercontent.com/canha/golang-tools-install-script/master/goinstall.sh
sudo chown circleci goinstall.sh
chmod +x goinstall.sh
./goinstall.sh
executors:
content-executor:
docker:
- image: circleci/python:latest
- image: cimg/python:3.9.5-browsers
working_directory: ~/repo
jobs:
@@ -81,6 +69,11 @@ jobs:
cd security-content
source venv/bin/activate
python contentctl.py --path . --verbose validate
- run:
name: get cti repo for mitre context
command: |
cd security-content
git clone https://github.com/mitre/cti.git
- run:
name: generate documentation
command: |
@@ -188,8 +181,6 @@ jobs:
name: install splunk packaging toolkit (slim)
command: |
cd ~/slim-latest
sudo pip install --upgrade pip setuptools
sudo pip install virtualenv
virtualenv --python=/usr/bin/python2.7 --clear venv
source venv/bin/activate
pip install semantic_version
@@ -244,7 +235,7 @@ jobs:
name: submit saaws package to appinspect API
command: |
cd security-content/bin
./appinspect.sh ~/ DA-ESS_AmazonWebServices_Content-latest.tar.gz $APPINSPECT_USERNAME $APPINSPECT_PASSWORD
./appinspect.sh ~/ DA-ESS_AmazonWebServices_Content-latest.tar.gz $APPINSPECT_USERNAME $APPINSPECT_PASSWORD
- store_artifacts:
path: ~/report
destination: report/
@@ -292,7 +283,7 @@ jobs:
source venv/bin/activate
python bin/pretty_yaml.py --path . -v
- run:
name: get cti repo for mitre-maps
name: get cti repo for mitre context
command: |
cd security-content
git clone https://github.com/mitre/cti.git
automated_detection_testing/requirements.txt
+2 -2
View File
@@ -10,7 +10,7 @@ azure-core==1.14.0
azure-identity==1.6.0
azure-mgmt-compute==20.0.0
azure-mgmt-core==1.2.1
azure-mgmt-network==16.0.0
azure-mgmt-network==19.0.0
azure-mgmt-resource==17.0.0
bcrypt==3.2.0
boto3==1.17.74
@@ -36,8 +36,8 @@ lockfile==0.12.2
MarkupSafe==1.1.1
mock==4.0.3
more-itertools==8.7.0
nodeenv==1.6.0
mysql-connector-python==8.0.25
nodeenv==1.3.4
ntlm-auth==1.5.0
packaging==20.9
path==15.1.2
bin/doc_gen.py
+25 -21
View File
@@ -6,35 +6,39 @@ import re
from os import path, walk
import json
from jinja2 import Environment, FileSystemLoader
from pyattck import Attck
import datetime
from stix2 import FileSystemSource
from stix2 import Filter
def get_all_techniques(projects_path):
path_cti = path.join(projects_path,'cti/enterprise-attack')
fs = FileSystemSource(path_cti)
all_techniques = get_techniques(fs)
return all_techniques
def get_techniques(src):
filt = [Filter('type', '=', 'attack-pattern')]
return src.query(filt)
def mitre_attack_object(technique, attack):
mitre_attack = dict()
mitre_attack['technique_id'] = technique.id
mitre_attack['technique'] = technique.name
mitre_attack['technique_id'] = technique["external_references"][0]["external_id"]
mitre_attack['technique'] = technique["name"]
# process tactics
tactics = []
for tactic in technique.tactics:
tactics.append(tactic.name)
if 'kill_chain_phases' in technique:
for tactic in technique['kill_chain_phases']:
if tactic['kill_chain_name'] == 'mitre-attack':
tactic = tactic['phase_name'].replace('-', ' ')
tactics.append(tactic.title())
mitre_attack['tactic'] = tactics
return mitre_attack
def get_mitre_enrichment_new(attack, mitre_attack_id):
for technique in attack.enterprise.techniques:
apt_groups = []
if '.' in mitre_attack_id:
for subtechnique in technique.subtechniques:
if mitre_attack_id == subtechnique.id:
mitre_attack = mitre_attack_object(subtechnique, attack)
return mitre_attack
elif mitre_attack_id == technique.id:
for technique in attack:
if mitre_attack_id == technique["external_references"][0]["external_id"]:
mitre_attack = mitre_attack_object(technique, attack)
return mitre_attack
return []
@@ -43,7 +47,7 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
manifest_files = []
for root, dirs, files in walk(REPO_PATH + '/stories'):
for file in files:
if file.endswith(".yml"):
if file.endswith(".yml") and root == './stories':
manifest_files.append((path.join(root, file)))
stories = []
@@ -167,7 +171,7 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messages, VERBOSE):
types = ["endpoint", "application", "cloud", "network", "web", "experimental", "deprecated"]
types = ["endpoint", "application", "cloud", "network", "web", "experimental"]
manifest_files = []
for t in types:
for root, dirs, files in walk(REPO_PATH + '/detections/' + t):
@@ -259,11 +263,11 @@ if __name__ == "__main__":
if VERBOSE:
print("getting mitre enrichment data from cti")
attack = Attck()
techniques = get_all_techniques(REPO_PATH)
messages = []
sorted_detections, messages = generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messages, VERBOSE)
sorted_stories, messages = generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_detections, messages, VERBOSE)
sorted_detections, messages = generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, messages, VERBOSE)
sorted_stories, messages = generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, sorted_detections, messages, VERBOSE)
# print all the messages from generation
for m in messages:
bin/generate.py
+17
View File
@@ -25,11 +25,21 @@ def load_objects(file_path, VERBOSE, REPO_PATH):
files.append(load_file(file))
return files
def process_deprecated(file,file_path):
DESCRIPTION_ANNOTATION = "WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. "
if 'deprecated' in file_path:
file['deprecated'] = True
file['description'] = DESCRIPTION_ANNOTATION + file['description']
return file
def load_file(file_path):
with open(file_path, 'r', encoding="utf-8") as stream:
try:
file = list(yaml.safe_load_all(stream))[0]
# mark any files that have been deprecated
file = process_deprecated(file,file_path)
except yaml.YAMLError as exc:
print(exc)
sys.exit("ERROR: reading {0}".format(file_path))
@@ -76,6 +86,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
@return: the savedsearches.conf file located in package/default/
'''
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
@@ -567,10 +578,16 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
workbench_panels_objects = generate_workbench_panels(objects["response_tasks"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
# calculate deprecation totals
deprecated = []
for d in objects['detections']:
if 'deprecated' in d:
deprecated.append(d)
if VERBOSE:
print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), story_path))
print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
print("{0} response tasks have been successfully written to {1}".format(len(objects["response_tasks"]), detection_path))
print("{0} baselines have been successfully written to {1}".format(len(objects["baselines"]), detection_path))
print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
bin/jinja2_templates/savedsearches.j2
+4
View File
@@ -58,7 +58,11 @@ cron_schedule = {{ detection.deployment.scheduling.cron_schedule }}
dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }}
dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
action.correlationsearch.enabled = 1
{% if detection.deprecated is defined %}
action.correlationsearch.label = ESCU - Deprecated - {{ detection.name }} - Rule
{% else %}
action.correlationsearch.label = ESCU - {{ detection.name }} - Rule
{% endif %}
action.correlationsearch.annotations = {{ detection.savedsearch_annotations | tojson }}
{% if detection.deployment.scheduling.schedule_window is defined %}
schedule_window = {{ detection.deployment.scheduling.schedule_window }}
bin/reporting.py
+12 -4
View File
@@ -30,6 +30,7 @@ def load_file(file_path):
def main(args):
print("generated reporting information for our detections")
# process all detections
REPO_PATH = os.path.join(os.path.dirname(__file__), '../')
@@ -41,11 +42,15 @@ def main(args):
detections.extend(load_objects("detections/web/*.yml", REPO_PATH))
detections_all = detections.copy()
detections_all.extend(load_objects("detections/deprecated/*.yml", REPO_PATH))
detections_all.extend(load_objects("detections/experimental/*/*.yml", REPO_PATH))
#lets exclude all deprecated detections from our reporting and experimental
# detections_all.extend(load_objects("detections/deprecated/*.yml", REPO_PATH))
# detections_all.extend(load_objects("detections/experimental/*/*.yml", REPO_PATH))
count_detections_all = len(detections_all)
print("detection count: {}".format(count_detections_all))
tests = load_objects("tests/*/*.yml", REPO_PATH)
print("test count: {}".format(len(tests)))
counter_tests=0
counter_detection=0
@@ -56,8 +61,9 @@ def main(args):
for test in tests:
counter_tests=counter_tests+1
detection_coverage = "{:.0%}".format(counter_tests/counter_detection)
detection_coverage = "{:.0%}".format(counter_detection/counter_tests)
print("detection_coverage {}".format(detection_coverage))
TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), 'jinja2_templates')
OUTPUT_PATH = os.path.join(os.path.dirname(__file__), 'reporting')
@@ -67,12 +73,14 @@ def main(args):
output = template.render(detection_coverage=detection_coverage)
with open(output_path, 'w', encoding="utf-8") as f:
f.write(output)
print("writting detection coverage report: {}".format(output_path))
template = j2_env.get_template('detection_count.j2')
output_path = path.join(OUTPUT_PATH, 'detection_count.svg')
output = template.render(detection_count=count_detections_all)
with open(output_path, 'w', encoding="utf-8") as f:
f.write(output)
print("writting detection count report: {}".format(output_path))
if __name__ == "__main__":
bin/reporting/detection_count.svg
+1 -1
View File
@@ -13,6 +13,6 @@
<rect rx="3" width="105" height="20" fill="url(#a)"/>
<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
<text x="30" y="14">detections</text>
<text x="83" y="14">440</text>
<text x="83" y="14">368</text>
</g>
</svg>
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 654 B

After

Width:  |  Height:  |  Size: 654 B

bin/reporting/detection_coverage.svg
+1 -1
View File
@@ -13,6 +13,6 @@
<rect rx="3" width="100" height="20" fill="url(#a)"/>
<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
<text x="30" y="14">coverage</text>
<text x="80" y="14">100%</text>
<text x="80" y="14">99%</text>
</g>
</svg>
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 653 B

After

Width:  |  Height:  |  Size: 652 B

contentctl.py
+2 -2
View File
@@ -73,7 +73,7 @@ def generate(args):
print("ERROR: contentctl failed to find folder for deployment {0}".format(output))
sys.exit(1)
print("contentctl is generating a new splunk_app under ".format(output))
print("contentctl is generating a new splunk_app under {}".format(output))
generator.main(security_content_path, args.output, args.product, args.verbose)
@@ -112,7 +112,7 @@ def main(args):
generate_parser.add_argument("-o", "--output", required=False, type=str, default="dist/escu",
help="Path where to store the deployment package, defaults to `dist/escu`")
generate_parser.add_argument("--product", required=False, type=str, default="ESCU",
help="Type of package to create, choose between `ESCU`, or `SAAWS`. Defaults to `ESCU`")
help="Type of package to create, choose between `ESCU`, or `SAAWS`. Defaults to `ESCU`")
generate_parser.set_defaults(func=generate)
# # parse them
detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-02-22'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user created a policy
description: This search looks for AWS CloudTrail events where a user created a policy
version that allows them to access any resource in their account
search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com
errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements
@@ -16,7 +16,7 @@ search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.
awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a policy to allow a user to access all
resources. That said, AWS strongly advises against granting full control to all
detections/cloud/aws_createaccesskey.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-03-02'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user A who has already
description: This search looks for AWS CloudTrail events where a user A who has already
permission to create access keys, makes an API call to create access keys for another
user B. Attackers have been know to use this technique for Privilege Escalation
in case new victim(user B) has more permissions than old victim(user B)
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.
eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId
user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created keys for another user.
references:
detections/cloud/aws_createloginprofile.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-03-02'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user A(victim A) creates
description: This search looks for AWS CloudTrail events where a user A(victim A) creates
a login profile for user B, followed by a AWS Console login event from user B from
the same src_ip as user B. This correlated event can be indicative of privilege
escalation since both events happened from the same src_ip
@@ -17,7 +17,7 @@ search: '`cloudtrail` eventName = CreateLoginProfile | rename requestParameters.
awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`] | `aws_createloginprofile_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a login profile for another user.
references:
detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
+1 -1
View File
@@ -19,7 +19,7 @@ search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath inpu
eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs
search works with AWS CloudTrail logs
known_false_positives: unknown
references:
- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
+1 -1
View File
@@ -14,7 +14,7 @@ search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-e
values(userAgent) AS userAgent values(region) AS region values(src) AS src by user
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs
search works with AWS CloudTrail logs
known_false_positives: bucket with S3 encryption
references:
- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
detections/cloud/aws_excessive_security_scanning.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-04-13'
author: Patrick Bareiss, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events and analyse the amount of eventNames
description: This search looks for AWS CloudTrail events and analyse the amount of eventNames
which starts with Describe by a single user. This indicates that this user scans
the configuration of your AWS cloud environment.
search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* |
@@ -14,7 +14,7 @@ search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*
by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives.
references:
- https://github.com/aquasecurity/cloudsploit
detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-01-11'
author: Bhavin Patel, Patrick Bareiss, Splunk
type: batch
datamodel: []
description: The search looks for CloudTrail events to detect if any network ACLs
description: The search looks for AWS CloudTrail events to detect if any network ACLs
were created with all the ports open to a specified CIDR.
search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor
requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail
and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail
inputs.
known_false_positives: It's possible that an admin has created this ACL with all ports
open for some legitimate purpose however, this should be scoped and not allowed
detections/cloud/aws_network_access_control_list_deleted.yml
+2 -2
View File
@@ -9,13 +9,13 @@ description: Enforcing network-access controls is one of the defensive mechanism
used by cloud administrators to restrict access to a cloud instance. After the attacker
has gained control of the AWS console by compromising an admin account, they can
delete a network ACL and gain access to the instance from anywhere. This search
will query the CloudTrail logs to detect users deleting network ACLs.
will query the AWS CloudTrail logs to detect users deleting network ACLs.
search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
| fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName
userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs.
known_false_positives: It's possible that a user has legitimately deleted a network
ACL.
detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as f
userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|`aws_saml_access_by_provider_user_and_principal_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs
search works with AWS CloudTrail logs
known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries
are very difficult to detect as accessing cloud providers with these assertions
looks exactly like normal access, however things such as source IP sourceIPAddress
detections/cloud/aws_saml_update_identity_provider.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as f
userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|`aws_saml_update_identity_provider_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: Updating a SAML provider or creating a new one may not necessarily
be malicious however it needs to be closely monitored.
references:
detections/cloud/aws_setdefaultpolicyversion.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-03-02'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user has set a default
description: This search looks for AWS CloudTrail events where a user has set a default
policy versions. Attackers have been know to use this technique for Privilege Escalation
in case the previous versions of the policy had permissions to access more resources
than the current version of the policy
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazon
errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_setdefaultpolicyversion_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately set a default policy to allow a user to access
all resources. That said, AWS strongly advises against granting full control to
detections/cloud/aws_updateloginprofile.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-03-02'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user A who has already
description: This search looks for AWS CloudTrail events where a user A who has already
permission to update login profile, makes an API call to update login profile for
another user B . Attackers have been know to use this technique for Privilege Escalation
in case new victim(user B) has more permissions than old victim(user B)
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazona
eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userName
user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created keys for another user.
references:
detections/cloud/detect_aws_console_login_by_new_user.yml
+3 -3
View File
@@ -6,7 +6,7 @@ author: Rico Valdez, Splunk
type: batch
datamodel:
- Authentication
description: This search looks for CloudTrail events wherein a console login event
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
@@ -21,8 +21,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines.
known_false_positives: When a legitimate new user logins for the first time, this
detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+3 -3
View File
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
type: batch
datamodel:
- Authentication
description: This search looks for CloudTrail events wherein a console login event
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
@@ -24,8 +24,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter`
detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+3 -3
View File
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
type: batch
datamodel:
- Authentication
description: This search looks for CloudTrail events wherein a console login event
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
@@ -24,8 +24,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter`
detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+3 -3
View File
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
type: batch
datamodel:
- Authentication
description: This search looks for CloudTrail events wherein a console login event
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
@@ -24,8 +24,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter`
detections/cloud/detect_new_open_s3_buckets.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2021-01-12'
author: Bhavin Patel, Patrick Bareiss, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user has created an open/public
description: This search looks for AWS CloudTrail events where a user has created an open/public
S3 bucket.
search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw
"(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{}
detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2021-01-12'
author: Patrick Bareiss, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user has created an open/public
description: This search looks for AWS CloudTrail events where a user has created an open/public
S3 bucket over the aws cli.
search: '`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write
detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2020-07-21'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user successfully launches
description: This search looks for AWS CloudTrail events where a user successfully launches
an abnormally high number of instances. This search is deprecated and have been
translated to use the latest Change Datamodel
search: '`cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m _time
@@ -17,7 +17,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m
/ total_launched_stdev, 2) | table _time, userName, instances_launched, num_standard_deviations_away,
total_launched_avg, total_launched_stdev | `abnormally_high_aws_instances_launched_by_user_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. The threshold value should be tuned to your environment.
known_false_positives: Many service accounts configured within an AWS infrastructure
are known to exhibit this behavior. Please adjust the threshold values and filter
detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2020-07-21'
author: Jason Brewer, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user successfully launches
description: This search looks for AWS CloudTrail events where a user successfully launches
an abnormally high number of instances. This search is deprecated and have been
translated to use the latest Change Datamodel.
search: '`cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_aws_instances_launched_by_user___mltk_filter`
@@ -13,7 +13,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_
apply ec2_excessive_runinstances_v1 | rename "IsOutlier(instances_launched)" as
isOutlier | where isOutlier=1'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. The threshold value should be tuned to your environment.
known_false_positives: Many service accounts configured within an AWS infrastructure
are known to exhibit this behavior. Please adjust the threshold values and filter
detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2020-07-21'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where an abnormally high number
description: This search looks for AWS CloudTrail events where an abnormally high number
of instances were successfully terminated by a user in a 10-minute window. This
search is deprecated and have been translated to use the latest Change Datamodel.
search: '`cloudtrail` eventName=TerminateInstances errorCode=success | bucket span=10m
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=TerminateInstances errorCode=success | bucket sp
num_standard_deviations_away, total_terminations_avg, total_terminations_stdev |
`abnormally_high_aws_instances_terminated_by_user_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs.
known_false_positives: Many service accounts configured with your AWS infrastructure
are known to exhibit this behavior. Please adjust the threshold values and filter
detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2020-07-21'
author: Jason Brewer, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user successfully terminates
description: This search looks for AWS CloudTrail events where a user successfully terminates
an abnormally high number of instances. This search is deprecated and have been
translated to use the latest Change Datamodel.
search: '`cloudtrail` eventName=TerminateInstances errorCode=success `abnormally_high_aws_instances_terminated_by_user___mltk_filter`
@@ -13,7 +13,7 @@ search: '`cloudtrail` eventName=TerminateInstances errorCode=success `abnormally
apply ec2_excessive_terminateinstances_v1 | rename "IsOutlier(instances_terminated)"
as isOutlier | where isOutlier=1'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. The threshold value should be tuned to your environment.
known_false_positives: Many service accounts configured within an AWS infrastructure
are known to exhibit this behavior. Please adjust the threshold values and filter
detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml
+1 -1
View File
@@ -20,7 +20,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user,
src_ip, City, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_city_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen AWS Provisioning
Activity Sources" support search once to create a history of previously seen locations
that have provisioned AWS resources.
detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml
+1 -1
View File
@@ -21,7 +21,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time,
user, src_ip, Country, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_country_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen AWS Provisioning
Activity Sources" support search once to create a history of previously seen locations
that have provisioned AWS resources.
detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml
+1 -1
View File
@@ -20,7 +20,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail`
| spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table
_time, user, src_ip, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_ip_address_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen AWS Provisioning
Activity Sources" support search once to create a history of previously seen locations
that have provisioned AWS resources.
detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml
+1 -1
View File
@@ -20,7 +20,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user,
src_ip, Region, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_region_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen AWS Provisioning
Activity Sources" support search once to create a history of previously seen locations
that have provisioned AWS resources.
detections/deprecated/detect_api_activity_from_users_without_mfa.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2018-05-17'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user logged into the
description: This search looks for AWS CloudTrail events where a user logged into the
AWS account, is making API calls and has not enabled Multi Factor authentication.
Multi factor authentication adds a layer of security by forcing the users to type
a unique authentication code from an approved authentication device when they access
@@ -17,7 +17,7 @@ search: '`cloudtrail` userIdentity.sessionContext.attributes.mfaAuthenticated=fa
as eventName by userIdentity.arn userIdentity.type user | `security_content_ctime(firstTime)` |
`security_content_ctime(lastTime)` | `detect_api_activity_from_users_without_mfa_filter`'
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. Leverage the support search `Create a list of approved AWS service accounts`:
run it once every 30 days to create a list of service accounts and validate them.\
detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2020-07-21'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for successful CloudTrail activity by user accounts
description: This search looks for successful AWS CloudTrail activity by user accounts
that are not listed in the identity table or `aws_service_accounts.csv`. It returns
event names and count, as well as the first and last time a specific user or service
is detected, grouped by users. Deprecated because managing this list can be quite
@@ -17,7 +17,7 @@ search: '`cloudtrail` errorCode=success | rename userName as identity | search N
user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `detect_aws_api_activities_from_unapproved_accounts_filter`'
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. You must also populate the `identity_lookup_expanded` lookup shipped with
the Asset and Identity framework to be able to look up users in your identity table
in Enterprise Security (ES). Leverage the support search called "Create a list of
detections/deprecated/detect_new_api_calls_from_user_roles.yml
+2 -2
View File
@@ -18,9 +18,9 @@ search: '`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=A
as earliest latest(_time) as latest by user | `security_content_ctime(earliest)`
| `security_content_ctime(latest)` | `detect_new_api_calls_from_user_roles_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously seen API call per user
roles in CloudTrail" support search once to create a history of previously seen
roles in AWS CloudTrail" support search once to create a history of previously seen
user roles.
known_false_positives: It is possible that there are legitimate user roles making
new or infrequently used API calls in your infrastructure, causing the search to
detections/deprecated/detect_new_user_aws_console_login.yml
+4 -4
View File
@@ -5,7 +5,7 @@ date: '2020-07-21'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events wherein a console login event
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
@@ -17,10 +17,10 @@ search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user |
"-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
where userStatus ="First Time Logging into AWS Console" | `detect_new_user_aws_console_login_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Run the "Previously seen users in CloudTrail" support search only once to
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to
create a baseline of previously seen IAM users within the last 30 days. Run "Update
previously seen users in CloudTrail" hourly (or more frequently depending on how
previously seen users in AWS CloudTrail" hourly (or more frequently depending on how
often you run the detection searches) to refresh the baselines.
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
detections/deprecated/detect_spike_in_aws_api_activity.yml
+1 -1
View File
@@ -24,7 +24,7 @@ search: '`cloudtrail` eventType=AwsApiCall [search `cloudtrail` eventType=AwsApi
as eventName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user
| `detect_spike_in_aws_api_activity_filter`'
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
your environment. The `dataPointThreshold` variable is the minimum number of data
points required to have a statistically significant amount of data to determine.
detections/deprecated/detect_spike_in_network_acl_activity.yml
+1 -1
View File
@@ -23,7 +23,7 @@ search: '`cloudtrail` `network_acl_events` [search `cloudtrail` `network_acl_eve
| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
as uniqueApisCalled by user | `detect_spike_in_network_acl_activity_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
your environment. The `dataPointThreshold` variable is the minimum number of data
points required to have a statistically significant amount of data to determine.
detections/deprecated/detect_spike_in_security_group_activity.yml
+1 -1
View File
@@ -24,7 +24,7 @@ search: '`cloudtrail` `security_group_api_calls` [search `cloudtrail` `security_
| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
as uniqueApisCalled by user | `detect_spike_in_security_group_activity_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
your environment. The `dataPointThreshold` variable is the minimum number of data
points required to have a statistically significant amount of data to determine.
detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml
+1 -1
View File
@@ -17,7 +17,7 @@ search: '`cloudtrail` `ec2_modification_api_calls` [search `cloudtrail` `ec2_mod
| rename arn as userIdentity.arn | table userIdentity.arn] | spath output=dest responseElements.instancesSet.items{}.instanceId
| spath output=user userIdentity.arn | table _time, user, dest | `ec2_instance_modified_with_previously_unseen_user_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen EC2 Launches By
User" support search once to create a history of previously seen ARNs. To add or
remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2018-02-23'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where an instance is started
description: This search looks for AWS CloudTrail events where an instance is started
in a particular region in the last one hour and then compares it to a lookup file
of previously seen regions where an instance was started
search: '`cloudtrail` earliest=-1h StartInstances | stats earliest(_time) as earliest
@@ -16,7 +16,7 @@ search: '`cloudtrail` earliest=-1h StartInstances | stats earliest(_time) as ear
| `security_content_ctime(latest)` | where regionStatus="Instance Started in a New
Region" | `ec2_instance_started_in_previously_unseen_region_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. Run the "Previously seen AWS Regions" support search only once to create
of baseline of previously seen regions. This search is deprecated and have been
translated to use the latest Change Datamodel.
detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml
+1 -1
View File
@@ -20,7 +20,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI
as arn, requestParameters.instancesSet.items{}.imageId as amiID | table firstTime,
lastTime, arn, amiID, dest, instanceType | `ec2_instance_started_with_previously_unseen_ami_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen EC2 AMIs" support
search once to create a history of previously seen AMIs.
known_false_positives: After a new AMI is created, the first systems created with
detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml
+1 -1
View File
@@ -20,7 +20,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI
as instanceType, responseElements.instancesSet.items{}.instanceId as dest | table
_time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_instance_type_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen EC2 Instance Types"
support search once to create a history of previously seen instance types.
known_false_positives: It is possible that an admin will create a new system using
detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml
+1 -1
View File
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI
as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn
as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen EC2 Launches By
User" support search once to create a history of previously seen ARNs.
known_false_positives: It's possible that a user will start to create EC2 instances
detections/deprecated/remote_wmi_command_attempt.yml
-47
View File
@@ -1,47 +0,0 @@
name: Remote WMI Command Attempt
id: 272df6de-61f1-4784-877c-1fbc3e2d0838
version: 2
date: '2018-12-03'
author: Rico Valdez, Splunk
type: batch
datamodel:
- Endpoint
description: This search looks for wmic.exe being launched with parameters to operate
on remote systems.
search: '| tstats `security_content_summariesonly` count values(Processes.process)
as process values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe AND
Processes.process= */node* by Processes.user Processes.process_name Processes.parent_process_name
Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model. Deprecated because duplicate of Remote Process Instantiation via WMI.
known_false_positives: Administrators may use this legitimately to gather info from
remote systems.
references: []
tags:
analytic_story:
- Suspicious WMI Use
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
kill_chain_phases:
- Actions on Objectives
mitre_attack_id:
- T1047
nist:
- PR.PT
- PR.AT
- PR.AC
- PR.IP
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
security_domain: endpoint
detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml
-82
View File
@@ -1,82 +0,0 @@
name: Rare Parent-Child Process Relationship
id: e03aa905-6549-4e34-b304-7a922185b2c4
version: 1
date: '2020-08-13'
author: Ignacio Bermudez Corrales, Splunk
type: streaming
datamodel: []
description: An attacker may use LOLBAS tools spawned from vulnerable applications
not typically used by system administrators. This search leverages the Splunk Streaming
ML DSP plugin to find rare parent/child relationships. The list of application has
been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event,
"parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process,
"\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) | where
parent_process_name!=null | select parent_process_name, process_name, timestamp,
dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name"
target="process_name" | rename output as input | where input < 1 | adaptive_threshold
algorithm="quantile" entity="parent_process_name" window=604800000L | where label
AND quantile<0.1 AND (process_name="powershell.exe" OR process_name="regsvcs.exe"
OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe"
OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe"
OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe"
OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe"
OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe"
OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe"
OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe"
OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe"
OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe"
OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe"
OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe"
OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe"
OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe"
OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe"
OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe"
OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe"
OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe"
OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe"
OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe"
OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR
process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe"
OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe"
OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe"
OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
dest_user_id), body = "TBD" | into write_null();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: 'Some custom tools used by admins could be used rarely to launch
remotely applications. This might trigger false positives at the beginning when
it hasn''t collected yet enough data to construct the baseline.
'
references: []
tags:
analytic_story:
- Unusual Processes
cis20:
- CIS 8
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1203
- T1059
- T1053
- T1072
nist:
- PR.PT
- DE.CM
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- parent_process_name
- _time
- dest_device_id
- dest_user_id
risk_severity: low
security_domain: endpoint
detections/endpoint/allow_operation_with_consent_admin.yml
+3 -3
View File
@@ -30,6 +30,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -45,6 +48,3 @@ tags:
- Registry.registry_value_name
- Registry.dest
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
+3 -3
View File
@@ -25,6 +25,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -44,6 +47,3 @@ tags:
- Processes.process_id
- Processes.process_guid
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
+59
View File
@@ -0,0 +1,59 @@
name: Detect Empire with PowerShell Script Block Logging
id: bc1dc6b8-c954-11eb-bade-acde48001122
version: 1
date: '2021-06-09'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies the common PowerShell stager used by PowerShell-Empire.
Each stager that may use PowerShell all uses the same pattern. The initial HTTP
will be base64 encoded and use `system.net.webclient`. Note that some obfuscation
may evade the analytic. \
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 (Message=*system.net.webclient* AND Message=*frombase64string*)
| stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `detect_empire_with_powershell_script_block_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: False positives may only pertain to it not being related to
Empire, but another framework. Filter as needed if any applications use the same
pattern.
references:
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://github.com/BC-SECURITY/Empire
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1059.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
+56
View File
@@ -0,0 +1,56 @@
name: Detect Mimikatz With PowerShell Script Block Logging
id: 8148c29c-c952-11eb-9255-acde48001122
version: 1
date: '2021-06-09'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies common Mimikatz functions that may be identified in the
script block, including `mimikatz`. This will catch the most basic use cases for
Pass the Ticket, Pass the Hash and `-DumprCreds`. \
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*,
*kerberos::ptt*, *kerberos::golden*) | stats count min(_time) as firstTime max(_time)
as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `detect_mimikatz_with_powershell_script_block_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: False positives should be limited as the commands being identifies
are quite specific to EventCode 4104 and Mimikatz. Filter as needed.
references:
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1003
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/detect_wmi_event_subscription_persistence.yml
+62
View File
@@ -0,0 +1,62 @@
name: Detect WMI Event Subscription Persistence
id: 01d9a0c2-cece-11eb-ab46-acde48001122
version: 1
date: '2021-06-16'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic identifies the use of WMI Event Subscription
to establish persistence or perform privilege escalation. WMI can be used to install
event filters, providers, consumers, and bindings that execute code when a defined
event occurs. WMI subscription execution is proxied by the WMI Provider Host process
(WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic
is restricted by commonly added process execution and a path. If the volume is low
enough, remove the values and flag on any new subscriptions.
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID = 19 \
1. Consumer - An action to take upon triggering the filter. EventID = 20 \
1. Binding - Registers a filter to a consumer. EventID = 21 \
Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding.
It may be pertinent to review all 3 to identify the flow of execution. In addition,
EventCode 4104 may assist with any other PowerShell script usage that registered
the subscription.'
search: '`sysmon` EventID=20 | stats count min(_time) as firstTime max(_time) as lastTime
by Computer User Destination | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `detect_wmi_event_subscription_persistence_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with that provide WMI Event Subscription from your endpoints. If you are using
Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID
19, 20 and 21. Tune and filter known good to limit the volume.
known_false_positives: It is possible some applications will create a consumer and
may be required to be filtered. For tuning, add any additional LOLBin's for further
depth of coverage.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
- https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
- https://github.com/trustedsec/SysmonCommunityGuide/blob/master/WMI-events.md
- https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
tags:
analytic_story:
- Suspicious WMI Use
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1546.003
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Destination
- Computer
- User
security_domain: endpoint
detections/endpoint/disable_logs_using_wevtutil.yml
+3 -3
View File
@@ -26,6 +26,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -45,6 +48,3 @@ tags:
- Processes.process_id
- Processes.process_guid
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
+1 -1
View File
@@ -28,6 +28,7 @@ references:
tags:
analytic_story:
- meterpreter
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/windows_temp_processes/logExcessiveWindowsTemp.log
kill_chain_phases:
@@ -44,4 +45,3 @@ tags:
- Processes.dest
- Processes.user
security_domain: endpoint
automated_detection_testing: passed
detections/endpoint/malicious_powershell_executed_as_a_service.yml
+1 -1
View File
@@ -10,7 +10,7 @@ description: This detection is to identify the abuse the Windows SC.exe to execu
malicious commands or payloads via PowerShell.
search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name)
| regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]"
| regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*"
| regex l_Service_File_Name="-nop[rofile\s]+|-w[indowstyle]*\s+hid[den]*|-noe[xit\s]+|-enc[odedcommand\s]+"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter`'
detections/endpoint/office_document_spawned_child_process_to_download.yml
+6 -6
View File
@@ -1,7 +1,7 @@
name: Office Document Spawned Child Process To Download
id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3
version: 1
date: '2021-04-16'
version: 2
date: '2021-06-23'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
@@ -12,10 +12,10 @@ description: this search is to detect potential malicious office document execut
blend it to the normal noise in the infected machine to cover its track.
search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe",
"excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName
IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats
min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name
parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`'
IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) | stats min(_time)
as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process
cmdline process_id OriginalFileName ProcessGuid Computer EventCode | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
detections/endpoint/permission_modification_using_takeown_app.yml
+3 -3
View File
@@ -26,6 +26,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -45,6 +48,3 @@ tags:
- Processes.process_id
- Processes.process_guid
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
detections/endpoint/powershell_creating_thread_mutex.yml
+17 -12
View File
@@ -4,25 +4,33 @@ version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect suspicious powershell script that using mutex
function. This function is commonly seen in some obfuscated powershell script to
make sure that only one instance of there process is running to a compromise machine
which is also a good indicator to check why powershell script is using it.
datamodel: []
description: The following analytic identifies suspicious PowerShell script execution
via EventCode 4104 that is using the `mutex` function. This function is commonly
seen in some obfuscated PowerShell scripts to make sure that only one instance of
there process is running on a compromise machine. During triage, review parallel
processes within the same timeframe. Review the full script block to identify other
related artifacts.
search: '`powershell` EventCode=4104 Message = "*Threading.Mutex*" | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
registry to monitor this event.
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: powershell developer may used this function in their script
for instance checking too.
references:
- https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -38,6 +46,3 @@ tags:
- ComputerName
- User
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
detections/endpoint/powershell_domain_enumeration.yml
+54
View File
@@ -0,0 +1,54 @@
name: PowerShell Domain Enumeration
id: e1866ce2-ca22-11eb-8e44-acde48001122
version: 1
date: '2021-06-10'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies specific PowerShell modules typically used to enumerate
an organizations domain or users. \
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netforesttrust*,
*get-addomain*, *get-adgroupmember*, *get-domainuser*) | stats count min(_time)
as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: It is possible there will be false positives, filter as needed.
references:
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
- T1059.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
+58
View File
@@ -0,0 +1,58 @@
name: Powershell Fileless Process Injection via GetProcAddress
id: a26d9db4-c883-11eb-9d75-acde48001122
version: 1
date: '2021-06-08'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies `GetProcAddress` in the script block. This is not normal
to be used by most PowerShell scripts and is typically unsafe/malicious. Many attack
toolkits use GetProcAddress to obtain code execution. \
In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and later
referenced/executed elsewhere. \
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message=*getprocaddress* | stats count min(_time)
as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_process_injection_via_getprocaddress_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: Limited false positives. Filter as needed.
references:
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1055
- T1059.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+58
View File
@@ -0,0 +1,58 @@
name: Powershell Fileless Script Contains Base64 Encoded Content
id: 8acbc04c-c882-11eb-b060-acde48001122
version: 1
date: '2021-06-08'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies `FromBase64String` within the script block. A typical malicious
instance will include additional code. \
Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....`
\
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message=*frombase64string* | stats count min(_time)
as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: False positives should be limited. Filter as needed.
references:
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Exploitation
- Privilege Escalation
mitre_attack_id:
- T1027
- T1059.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
+57
View File
@@ -0,0 +1,57 @@
name: PowerShell Loading DotNET into Memory via System Reflection Assembly
id: 85bc3f30-ca28-11eb-bd21-acde48001122
version: 1
date: '2021-06-10'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies the use of PowerShell loading .net assembly via reflection.
This is commonly found in malicious PowerShell usage, including Empire and Cobalt
Strike. In addition, the `load(` value may be modifed by removing `(` and it will
identify more events to review. \
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message="*[system.reflection.assembly]::load(*"
| stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: False positives will be limited to
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1059.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/powershell_processing_stream_of_data.yml
+17 -12
View File
@@ -4,25 +4,33 @@ version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: this search is to detect suspicious powershell that processing compressed
stream data. This technique was seen in obfuscated powershell or powershell with
embedded .net or binary files that are stream flated and will be deflated during
execution.
datamodel: []
description: The following analytic identifies suspicious PowerShell script execution
via EventCode 4104 that is processing compressed stream data. This is typically
found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files
that are stream flattened and will be deflated durnig execution. During triage,
review parallel processes within the same timeframe. Review the full script block
to identify other related artifacts.
search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*"
OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
registry to monitor this event.
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: powershell may used this function to process compressed data.
references:
- https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -39,6 +47,3 @@ tags:
- User
- Score
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
detections/endpoint/powershell_using_memory_as_backing_store.yml
+16 -12
View File
@@ -4,26 +4,33 @@ version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: this search is to detect suspicious powershell script that using memory
stream as new object backstore. This technique is commonly seen in malicious powershell
contain a stream flate data and will be decompressed in memory to run or drop the
actual payload to the compromise machine.
datamodel: []
description: The following analytic identifies suspicious PowerShell script execution
via EventCode 4104 that is using memory stream as new object backstore. The malicious
PowerShell script will contain stream flate data and will be decompressed in memory
to run or drop the actual payload. During triage, review parallel processes within
the same timeframe. Review the full script block to identify other related artifacts.
search: '`powershell` EventCode=4104 Message = "*New-Object IO.MemoryStream*" | stats
count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `powershell_using_memory_as_backing_store_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
registry to monitor this event.
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: powershell may used this function to store out object into
memory.
references:
- https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -39,6 +46,3 @@ tags:
- ComputerName
- User
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
+3 -3
View File
@@ -27,6 +27,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -46,6 +49,3 @@ tags:
- Processes.process_id
- Processes.process_guid
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
detections/endpoint/process_execution_via_wmi.yml
+14 -9
View File
@@ -1,16 +1,21 @@
name: Process Execution via WMI
id: 24869767-8579-485d-9a4f-d9ddfd8f0cac
version: 3
version: 4
date: '2020-03-16'
author: Rico Valdez, Splunk
author: Rico Valdez, Michael Haag, Splunk
type: batch
datamodel: []
description: This search looks for processes launched via WMI.
search: '| tstats `security_content_summariesonly` count values(Processes.process)
as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
where Processes.parent_process_name = *WmiPrvSE.exe by Processes.user Processes.dest
Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)`| `process_execution_via_wmi_filter` '
datamodel:
- Endpoint
description: The following analytic identifies `WmiPrvSE.exe` spawning a process.
This typically occurs when a process is instantiated from a local or remote process
using `wmic.exe`. During triage, review parallel processes for suspicious behavior
or commands executed. Review the process and command-line spawning from `wmiprvse.exe`.
Contain and remediate the endpoint as necessary.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=WmiPrvSE.exe
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter` '
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. The command-line arguments are mapped to the "process"
detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
+17 -11
View File
@@ -4,25 +4,34 @@ version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect a powershell script that do a recon or checking
to the av product install on the machine. This technique is commonly seen in APT
or malware like ransomware to list all security product and disable it.
datamodel: []
description: The following analytic identifies suspicious PowerShell script execution
via EventCode 4104 performing checks to identify anti-virus products installed on
the endpoint. This technique is commonly found in malware and APT events where the
adversary will map all running security applications or services. During triage,
review parallel processes within the same timeframe. Review the full script block
to identify other related artifacts.
search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*"
OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed registry
to monitor this event.
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: network administrator may used this command for checking purposes
references:
- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Ransomware
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
@@ -38,6 +47,3 @@ tags:
- ComputerName
- User
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
detections/endpoint/recon_using__wmi_class.yml
-44
View File
@@ -1,44 +0,0 @@
name: Recon Using WMI Class
id: 018c1972-ca07-11eb-9473-acde48001122
version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect a powershell script that do a recon to the targetted
or compromised machine. This technique is common nowadays to know the running process,
services
search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*")
AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*"
OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*"
OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `recon_using__wmi_class_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed registry
to monitor this event.
known_false_positives: network administrator may used this command for checking purposes
references:
- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
tags:
analytic_story:
- Malicious PowerShell
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
- T1592
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
detections/endpoint/recon_using_wmi_class.yml
+50
View File
@@ -0,0 +1,50 @@
name: Recon Using WMI Class
id: 018c1972-ca07-11eb-9473-acde48001122
version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel: []
description: The following analytic identifies suspicious PowerShell via EventCode
4104, where WMI is performing an event query looking for running processes or running
services. This technique is commonly found where the adversary will identify services
and system information on the compromised machine. During triage, review parallel
processes within the same timeframe. Review the full script block to identify other
related artifacts.
search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*")
AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*"
OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*"
OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: network administrator may used this command for checking purposes
references:
- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
- T1592
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
security_domain: endpoint
detections/endpoint/remote_wmi_command_attempt.yml
+61
View File
@@ -0,0 +1,61 @@
name: Remote WMI Command Attempt
id: 272df6de-61f1-4784-877c-1fbc3e2d0838
version: 3
date: '2018-12-03'
author: Rico Valdez, Michael Haag, Splunk
type: batch
datamodel:
- Endpoint
description: The following analytic identifies usage of `wmic.exe` spawning a local
or remote process, identified by the `node` switch. During triage, review parallel
processes for additional commands executed. Look for any file modifications before
and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm
execution or file modifications. Contain and isolate the endpoint as needed.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe
Processes.process=*node* by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `remote_wmi_command_attempt_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model. Deprecated because duplicate of Remote Process Instantiation via WMI.
known_false_positives: Administrators may use this legitimately to gather info from
remote systems. Filter as needed.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml
tags:
analytic_story:
- Suspicious WMI Use
asset_type: Endpoint
automated_detection_testing: passed
cis20:
- CIS 3
- CIS 5
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log
kill_chain_phases:
- Actions on Objectives
mitre_attack_id:
- T1047
nist:
- PR.PT
- PR.AT
- PR.AC
- PR.IP
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.process_name
- Processes.parent_process_name
- Processes.dest
- Processes.parent_process
- Processes.parent_process_id
- Processes.process_id
security_domain: endpoint
detections/endpoint/script_execution_via_wmi.yml
+12 -10
View File
@@ -1,23 +1,25 @@
name: Script Execution via WMI
id: aa73f80d-d728-4077-b226-81ea0c8be589
version: 3
version: 4
date: '2020-03-16'
author: Rico Valdez, Splunk
author: Rico Valdez, Michael Haag, Splunk
type: batch
datamodel: []
datamodel:
- Endpoint
description: This search looks for scripts launched via WMI.
search: '| tstats `security_content_summariesonly` count values(Processes.process)
as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
where Processes.process_name = "scrcons.exe" by Processes.user Processes.dest Processes.process_name |
`drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`script_execution_via_wmi_filter` '
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `script_execution_via_wmi_filter` '
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. The command-line arguments are mapped to the "process"
field in the Endpoint data model.
known_false_positives: Although unlikely, administrators may use wmi to launch scripts
for legitimate purposes.
references: []
for legitimate purposes. Filter as needed.
references:
- https://redcanary.com/blog/child-processes/
tags:
analytic_story:
- Suspicious WMI Use
detections/endpoint/ssa___detect_kerberoasting.yml
+7 -4
View File
@@ -11,13 +11,16 @@ search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_
EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
"ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
"service_id") | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
| first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
"service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id") | where EventCode="4769"
AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event
input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
| eval start_time=_time, end_time=_time, body=create_map(["EventCode", EventCode,
"ServiceName", ServiceName, "TicketOptions", TicketOptions, "TicketEncryptionType",
TicketEncryptionType]), entities="TBD" | select start_time, end_time, entities,
body | into write_null(); '
TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))|
select start_time, end_time, entities, body | into write_ssa_detected_events();'
how_to_implement: The test data is converted from Windows Security Event logs generated
from Attach Range simulation and used in SPL search and extended to SPL2
known_false_positives: Older systems that support kerberos RC4 by default NetApp may
detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+1 -1
View File
@@ -25,7 +25,7 @@ search: '| from read_ssa_enriched_events()
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name",
parent_process_name]) | into write_ssa_detected_events();'
parent_process]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting sysmon logs. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
known_false_positives: There are circumstances where an application may legitimately
detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
+21 -23
View File
@@ -13,22 +13,20 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event,
"parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process,
"\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
| where parent_process_name!=null
| select parent_process_name, process_name, cmd_line, timestamp, dest_device_id, dest_user_id
| conditional_anomaly conditional="parent_process_name" target="process_name"
| where (process_name="powershell.exe" OR process_name="regsvcs.exe"
OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe"
OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe"
OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe"
OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe"
OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe"
OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe"
OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe"
OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe"
OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event,
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
"string", null) | where parent_process_name!=null | select parent_process_name,
process_name, cmd_line, timestamp, dest_device_id, dest_user_id | conditional_anomaly
conditional="parent_process_name" target="process_name" | where (process_name="powershell.exe"
OR process_name="regsvcs.exe" OR process_name="ftp.exe" OR process_name="dfsvc.exe"
OR process_name="rasautou.exe" OR process_name="schtasks.exe" OR process_name="xwizard.exe"
OR process_name="findstr.exe" OR process_name="esentutl.exe" OR process_name="cscript.exe"
OR process_name="reg.exe" OR process_name="csc.exe" OR process_name="atbroker.exe"
OR process_name="print.exe" OR process_name="pcwrun.exe" OR process_name="vbc.exe"
OR process_name="rpcping.exe" OR process_name="wsreset.exe" OR process_name="ilasm.exe"
OR process_name="certutil.exe" OR process_name="replace.exe" OR process_name="mshta.exe"
OR process_name="bitsadmin.exe" OR process_name="wscript.exe" OR process_name="ieexec.exe"
OR process_name="cmd.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe"
OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe"
OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe"
@@ -45,12 +43,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe"
OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe"
OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")
| eval input = (-1)*log(output)
| adaptive_threshold algorithm="gaussian" threshold=0.001 window=604800000L
| where label AND input > mean
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
dest_user_id), body = create_map(["process_name", process_name, "parent_process_name", parent_process_name, "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
| eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001
window=604800000L | where label AND input > mean | eval start_time = timestamp,
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body =
create_map(["process_name", process_name, "parent_process_name", parent_process_name,
"input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
cmd_line]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: 'Some custom tools used by admins could be used rarely to launch
remotely applications. This might trigger false positives at the beginning when
@@ -83,4 +81,4 @@ tags:
- dest_device_id
- dest_user_id
risk_severity: low
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___system_process_running_unexpected_location.yml
+1 -1
View File
@@ -224,7 +224,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";
| from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" OR process_path
union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" AND process_path
NOT LIKE "%\\windows\\syswow64%" | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(device, user), body=create_map(["process_path", process_path,
"process_name", process_name]) | into write_ssa_detected_events();'
detections/endpoint/start_up_during_safe_mode_boot.yml
+3 -3
View File
@@ -27,6 +27,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -42,6 +45,3 @@ tags:
- Registry.registry_value_name
- Registry.dest
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
detections/endpoint/suspicious_event_log_service_behavior.yml
+58
View File
@@ -0,0 +1,58 @@
name: Suspicious Event Log Service Behavior
id: 2b85aa3d-f5f6-4c2e-a081-a09f6e1c2e40
version: 1
date: '2021-06-17'
author: Mauricio Velazco, Splunk
type: batch
datamodel: []
description: The following analytic utilizes Windows Event ID 1100 to identify when
Windows event log service is shutdown. Note that this is a voluminous analytic that
will require tuning or restricted to specific endpoints based on criticality. This
event generates every time Windows Event Log service has shut down. It also generates
during normal system shutdown. During triage, based on time of day and user, determine
if this was planned. If not planned, follow through with reviewing parallel alerts
and other data sources to determine what else may have occurred.
search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime
max(_time) as lastTime by dest Message EventCode | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `suspicious_event_log_service_behavior_filter`
how_to_implement: To successfully implement this search, you need to be ingesting
Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
known_false_positives: It is possible the Event Logging service gets shut down due
to system errors or legitimately administration tasks. Filter as needed.
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100
- https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads
- https://attack.mitre.org/techniques/T1070/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
tags:
analytic_story:
- Windows Log Manipulation
- Ransomware
- Clop Ransomware
asset_type: Endpoint
automated_detection_testing: passed
cis20:
- CIS 3
- CIS 5
- CIS 6
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log
kill_chain_phases:
- Actions on Objectives
mitre_attack_id:
- T1070.001
nist:
- DE.DP
- PR.IP
- PR.AC
- PR.AT
- DE.AE
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- dest
security_domain: endpoint
detections/endpoint/suspicious_msbuild_rename.yml
+1 -1
View File
@@ -9,7 +9,7 @@ description: The following analytic identifies renamed instances of msbuild.exe
Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and
C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
the code executed and what is executing a renamed instance of MSBuild.
search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe)
search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe process_name!=msbuild.exe)
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
detections/endpoint/unloading_amsi_via_reflection.yml
+57
View File
@@ -0,0 +1,57 @@
name: Unloading AMSI via Reflection
id: a21e3484-c94d-11eb-b55b-acde48001122
version: 1
date: '2021-06-09'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies the behavior of AMSI being tampered with. Implemented natively
in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct
COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")`
taken from Powershell-Empire. \
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message=*system.management.automation.amsi* |
stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `unloading_amsi_via_reflection_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: Potential for some third party applications to disable AMSI
upon invocation. Filter as needed.
references:
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1562
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/windows_event_log_cleared.yml
+18 -11
View File
@@ -1,21 +1,28 @@
name: Windows Event Log Cleared
id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a
version: 4
version: 6
date: '2020-07-06'
author: Rico Valdez, Splunk
author: Rico Valdez, Michael Haag, Splunk
type: batch
datamodel: []
description: This search looks for Windows events that indicate one of the Windows
event logs has been purged.
search: (`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system`
EventCode=104) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_event_log_cleared_filter`
description: The following analytic utilizes Windows Security Event ID 1102 or System
log event 104 to identify when a Windows event log is cleared. Note that this analytic
will require tuning or restricted to specific endpoints based on criticality. During
triage, based on time of day and user, determine if this was planned. If not planned,
follow through with reviewing parallel alerts and other data sources to determine
what else may have occurred.
search: (`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104)
| stats count min(_time) as firstTime max(_time) as lastTime by dest Message EventCode
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`
how_to_implement: To successfully implement this search, you need to be ingesting
Windows event logs from your hosts.
Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
known_false_positives: It is possible that these logs may be legitimately cleared
by Administrators.
references: []
by Administrators. Filter as needed.
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102
- https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads
- https://attack.mitre.org/techniques/T1070/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
tags:
analytic_story:
- Windows Log Manipulation
detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
+30 -6
View File
@@ -1,20 +1,44 @@
name: WMI Permanent Event Subscription - Sysmon
id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9
version: 2
version: 3
date: '2020-12-08'
author: Rico Valdez, Splunk
author: Rico Valdez, Michael Haag, Splunk
type: batch
datamodel: []
description: This search looks for the creation of WMI permanent event subscriptions.
description: 'This analytic looks for the creation of WMI permanent event subscriptions.
The following analytic identifies the use of WMI Event Subscription to establish
persistence or perform privilege escalation. WMI can be used to install event filters,
providers, consumers, and bindings that execute code when a defined event occurs.
WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe)
and thus may result in elevated SYSTEM privileges. This analytic is restricted by
commonly added process execution and a path. If the volume is low enough, remove
the values and flag on any new subscriptions.
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID = 19 \
1. Consumer - An action to take upon triggering the filter. EventID = 20 \
1. Binding - Registers a filter to a consumer. EventID = 21 \
Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding.
It may be pertinent to review all 3 to identify the flow of execution. In addition,
EventCode 4104 may assist with any other PowerShell script usage that registered
the subscription.'
search: '`sysmon` EventCode=21 | rename host as dest | table _time, dest, user, Operation,
EventType, Query, Consumer, Filter | `wmi_permanent_event_subscription___sysmon_filter`'
how_to_implement: To successfully implement this search, you must be collecting Sysmon
data using Sysmon version 6.1 or greater and have Sysmon configured to generate
alerts for WMI activity. In addition, you must have at least version 6.0.4 of the
Sysmon TA installed to properly parse the fields.
alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least
version 6.0.4 of the Sysmon TA installed to properly parse the fields.
known_false_positives: Although unlikely, administrators may use event subscriptions
for legitimate purposes.
references: []
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
- https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
- https://github.com/trustedsec/SysmonCommunityGuide/blob/master/WMI-events.md
- https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
tags:
analytic_story:
- Suspicious WMI Use
detections/endpoint/wmi_recon_running_process_or_services.yml
+16 -12
View File
@@ -4,25 +4,32 @@ version: 1
date: '2021-06-14'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This seearch is to detect a suspicious powershell/wmi query to recon
running process and running services. This technique is commonly seen in malware
and apt attack to mapped all running security application or services on the compromised
machine.
datamodel: []
description: The following analytic identifies suspicious PowerShell script execution
via EventCode 4104, where WMI is performing an event query looking for running processes
or running services. This technique is commonly found in malware and APT events
where the adversary will map all running security applications or services on the
compromised machine. During triage, review parallel processes within the same timeframe.
Review the full script block to identify other related artifacts.
search: '`powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*"
OR Message="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as
lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed registry
to monitor this event.
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: network administrator may used this command for checking purposes
references:
- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
- https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
- https://github.com/trustedsec/SysmonCommunityGuide/blob/master/WMI-events.md
- https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
@@ -38,6 +45,3 @@ tags:
- ComputerName
- User
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml
+1 -1
View File
@@ -13,7 +13,7 @@ search: '`cloudtrail` user_type=AssumedRole userIdentity.sessionContext.sessionI
requestParameters.roleName responseElements.role.roleName responseElements.role.createDate
| `aws_detect_sts_assume_role_abuse_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs
search works with AWS CloudTrail logs
known_false_positives: Sts:AssumeRole can be very noisy as it is a standard mechanism
to provide cross account and cross resources access. This search can be adjusted
to provide specific values to identify cases of abuse.
detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml
+1 -1
View File
@@ -23,7 +23,7 @@ search: '`cloudtrail` eventName=DeleteBucket [search `cloudtrail` eventName=Dele
path=requestParameters.bucketName | stats values(bucketName) as bucketName, count
as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user | `detect_spike_in_s3_bucket_deletion_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
your environment. The `dataPointThreshold` variable is the minimum number of data
points required to have a statistically significant amount of data to determine.
detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml
+1 -1
View File
@@ -14,7 +14,7 @@ search: '| tstats count min(_time) as firstTime max(_time) as lastTime FROM data
Compute.region Compute.msg Compute.user_type | `drop_dm_object_name("Compute")`
| `new_container_uploaded_to_aws_ecr_filter` '
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. You must also install Cloud Infrastructure data model. Please also customize
the `container_implant_aws_detection_filter` macro to filter out the false positives.
known_false_positives: Uploading container is a normal behavior from developers or
dist/escu/app.manifest
Vendored
+1 -1
View File
@@ -5,7 +5,7 @@
"id": {
"group": null,
"name": "DA-ESS-ContentUpdate",
"version": "3.23.0"
"version": "3.24.0"
},
"author": [
{
dist/escu/default/analytic_stories.conf
Vendored
+24 -267
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-06-10T18:24:24 UTC
# On Date: 2021-06-24T18:00:37 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -26,26 +26,6 @@ Herein lies the rub. In between the time between when the temporary credentials
This Analytic Story includes searches that will help you monitor your AWS CloudTrail logs for evidence of suspicious cross-account activity. For example, while accessing multiple AWS accounts and roles may be perfectly valid behavior, it may be suspicious when an account requests privileges of an account it has not accessed in the past. After identifying suspicious activities, you can use the provided investigative searches to help you probe more deeply.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[AWS Cryptomining]
category = Cloud Security
creation_date = 2018-03-08
modification_date = 2018-03-08
id = ced74200-8465-4bc3-bd2c-9a782eec6750
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
support_searches = ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 Launches By User"]
data_models = []
providing_technologies = none
description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS). It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \
When malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So, it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \
This Analytic Story is focused on detecting suspicious new instances in your EC2 environment to help prevent such a disaster. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[AWS IAM Privilege Escalation]
category = Cloud Security
creation_date = 2021-03-08
@@ -98,24 +78,6 @@ description = This story is focused around detecting Security Hub alerts generat
narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[AWS Suspicious Provisioning Activities]
category = Cloud Security
creation_date = 2018-03-16
modification_date = 2018-03-16
id = 3338b567-3804-4261-9889-cf0ca4753c7f
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule"]
mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]}
investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get All AWS Activity From Region - Response Task"]
support_searches = ["ESCU - Previously Seen AWS Provisioning Activity Sources"]
data_models = []
providing_technologies = none
description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network.
narrative = Because most enterprise AWS activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary. \
This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[AWS User Monitoring]
category = Cloud Security
creation_date = 2018-03-12
@@ -262,7 +224,7 @@ modification_date = 2021-03-17
id = 5a6f6849-1a26-4fae-aa05-fa730556eeb6
version = 1
reference = ["https://www.hhs.gov/sites/default/files/analyst-note-cl0p-tlp-white.pdf", "https://securityaffairs.co/wordpress/115250/data-breach/qualys-clop-ransomware.html", "https://www.darkreading.com/attacks-breaches/qualys-is-the-latest-victim-of-accellion-data-breach/d/d-id/1340323"]
detection_searches = ["ESCU - Clop Common Exec Parameter - Rule", "ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Create Service In Suspicious File Path - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - High File Deletion Frequency - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule"]
detection_searches = ["ESCU - Clop Common Exec Parameter - Rule", "ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Create Service In Suspicious File Path - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - High File Deletion Frequency - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule"]
mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Obfuscation", "Privilege Escalation"], "mitre_attack": ["T1003.002", "T1070.001", "T1204", "T1485", "T1486", "T1490", "T1543", "T1569.001", "T1569.002"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = []
support_searches = []
@@ -391,24 +353,6 @@ narrative = Threat actors typically architect and implement an infrastructure to
Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Common Phishing Frameworks]
category = Adversary Tactics
creation_date = 2019-04-29
modification_date = 2019-04-29
id = 9a64ab44-9214-4639-8163-7eaa2621bd61
version = 1
reference = ["https://github.com/kgretzky/evilginx2", "https://attack.mitre.org/techniques/T1192/", "https://breakdev.org/evilginx-advanced-phishing-with-two-factor-authentication-bypass/"]
detection_searches = ["ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule"]
mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Delivery"], "mitre_attack": ["T1566.003"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP"]}
investigative_searches = ["ESCU - Domain Certificate Investigation - Response Task", "ESCU - Get Certificate logs for a domain - Response Task"]
support_searches = []
data_models = ["Network_Resolution"]
providing_technologies = none
description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email.
narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\
This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Container Implantation Monitoring and Investigation]
category = Cloud Security
creation_date = 2020-02-20
@@ -532,11 +476,11 @@ modification_date = 2020-10-21
id = 66b0fe0c-1351-11eb-adc1-0242ac120002
version = 1
reference = ["https://attack.mitre.org/tactics/TA0010/"]
detection_searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"]
mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exploitation"], "mitre_attack": ["T1041", "T1114", "T1114.001", "T1114.003"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS"]}
detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"]
mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1041", "T1048", "T1048.003", "T1114", "T1114.001", "T1114.003"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS"]}
investigative_searches = ["ESCU - Get Notable History - Response Task"]
support_searches = []
data_models = []
data_models = ["Endpoint"]
providing_technologies = none
description = The stealing of data by an adversary.
narrative = Exfiltration comes in many flavors. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command and Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.
@@ -738,23 +682,6 @@ In June of 2018, The Department of Homeland Security, together with the FBI and
Among other searches in this Analytic Story is a detection search that looks for the creation or deletion of hidden shares, such as, "adnim$," which the Hidden Cobra malware creates on the target system. Another looks for the creation of three malicious files associated with the malware. You can also use a search in this story to investigate activity that indicates that malware is sending email back to the attackers.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Host Redirection]
category = Abuse
creation_date = 2017-09-14
modification_date = 2017-09-14
id = 2e8948a5-5239-406b-b56b-6c50fe268af4
version = 1
reference = ["https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/"]
detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Windows hosts file modification - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003", "T1071.004"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task"]
support_searches = []
data_models = ["Network_Resolution"]
providing_technologies = none
description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website.
narrative = Attackers will often attempt to manipulate client communications for nefarious purposes. In some cases, an attacker may endeavor to modify a local host file to redirect communications with resources (such as antivirus or system-update services) to prevent clients from receiving patches or updates. In other cases, an attacker might use this tactic to have the client connect to a site that looks like the intended site, but instead installs malware or collects information from the victim. Additionally, an attacker may redirect a victim in order to execute a MITM attack and observe communications.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Ingress Tool Transfer]
category = Adversary Tactics
creation_date = 2021-03-24
@@ -837,23 +764,6 @@ description = This story addresses detection and response of accounts acccesing
narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Kubernetes Sensitive Role Activity]
category = Cloud Security
creation_date = 2020-05-20
modification_date = 2020-05-20
id = 2574e6d9-7254-4751-8925-0447deeec8ew
version = 1
reference = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"]
detection_searches = ["ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule"]
mappings = {"kill_chain_phases": ["Lateral Movement"]}
investigative_searches = ["ESCU - Get Notable History - Response Task"]
support_searches = []
data_models = []
providing_technologies = none
description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Lateral Movement]
category = Adversary Tactics
creation_date = 2020-02-04
@@ -880,25 +790,27 @@ category = Adversary Tactics
creation_date = 2017-08-23
modification_date = 2017-08-23
id = 2c8ff66e-0b57-42af-8ad7-912438a403fc
version = 4
version = 5
reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation"], "mitre_attack": ["T1027", "T1059.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1003", "T1027", "T1027.005", "T1055", "T1059.001", "T1140", "T1562", "T1592"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope.\
narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope. \
The following factors may assist you in determining whether the event is malicious: \
1. Country of origin\
1. Responsible party\
1. Fully qualified domain names associated with the external IP address\
1. Registration of fully qualified domain names associated with external IP addressDetermining whether it is a dynamic domain frequently visited by others and/or how third parties categorize it can also help you answer some questions surrounding the attacker and details related to the external system. In addition, there are various sources--such as VirusTotal&#151; that can provide some reputation information on the IP address or domain name, which can assist in determining whether the event is malicious. Finally, determining whether there are other events associated with the IP address may help connect data points or show other events that should be brought into scope.\
Gathering data on the system of interest can sometimes help you quickly determine whether something suspicious is happening. Some of these items include finding out who else may have recently logged into the system, whether any unusual scheduled tasks exist, whether the system is communicating on suspicious ports, whether there are modifications to sensitive registry keys, and whether there are any known vulnerabilities on the system. This information can often highlight other activity commonly seen in attack scenarios or give more information about how the system may have been targeted.\
Often, a simple inspection of the process name and path can tell you if the system has been compromised. For example, if `svchost.exe` is found running from a location other than `C:\Windows\System32`, it is likely something malicious designed to hide in plain sight when cursorily reviewing process names. Similarly, if the process itself seems legitimate, but the parent process is running from the temporary browser cache, that could be indicative of activity initiated via a compromised website a user visited.\
It can also be very helpful to examine various behaviors of the process of interest or the parent of the process of interest. For example, if it turns out the process of interest is malicious, it would be good to see if the parent to that process spawned other processes that might be worth further scrutiny. If a process is suspect, a review of the network connections made in and around the time of the event and/or whether the process spawned any child processes could be helpful, as well.\
In the event a system is suspected of having been compromised via a malicious website, we suggest reviewing the browsing activity from that system around the time of the event. If categories are given for the URLs visited, that can help you zero in on possible malicious sites.
1. Country of origin \
1. Responsible party \
1. Fully qualified domain names associated with the external IP address \
1. Registration of fully qualified domain names associated with external IP address \
Determining whether it is a dynamic domain frequently visited by others and/or how third parties categorize it can also help you answer some questions surrounding the attacker and details related to the external system. In addition, there are various sources--such as VirusTotal&#151; that can provide some reputation information on the IP address or domain name, which can assist in determining whether the event is malicious. Finally, determining whether there are other events associated with the IP address may help connect data points or show other events that should be brought into scope. \
Gathering data on the system of interest can sometimes help you quickly determine whether something suspicious is happening. Some of these items include finding out who else may have recently logged into the system, whether any unusual scheduled tasks exist, whether the system is communicating on suspicious ports, whether there are modifications to sensitive registry keys, and whether there are any known vulnerabilities on the system. This information can often highlight other activity commonly seen in attack scenarios or give more information about how the system may have been targeted. \
Often, a simple inspection of the process name and path can tell you if the system has been compromised. For example, if `svchost.exe` is found running from a location other than `C:\Windows\System32`, it is likely something malicious designed to hide in plain sight when cursorily reviewing process names. Similarly, if the process itself seems legitimate, but the parent process is running from the temporary browser cache, that could be indicative of activity initiated via a compromised website a user visited. \
It can also be very helpful to examine various behaviors of the process of interest or the parent of the process of interest. For example, if it turns out the process of interest is malicious, it would be good to see if the parent to that process spawned other processes that might be worth further scrutiny. If a process is suspect, a review of the network connections made in and around the time of the event and/or whether the process spawned any child processes could be helpful, as well. \
In the event a system is suspected of having been compromised via a malicious website, we suggest reviewing the browsing activity from that system around the time of the event. If categories are given for the URLs visited, that can help you zero in on possible malicious sites. \
Most recently we have added new content related to PowerShell Script Block logging, Windows EventCode 4104. Script block logging presents the deobfuscated and raw script executed on an endpoint. The analytics produced were tested against commonly used attack frameworks - PowerShell-Empire, Cobalt Strike and Covenant. In addition, we sampled publicly available samples that utilize PowerShell and validated coverage. The analytics are here to identify suspicious usage, cmdlets, or script values. 4104 events are enabled via the Windows registry and may generate a large volume of data if enabled globally. Enabling on critical systems or a limited set may be best. During triage of 4104 events, review parallel processes for other processes and command executed. Identify any file modifications and network communication and review accordingly. Fortunately, we get the full script to determine the level of threat identified.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Masquerading - Rename System Utilities]
@@ -939,41 +851,6 @@ Meterpreter enables the operator to remotely run commands on the target machine,
While investigating a detection related to this analytic story, please bear in mind that the detections look for anomalies in system behavior. It will be imperative to look for other signs in the endpoint and network logs for lateral movement, discovery and other actions to confirm that the host was compromised and a remote actor used it to progress on their objectives.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Monitor Backup Solution]
category = Best Practices
creation_date = 2017-09-12
modification_date = 2017-09-12
id = abe807c7-1eb6-4304-ac32-6e7aacdb891d
version = 1
reference = ["https://www.carbonblack.com/2016/03/04/tracking-locky-ransomware-using-carbon-black/"]
detection_searches = ["ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - Unsuccessful Netbackup backups - Rule"]
mappings = {"cis20": ["CIS 10"], "nist": ["PR.IP"]}
investigative_searches = ["ESCU - All backup logs for host - Response Task", "ESCU - Get Notable History - Response Task"]
support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups"]
data_models = []
providing_technologies = none
description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints.
narrative = Having backups is a standard best practice that helps ensure continuity of business operations. Having mature backup processes can also help you reduce the risks of many security-related incidents and streamline your response processes. The detection searches in this Analytic Story will help you identify systems that have backup failures, as well as systems that have not been backed up for an extended period of time. The story will also return the notable event history and all of the backup logs for an endpoint.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Monitor for Unauthorized Software]
category = Best Practices
creation_date = 2017-09-15
modification_date = 2017-09-15
id = 8892a655-6205-43f7-abba-06460e38c8ae
version = 1
reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
detection_searches = ["ESCU - Prohibited Software On Endpoint - Rule"]
mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "nist": ["ID.AM", "PR.DS"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment.
narrative = It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\
It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Monitor for Updates]
category = Best Practices
creation_date = 2017-09-15
@@ -1133,8 +1010,8 @@ modification_date = 2020-02-04
id = cf309d0d-d4aa-4fbb-963d-1e79febd3756
version = 1
reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"]
mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1020", "T1021.002", "T1036.003", "T1047", "T1048", "T1053.005", "T1069.001", "T1069.002", "T1070", "T1070.001", "T1071.001", "T1087.001", "T1087.002", "T1112", "T1204", "T1218.003", "T1482", "T1485", "T1490", "T1491", "T1547.001"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"]
mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1020", "T1021.002", "T1036.003", "T1047", "T1048", "T1053.005", "T1069.001", "T1069.002", "T1070", "T1070.001", "T1070.004", "T1071.001", "T1087.001", "T1087.002", "T1112", "T1204", "T1218.003", "T1222", "T1482", "T1485", "T1490", "T1491", "T1547.001", "T1548", "T1592"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"]
data_models = ["Endpoint", "Network_Traffic"]
@@ -1293,86 +1170,6 @@ Following is a typical series of events, according to an [article by Trend Micro
This Analytic Story focuses on detecting signs that a malicious payload has been injected into your environment. For example, one search detects outlook.exe writing a .zip file. Another looks for suspicious .lnk files launching processes.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Spectre And Meltdown Vulnerabilities]
category = Vulnerability
creation_date = 2018-01-08
modification_date = 2018-01-08
id = 6d3306f6-bb2b-4219-8609-8efad64032f2
version = 1
reference = ["https://meltdownattack.com/"]
detection_searches = ["ESCU - Spectre and Meltdown Vulnerable Systems - Rule"]
mappings = {"cis20": ["CIS 4"], "nist": ["DE.CM", "ID.RA", "PR.IP", "RS.MI"]}
investigative_searches = ["ESCU - Get Notable History - Response Task"]
support_searches = ["ESCU - Systems Ready for Spectre-Meltdown Windows Patch"]
data_models = ["Vulnerabilities"]
providing_technologies = none
description = Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story.
narrative = Meltdown and Spectre exploit critical vulnerabilities in modern CPUs that allow unintended access to data in memory. This Analytic Story will help you identify the systems can be patched for these vulnerabilities, as well as those that still need to be patched.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Splunk Enterprise Vulnerability]
category = Vulnerability
creation_date = 2017-09-19
modification_date = 2017-09-19
id = 4e692b96-de2d-4bd1-9105-37e2368a8db1
version = 1
reference = ["http://www.splunk.com/view/SP-CAAAPQ6#announce", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4859"]
detection_searches = ["ESCU - Open Redirect in Splunk Web - Rule"]
mappings = {"cis20": ["CIS 18", "CIS 3", "CIS 4"], "kill_chain_phases": ["Delivery"], "nist": ["DE.CM", "ID.RA", "PR.AC", "PR.IP", "PR.PT", "RS.MI"]}
investigative_searches = ["ESCU - Get Notable History - Response Task"]
support_searches = []
data_models = []
providing_technologies = none
description = Keeping your Splunk deployment up to date is critical and may help you reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some older versions of Splunk Enterprise. The detection search will help ensure that users are being properly authenticated and not being redirected to malicious domains.
narrative = This Analytic Story is associated with CVE-2016-4859, an open-redirect vulnerability in the following versions of Splunk Enterprise:\
\
1. Splunk Enterprise 6.4.x, prior to 6.4.3\
1. Splunk Enterprise 6.3.x, prior to 6.3.6\
1. Splunk Enterprise 6.2.x, prior to 6.2.10\
1. Splunk Enterprise 6.1.x, prior to 6.1.11\
1. Splunk Enterprise 6.0.x, prior to 6.0.12\
1. Splunk Enterprise 5.0.x, prior to 5.0.16\
1. Splunk Light, prior to 6.4.3CVE-2016-4859 allows attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. (Credit: Noriaki Iwasaki, Cyber Defense Institute, Inc.).\
It is important to ensure that your Splunk deployment is being kept up to date and is properly configured. This detection search allows analysts to monitor internal logs to ensure users are properly authenticated and cannot be redirected to any malicious third-party websites.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Splunk Enterprise Vulnerability CVE-2018-11409]
category = Vulnerability
creation_date = 2018-06-14
modification_date = 2018-06-14
id = 1fc34cbc-34e9-43ba-87ab-6811c9e95400
version = 1
reference = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"]
detection_searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule"]
mappings = {"cis20": ["CIS 18", "CIS 3", "CIS 4"], "kill_chain_phases": ["Delivery"], "nist": ["DE.CM", "ID.RA", "PR.AC", "PR.IP", "PR.PT", "RS.MI"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"]
support_searches = []
data_models = []
providing_technologies = none
description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users.
narrative = Although there have been no reports of it being exploited, Splunk Enterprise versions through 7.0.1 reportedly have a vulnerability that may expose information through a REST endpoint (read more here: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings). NIST has included it in its vulnerability database (read more here: https://nvd.nist.gov/vuln/detail/CVE-2018-11409). The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Customers should upgrade to the latest version to reduce the risk of this vulnerability.\
Splunk Enterprise exposes partial information about the host operating system, hardware, and Splunk license. Splunk Enterprise before 6.6.0 exposes this information without authentication. Splunk Enterprise 6.6.0 and later exposes this information only to authenticated Splunk users. Based on the information exposure, Splunk characterizes this issue as a low severity impact.\
Read more in Splunk's official response: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings.\
A detection search within this Analytic Story looks for vulnerabilities described in CVE-2018-11409: Information Exposure (https://nvd.nist.gov/vuln/detail/CVE-2018-11409). If it turns up activities that may be specific, you can use the included investigative searches to return information regarding web activity and network traffic by src_ip.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Suspicious AWS EC2 Activities]
category = Cloud Security
creation_date = 2018-02-09
modification_date = 2018-02-09
id = 2e8948a5-5239-406b-b56b-6c50f1268af3
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
support_searches = ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User"]
data_models = []
providing_technologies = none
description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.
narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and risk auditing within your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Console, AWS command-line interface, and AWS SDKs and APIs to ensure that your EC2 instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your AWS EC2 instances and helps you respond and investigate those activities.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Suspicious AWS Login Activities]
category = Cloud Security
creation_date = 2019-05-01
@@ -1661,8 +1458,8 @@ modification_date = 2018-10-23
id = c8ddc5be-69bc-4202-b3ab-4010b27d7ad5
version = 2
reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"]
detection_searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047", "T1546.003"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1047", "T1546.003"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
support_searches = []
data_models = ["Endpoint"]
@@ -1775,24 +1572,6 @@ Retrieval of script code\
The objective of this step is to confirm the executed script code is benign or malicious.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Unusual AWS EC2 Modifications]
category = Cloud Security
creation_date = 2018-04-09
modification_date = 2018-04-09
id = 73de57ef-0dfc-411f-b1e7-fa24428aeae0
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule"]
mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"]
support_searches = ["ESCU - Previously Seen EC2 Modifications By User"]
data_models = []
providing_technologies = none
description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation.
narrative = A common attack technique is to infiltrate a cloud instance and make modifications. The adversary can then secure access to your infrastructure or hide their activities. So it's important to stay alert to changes that may indicate that your environment has been compromised. \
Searches within this Analytic Story can help you detect the presence of a threat by monitoring for EC2 instances that have been created or changed--either by users that have never previously performed these activities or by known users who modify or create instances in a way that have not been done before. This story also provides investigative searches that help you go deeper once you detect suspicious behavior.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Unusual Processes]
category = Malware
creation_date = 2020-02-04
@@ -1829,28 +1608,6 @@ description = Leverage searches that detect cleartext network protocols that may
narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Web Fraud Detection]
category = Abuse
creation_date = 2018-10-08
modification_date = 2018-10-08
id = 31337aaa-bc22-4752-b599-ef112dq1dq7a
version = 1
reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"]
detection_searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule"]
mappings = {"cis20": ["CIS 16", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078", "T1136"], "nist": ["DE.AE", "DE.CM", "DE.DP"]}
investigative_searches = ["ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task"]
support_searches = []
data_models = []
providing_technologies = none
description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.
narrative = The Federal Bureau of Investigations (FBI) defines Internet fraud as the use of Internet services or software with Internet access to defraud victims or to otherwise take advantage of them. According to the Bureau, Internet crime schemes are used to steal millions of dollars each year from victims and continue to plague the Internet through various methods. The agency includes phishing scams, data breaches, Denial of Service (DOS) attacks, email account compromise, malware, spoofing, and ransomware in this category.\
These crimes are not the fraud itself, but rather the attack techniques commonly employed by fraudsters in their pursuit of data that enables them to commit malicious actssuch as obtaining and using stolen credit cards. They represent a serious problem that is steadily increasing and not likely to go away anytime soon.\
When developing a strategy for preventing fraud in your environment, its important to look across all of your web services for evidence that attackers are abusing enterprise resources to enumerate systems, harvest data for secondary fraudulent activity, or abuse terms of service.This Analytic Story looks for evidence of common Internet attack techniques that could be indicative of web fraud in your environmentincluding account harvesting, anomalous user clickspeed, and password sharing across accounts, to name just a few.\
The account-harvesting search focuses on web pages used for user-account registration. It detects the creation of a large number of user accounts using the same email domain name, a type of activity frequently seen in advance of a fraud campaign.\
The anomalous clickspeed search looks for users who are moving through your website at a faster-than-normal speed or with a perfect click cadence (high periodicity or low standard deviation), which could indicate that the user is a script, not an actual human.\
Another search detects incidents wherein a single password is used across multiple accounts, which may indicate that a fraudster has infiltrated your environment and embedded a common password within a script.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Windows DNS SIGRed CVE-2020-1350]
category = Adversary Tactics
creation_date = 2020-07-28
@@ -1913,7 +1670,7 @@ modification_date = 2017-09-12
id = b6db2c60-a281-48b4-95f1-2cd99ed56835
version = 2
reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"]
detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"]
detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"]
mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001", "T1490"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = []
dist/escu/default/analyticstories.conf
Vendored
+355 -274
View File
File diff suppressed because it is too large Load Diff
dist/escu/default/app.conf
Vendored
+2 -2
View File
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
build = 30583
build = 32018
[triggers]
reload.analytic_stories = simple
@@ -19,7 +19,7 @@ reload.content-version = simple
[launcher]
author = Splunk
version = 3.23.0
version = 3.24.0
description = Explore the Analytic Stories included with ES Content Updates.
[ui]
dist/escu/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-06-10T18:24:24 UTC
# On Date: 2021-06-24T18:00:37 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/content-version.conf
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
[content-version]
version = 3.23.0
version = 3.24.0
dist/escu/default/es_investigations.conf
Vendored
-91
View File
@@ -6,13 +6,6 @@ disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task", "panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_aws_cryptomining]
label = AWS Cryptomining
description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]
[panel_group://workbench_panel_group_aws_iam_privilege_escalation]
label = AWS IAM Privilege Escalation
description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.
@@ -34,13 +27,6 @@ disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task"]
[panel_group://workbench_panel_group_aws_suspicious_provisioning_activities]
label = AWS Suspicious Provisioning Activities
description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network.
disabled = 0
panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_city___response_task", "panel://workbench_panel_get_all_aws_activity_from_country___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_all_aws_activity_from_region___response_task"]
[panel_group://workbench_panel_group_aws_user_monitoring]
label = AWS User Monitoring
description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.
@@ -139,13 +125,6 @@ disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"]
[panel_group://workbench_panel_group_common_phishing_frameworks]
label = Common Phishing Frameworks
description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email.
disabled = 0
panels = ["panel://workbench_panel_domain_certificate_investigation___response_task", "panel://workbench_panel_get_certificate_logs_for_a_domain___response_task"]
[panel_group://workbench_panel_group_container_implantation_monitoring_and_investigation]
label = Container Implantation Monitoring and Investigation
description = Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry.
@@ -272,13 +251,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task"]
[panel_group://workbench_panel_group_host_redirection]
label = Host Redirection
description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website.
disabled = 0
panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_ingress_tool_transfer]
label = Ingress Tool Transfer
description = Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP.
@@ -307,13 +279,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_kubernetes_sensitive_role_activity]
label = Kubernetes Sensitive Role Activity
description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_lateral_movement]
label = Lateral Movement
description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.
@@ -342,20 +307,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_monitor_backup_solution]
label = Monitor Backup Solution
description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints.
disabled = 0
panels = ["panel://workbench_panel_all_backup_logs_for_host___response_task", "panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_monitor_for_unauthorized_software]
label = Monitor for Unauthorized Software
description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment.
disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]
[panel_group://workbench_panel_group_monitor_for_updates]
label = Monitor for Updates
description = Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches.
@@ -468,34 +419,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_spectre_and_meltdown_vulnerabilities]
label = Spectre And Meltdown Vulnerabilities
description = Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story.
disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_splunk_enterprise_vulnerability]
label = Splunk Enterprise Vulnerability
description = Keeping your Splunk deployment up to date is critical and may help you reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some older versions of Splunk Enterprise. The detection search will help ensure that users are being properly authenticated and not being redirected to malicious domains.
disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_splunk_enterprise_vulnerability_cve_2018_11409]
label = Splunk Enterprise Vulnerability CVE-2018-11409
description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users.
disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task"]
[panel_group://workbench_panel_group_suspicious_aws_ec2_activities]
label = Suspicious AWS EC2 Activities
description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.
disabled = 0
panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]
[panel_group://workbench_panel_group_suspicious_aws_login_activities]
label = Suspicious AWS Login Activities
description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.
@@ -643,13 +566,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_unusual_aws_ec2_modifications]
label = Unusual AWS EC2 Modifications
description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation.
disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_unusual_processes]
label = Unusual Processes
description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
@@ -664,13 +580,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"]
[panel_group://workbench_panel_group_web_fraud_detection]
label = Web Fraud Detection
description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.
disabled = 0
panels = ["panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_web_session_information_via_session_id___response_task"]
[panel_group://workbench_panel_group_windows_dns_sigred_cve_2020_1350]
label = Windows DNS SIGRed CVE-2020-1350
description = Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise. The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit.
dist/escu/default/macros.conf
Vendored
+89 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-06-10T18:24:25 UTC
# On Date: 2021-06-24T18:00:37 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -435,6 +435,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[allow_operation_with_consent_admin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[amazon_eks_kubernetes_pod_scan_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -511,6 +515,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[clear_unallocated_sector_using_cipher_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[clients_connecting_to_multiple_dns_servers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -723,6 +731,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_empire_with_powershell_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_excessive_account_lockouts_from_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -783,6 +795,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_mimikatz_with_powershell_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_local_admin_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -967,6 +983,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_wmi_event_subscription_persistence_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_windows_dns_sigred_via_splunk_stream_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1023,6 +1043,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_logs_using_wevtutil_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_registry_tool_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1175,6 +1199,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_number_of_taskhost_processes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1591,18 +1619,54 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[permission_modification_using_takeown_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[plain_http_post_exfiltrated_data_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_domain_enumeration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_start_bitstransfer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_creating_thread_mutex_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_fileless_process_injection_via_getprocaddress_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_fileless_script_contains_base64_encoded_content_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_processing_stream_of_data_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_remote_thread_to_known_windows_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_using_memory_as_backing_store_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[prevent_automatic_repair_mode_using_bcdedit_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[process_creating_lnk_file_in_suspicious_location_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1651,6 +1715,14 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[recon_avproduct_through_pwh_or_wmi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[recon_using_wmi_class_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[reg_exe_manipulating_windows_services_registry_keys_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1827,6 +1899,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[start_up_during_safe_mode_boot_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[sunburst_correlation_dll_and_network_event_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1859,6 +1935,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_event_log_service_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_file_write_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1991,6 +2071,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unloading_amsi_via_reflection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unsigned_image_loaded_by_lsass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2027,6 +2111,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wmi_recon_running_process_or_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wmi_temporary_event_subscription_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
dist/escu/default/savedsearches.conf
Vendored
+1327 -361
View File
File diff suppressed because it is too large Load Diff
dist/escu/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-06-10T18:24:24 UTC
# On Date: 2021-06-24T18:00:37 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/use_case_library.conf
Vendored
+355 -274
View File
File diff suppressed because it is too large Load Diff
dist/saaws/app.manifest
Vendored
+1 -1
View File
@@ -5,7 +5,7 @@
"id": {
"group": null,
"name": "DA-ESS_AmazonWebServices_Content",
"version": "3.23.0"
"version": "3.24.0"
},
"author": [
{
dist/saaws/default/analytic_stories.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-06-10T18:24:49 UTC
# On Date: 2021-06-24T18:00:54 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############

Some files were not shown because too many files have changed in this diff Show More