From 693ee6c03deaf7a1c82ad2fc4d941fc928ee866c Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Tue, 21 Jun 2022 14:40:19 +0200 Subject: [PATCH 01/19] model to detect risky commands --- ...ting_interpreter_detect_risky_spl_mltk.yml | 57 +++++++++++++++++++ lookups/__mlspl_DetectRiskySPL.yml | 6 ++ ...interpreter_detect_risky_spl_mltk.test.yml | 14 +++++ 3 files changed, 77 insertions(+) create mode 100644 detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml create mode 100644 lookups/__mlspl_DetectRiskySPL.yml create mode 100644 tests/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.test.yml diff --git a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml new file mode 100644 index 0000000000..bfe691c333 --- /dev/null +++ b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml @@ -0,0 +1,57 @@ +name: Splunk Command and Scripting Interpreter Detect Risky SPL MLTK +id: b4aefb5f-1037-410d-a149-1e091288ba33 +version: 1 +date: '2022-06-16' +author: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk +type: Anomaly +datamodel: +- Splunk_Audit +description: 'The following analytic uses a pre-trained machine learning text classifier to detect potentially risky commands. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.savedsearch_name Search_Activity.search_type + | eval spl_text = 'Search_Activity.search'. " " .'Search_Activity.user'. " " .'Search_Activity.search_type' + | apply DetectRiskySPL + | table Search_Activity.search, Search_Activity.user, Search_Activity.search_type, risk_score + |`splunk_command_and_scripting_interpreter_detect_risky_spl_mltk_filter`' +how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. +known_false_positives: False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 6 + confidence: 40 + cve: + - CVE-2022-32154 + context: + - Source:Endpoint + dataset: + - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: A potentially risky Splunk command has been run by $(Search_Activity.user), kindly review. + mitre_attack_id: + - T1059 + nist: + - DE.AE + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.user + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + diff --git a/lookups/__mlspl_DetectRiskySPL.yml b/lookups/__mlspl_DetectRiskySPL.yml new file mode 100644 index 0000000000..f4361bd161 --- /dev/null +++ b/lookups/__mlspl_DetectRiskySPL.yml @@ -0,0 +1,6 @@ +description: An MLTK model for detecting malicious commandlines +filename: __mlspl_DetectRiskySPL.mlmodel.mlmodel +name: __mlspl_DetectRiskySPL.mlmodel +case_sensitive_match: 'false' +min_matches: 1 +default_match: 'false' diff --git a/tests/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.test.yml b/tests/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.test.yml new file mode 100644 index 0000000000..bc3f68a213 --- /dev/null +++ b/tests/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.test.yml @@ -0,0 +1,14 @@ +name: Splunk Command and Scripting Interpreter Detect Risky SPL MLTK Unit Test +tests: +- name: Splunk Command and Scripting Interpreter Detect Risky SPL MLTK + file: application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -10y + latest_time: now + attack_data: + - file_name: search_activity.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + source: audittrail + sourcetype: audittrail + update_timestamp: true + custom_index: _audit From 8228c36d18c10a0edd4c4402e366ccaba4f87603 Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Tue, 21 Jun 2022 15:39:48 +0200 Subject: [PATCH 02/19] model to detect risky commands --- ..._command_and_scripting_interpreter_detect_risky_spl_mltk.yml | 1 + lookups/__mlspl_DetectRiskySPL.mlmodel | 2 ++ 2 files changed, 3 insertions(+) create mode 100644 lookups/__mlspl_DetectRiskySPL.mlmodel diff --git a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml index bfe691c333..ccbb6bec07 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml @@ -9,6 +9,7 @@ datamodel: description: 'The following analytic uses a pre-trained machine learning text classifier to detect potentially risky commands. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.savedsearch_name Search_Activity.search_type | eval spl_text = 'Search_Activity.search'. " " .'Search_Activity.user'. " " .'Search_Activity.search_type' + | dedup spl_text | apply DetectRiskySPL | table Search_Activity.search, Search_Activity.user, Search_Activity.search_type, risk_score |`splunk_command_and_scripting_interpreter_detect_risky_spl_mltk_filter`' diff --git a/lookups/__mlspl_DetectRiskySPL.mlmodel b/lookups/__mlspl_DetectRiskySPL.mlmodel new file mode 100644 index 0000000000..b217d05f0b --- /dev/null +++ b/lookups/__mlspl_DetectRiskySPL.mlmodel @@ -0,0 +1,2 @@ +algo,model,options +DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": ""collect|delete|fit|outputcsv|outputlookup|adhoc|sendalert|sendemail|splunk\\-system\\-user|tscollect|run|script|runshellscript"", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94700205837760, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""run"": 6, ""script"": 7, ""splunk-system-user"": 10, ""adhoc"": 0, ""delete"": 2, ""collect"": 1, ""outputlookup"": 5, ""sendemail"": 9, ""outputcsv"": 4, ""fit"": 3, ""sendalert"": 8, ""tscollect"": 11}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 3}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 12, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEyKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoJ2Llwab8rQCiu/el44vc/na1wqPt5BUBS9m4eUPILQBonfIHA8+a/Q0WJRaS/+T/DP5bBdcwNQLrfbPF6Pf0/omPwe8XB/D+FXV6Y32kDQIhuphupZSTA/h5iZ49Q8D8=""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAriY5zOOr0qwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoKAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""DetectRiskySPL"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" From f45aadfb8e94b1ea509781049e56ae205d75603b Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Tue, 21 Jun 2022 17:43:49 +0200 Subject: [PATCH 03/19] model to detect risky commands --- lookups/__mlspl_DetectRiskySPL.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lookups/__mlspl_DetectRiskySPL.yml b/lookups/__mlspl_DetectRiskySPL.yml index f4361bd161..24993c579b 100644 --- a/lookups/__mlspl_DetectRiskySPL.yml +++ b/lookups/__mlspl_DetectRiskySPL.yml @@ -1,4 +1,4 @@ -description: An MLTK model for detecting malicious commandlines +description: An MLTK model for detecting risky SPL filename: __mlspl_DetectRiskySPL.mlmodel.mlmodel name: __mlspl_DetectRiskySPL.mlmodel case_sensitive_match: 'false' From 7bb299490f5b253ca42c35e598a39dfba7ac0eaf Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Tue, 21 Jun 2022 17:47:31 +0200 Subject: [PATCH 04/19] model to detect risky commands --- lookups/__mlspl_DetectRiskySPL.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lookups/__mlspl_DetectRiskySPL.yml b/lookups/__mlspl_DetectRiskySPL.yml index 24993c579b..db6ad8d752 100644 --- a/lookups/__mlspl_DetectRiskySPL.yml +++ b/lookups/__mlspl_DetectRiskySPL.yml @@ -1,4 +1,4 @@ -description: An MLTK model for detecting risky SPL +description: An MLTK model for detecting Risky SPL filename: __mlspl_DetectRiskySPL.mlmodel.mlmodel name: __mlspl_DetectRiskySPL.mlmodel case_sensitive_match: 'false' From 67f35bba10fc69198e6c378bc3ef19c904059211 Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Tue, 21 Jun 2022 14:40:19 +0200 Subject: [PATCH 05/19] model to detect risky commands --- ...ting_interpreter_detect_risky_spl_mltk.yml | 57 +++++++++++++++++++ lookups/__mlspl_DetectRiskySPL.yml | 6 ++ ...interpreter_detect_risky_spl_mltk.test.yml | 14 +++++ 3 files changed, 77 insertions(+) create mode 100644 detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml create mode 100644 lookups/__mlspl_DetectRiskySPL.yml create mode 100644 tests/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.test.yml diff --git a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml new file mode 100644 index 0000000000..bfe691c333 --- /dev/null +++ b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml @@ -0,0 +1,57 @@ +name: Splunk Command and Scripting Interpreter Detect Risky SPL MLTK +id: b4aefb5f-1037-410d-a149-1e091288ba33 +version: 1 +date: '2022-06-16' +author: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk +type: Anomaly +datamodel: +- Splunk_Audit +description: 'The following analytic uses a pre-trained machine learning text classifier to detect potentially risky commands. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.savedsearch_name Search_Activity.search_type + | eval spl_text = 'Search_Activity.search'. " " .'Search_Activity.user'. " " .'Search_Activity.search_type' + | apply DetectRiskySPL + | table Search_Activity.search, Search_Activity.user, Search_Activity.search_type, risk_score + |`splunk_command_and_scripting_interpreter_detect_risky_spl_mltk_filter`' +how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. +known_false_positives: False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 6 + confidence: 40 + cve: + - CVE-2022-32154 + context: + - Source:Endpoint + dataset: + - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: A potentially risky Splunk command has been run by $(Search_Activity.user), kindly review. + mitre_attack_id: + - T1059 + nist: + - DE.AE + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.user + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + diff --git a/lookups/__mlspl_DetectRiskySPL.yml b/lookups/__mlspl_DetectRiskySPL.yml new file mode 100644 index 0000000000..f4361bd161 --- /dev/null +++ b/lookups/__mlspl_DetectRiskySPL.yml @@ -0,0 +1,6 @@ +description: An MLTK model for detecting malicious commandlines +filename: __mlspl_DetectRiskySPL.mlmodel.mlmodel +name: __mlspl_DetectRiskySPL.mlmodel +case_sensitive_match: 'false' +min_matches: 1 +default_match: 'false' diff --git a/tests/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.test.yml b/tests/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.test.yml new file mode 100644 index 0000000000..bc3f68a213 --- /dev/null +++ b/tests/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.test.yml @@ -0,0 +1,14 @@ +name: Splunk Command and Scripting Interpreter Detect Risky SPL MLTK Unit Test +tests: +- name: Splunk Command and Scripting Interpreter Detect Risky SPL MLTK + file: application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -10y + latest_time: now + attack_data: + - file_name: search_activity.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + source: audittrail + sourcetype: audittrail + update_timestamp: true + custom_index: _audit From 96652af2bf79ada842811c49b6f9c861d1fbec29 Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Tue, 21 Jun 2022 15:39:48 +0200 Subject: [PATCH 06/19] model to detect risky commands --- ..._command_and_scripting_interpreter_detect_risky_spl_mltk.yml | 1 + lookups/__mlspl_DetectRiskySPL.mlmodel | 2 ++ 2 files changed, 3 insertions(+) create mode 100644 lookups/__mlspl_DetectRiskySPL.mlmodel diff --git a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml index bfe691c333..ccbb6bec07 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml @@ -9,6 +9,7 @@ datamodel: description: 'The following analytic uses a pre-trained machine learning text classifier to detect potentially risky commands. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.savedsearch_name Search_Activity.search_type | eval spl_text = 'Search_Activity.search'. " " .'Search_Activity.user'. " " .'Search_Activity.search_type' + | dedup spl_text | apply DetectRiskySPL | table Search_Activity.search, Search_Activity.user, Search_Activity.search_type, risk_score |`splunk_command_and_scripting_interpreter_detect_risky_spl_mltk_filter`' diff --git a/lookups/__mlspl_DetectRiskySPL.mlmodel b/lookups/__mlspl_DetectRiskySPL.mlmodel new file mode 100644 index 0000000000..b217d05f0b --- /dev/null +++ b/lookups/__mlspl_DetectRiskySPL.mlmodel @@ -0,0 +1,2 @@ +algo,model,options +DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": ""collect|delete|fit|outputcsv|outputlookup|adhoc|sendalert|sendemail|splunk\\-system\\-user|tscollect|run|script|runshellscript"", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94700205837760, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""run"": 6, ""script"": 7, ""splunk-system-user"": 10, ""adhoc"": 0, ""delete"": 2, ""collect"": 1, ""outputlookup"": 5, ""sendemail"": 9, ""outputcsv"": 4, ""fit"": 3, ""sendalert"": 8, ""tscollect"": 11}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 3}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 12, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEyKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoJ2Llwab8rQCiu/el44vc/na1wqPt5BUBS9m4eUPILQBonfIHA8+a/Q0WJRaS/+T/DP5bBdcwNQLrfbPF6Pf0/omPwe8XB/D+FXV6Y32kDQIhuphupZSTA/h5iZ49Q8D8=""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAriY5zOOr0qwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoKAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""DetectRiskySPL"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" From 1120d578e5597f9ce13312691f4448d47ce10843 Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Tue, 21 Jun 2022 17:43:49 +0200 Subject: [PATCH 07/19] model to detect risky commands --- lookups/__mlspl_DetectRiskySPL.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lookups/__mlspl_DetectRiskySPL.yml b/lookups/__mlspl_DetectRiskySPL.yml index f4361bd161..24993c579b 100644 --- a/lookups/__mlspl_DetectRiskySPL.yml +++ b/lookups/__mlspl_DetectRiskySPL.yml @@ -1,4 +1,4 @@ -description: An MLTK model for detecting malicious commandlines +description: An MLTK model for detecting risky SPL filename: __mlspl_DetectRiskySPL.mlmodel.mlmodel name: __mlspl_DetectRiskySPL.mlmodel case_sensitive_match: 'false' From fe84f9fbf945e7c7cc04266edb1cd8a4fbb8a5da Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Tue, 21 Jun 2022 17:47:31 +0200 Subject: [PATCH 08/19] model to detect risky commands --- lookups/__mlspl_DetectRiskySPL.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lookups/__mlspl_DetectRiskySPL.yml b/lookups/__mlspl_DetectRiskySPL.yml index 24993c579b..db6ad8d752 100644 --- a/lookups/__mlspl_DetectRiskySPL.yml +++ b/lookups/__mlspl_DetectRiskySPL.yml @@ -1,4 +1,4 @@ -description: An MLTK model for detecting risky SPL +description: An MLTK model for detecting Risky SPL filename: __mlspl_DetectRiskySPL.mlmodel.mlmodel name: __mlspl_DetectRiskySPL.mlmodel case_sensitive_match: 'false' From f067ded25395867e13a705224c77783d22e03c4d Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Wed, 22 Jun 2022 16:38:22 +0200 Subject: [PATCH 09/19] model to detect risky commands --- ...ommand_and_scripting_interpreter_detect_risky_spl_mltk.yml | 4 +++- lookups/__mlspl_DetectRiskySPL.mlmodel | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml index ccbb6bec07..0e2d20c699 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml @@ -7,11 +7,13 @@ type: Anomaly datamodel: - Splunk_Audit description: 'The following analytic uses a pre-trained machine learning text classifier to detect potentially risky commands. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky.' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.savedsearch_name Search_Activity.search_type +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user Search_Activity.search_type | eval spl_text = 'Search_Activity.search'. " " .'Search_Activity.user'. " " .'Search_Activity.search_type' | dedup spl_text | apply DetectRiskySPL + | where risk_score > 0.6 | table Search_Activity.search, Search_Activity.user, Search_Activity.search_type, risk_score + | `drop_dm_object_name(Search_Activity)` |`splunk_command_and_scripting_interpreter_detect_risky_spl_mltk_filter`' how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. known_false_positives: False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords. diff --git a/lookups/__mlspl_DetectRiskySPL.mlmodel b/lookups/__mlspl_DetectRiskySPL.mlmodel index b217d05f0b..abaf42646b 100644 --- a/lookups/__mlspl_DetectRiskySPL.mlmodel +++ b/lookups/__mlspl_DetectRiskySPL.mlmodel @@ -1,2 +1,2 @@ algo,model,options -DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": ""collect|delete|fit|outputcsv|outputlookup|adhoc|sendalert|sendemail|splunk\\-system\\-user|tscollect|run|script|runshellscript"", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94700205837760, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""run"": 6, ""script"": 7, ""splunk-system-user"": 10, ""adhoc"": 0, ""delete"": 2, ""collect"": 1, ""outputlookup"": 5, ""sendemail"": 9, ""outputcsv"": 4, ""fit"": 3, ""sendalert"": 8, ""tscollect"": 11}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 3}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 12, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEyKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoJ2Llwab8rQCiu/el44vc/na1wqPt5BUBS9m4eUPILQBonfIHA8+a/Q0WJRaS/+T/DP5bBdcwNQLrfbPF6Pf0/omPwe8XB/D+FXV6Y32kDQIhuphupZSTA/h5iZ49Q8D8=""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAriY5zOOr0qwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoKAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""DetectRiskySPL"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" +DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": "" collect | delete | fit | outputcsv | outputlookup | adhoc | sendalert | sendemail | splunk\\-system\\-user | tscollect | run | script | runshellscript "", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94066371038656, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {"" outputlookup "": 4, "" run "": 5, "" collect "": 0, "" delete "": 1, "" script "": 7, "" sendemail "": 9, "" fit "": 2, "" sendalert "": 8, "" outputcsv "": 3, "" runshellscript "": 6, "" tscollect "": 10}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 10}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 11, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDExKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAaYLWqI8UQN0ZBmBI2wFAA2e/KLovHkAcQ6Ch+SiXv6D1hjY1+R9A1Atx/fgw3z9OyCic/2sVQPoFccfeeu4/fuPwqBnhHUAwqOnz71ggQO9NB0zB2SBA""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAr3/VNu+p4YwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoJAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""DetectRiskySPL"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" From 629e5c2e5e3e5391752d6ed1034d7f090b4c1253 Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Wed, 22 Jun 2022 16:47:07 +0200 Subject: [PATCH 10/19] model to detect risky commands --- lookups/__mlspl_DetectRiskySPL.mlmodel | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 lookups/__mlspl_DetectRiskySPL.mlmodel diff --git a/lookups/__mlspl_DetectRiskySPL.mlmodel b/lookups/__mlspl_DetectRiskySPL.mlmodel new file mode 100644 index 0000000000..3ed91fb331 --- /dev/null +++ b/lookups/__mlspl_DetectRiskySPL.mlmodel @@ -0,0 +1,6 @@ +algo,model,options +<<<<<<< HEAD +DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": "" collect | delete | fit | outputcsv | outputlookup | adhoc | sendalert | sendemail | splunk\\-system\\-user | tscollect | run | script | runshellscript "", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94066371038656, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {"" outputlookup "": 4, "" run "": 5, "" collect "": 0, "" delete "": 1, "" script "": 7, "" sendemail "": 9, "" fit "": 2, "" sendalert "": 8, "" outputcsv "": 3, "" runshellscript "": 6, "" tscollect "": 10}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 10}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 11, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDExKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAaYLWqI8UQN0ZBmBI2wFAA2e/KLovHkAcQ6Ch+SiXv6D1hjY1+R9A1Atx/fgw3z9OyCic/2sVQPoFccfeeu4/fuPwqBnhHUAwqOnz71ggQO9NB0zB2SBA""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAr3/VNu+p4YwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoJAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""DetectRiskySPL"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" +======= +DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": ""collect|delete|fit|outputcsv|outputlookup|adhoc|sendalert|sendemail|splunk\\-system\\-user|tscollect|run|script|runshellscript"", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94700205837760, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""run"": 6, ""script"": 7, ""splunk-system-user"": 10, ""adhoc"": 0, ""delete"": 2, ""collect"": 1, ""outputlookup"": 5, ""sendemail"": 9, ""outputcsv"": 4, ""fit"": 3, ""sendalert"": 8, ""tscollect"": 11}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 3}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 12, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEyKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoJ2Llwab8rQCiu/el44vc/na1wqPt5BUBS9m4eUPILQBonfIHA8+a/Q0WJRaS/+T/DP5bBdcwNQLrfbPF6Pf0/omPwe8XB/D+FXV6Y32kDQIhuphupZSTA/h5iZ49Q8D8=""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAriY5zOOr0qwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoKAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""DetectRiskySPL"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" +>>>>>>> b6fbbcfe7c6af0751ecfe29881fef410930280f7 From defa7b1bd021cc24d6979e71103effb2ec619122 Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Wed, 22 Jun 2022 16:57:52 +0200 Subject: [PATCH 11/19] model to detect risky commands --- lookups/__mlspl_DetectRiskySPL.mlmodel | 4 ---- 1 file changed, 4 deletions(-) diff --git a/lookups/__mlspl_DetectRiskySPL.mlmodel b/lookups/__mlspl_DetectRiskySPL.mlmodel index 3ed91fb331..abaf42646b 100644 --- a/lookups/__mlspl_DetectRiskySPL.mlmodel +++ b/lookups/__mlspl_DetectRiskySPL.mlmodel @@ -1,6 +1,2 @@ algo,model,options -<<<<<<< HEAD DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": "" collect | delete | fit | outputcsv | outputlookup | adhoc | sendalert | sendemail | splunk\\-system\\-user | tscollect | run | script | runshellscript "", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94066371038656, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {"" outputlookup "": 4, "" run "": 5, "" collect "": 0, "" delete "": 1, "" script "": 7, "" sendemail "": 9, "" fit "": 2, "" sendalert "": 8, "" outputcsv "": 3, "" runshellscript "": 6, "" tscollect "": 10}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 10}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 11, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDExKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAaYLWqI8UQN0ZBmBI2wFAA2e/KLovHkAcQ6Ch+SiXv6D1hjY1+R9A1Atx/fgw3z9OyCic/2sVQPoFccfeeu4/fuPwqBnhHUAwqOnz71ggQO9NB0zB2SBA""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAr3/VNu+p4YwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoJAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""DetectRiskySPL"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" -======= -DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": ""collect|delete|fit|outputcsv|outputlookup|adhoc|sendalert|sendemail|splunk\\-system\\-user|tscollect|run|script|runshellscript"", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94700205837760, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""run"": 6, ""script"": 7, ""splunk-system-user"": 10, ""adhoc"": 0, ""delete"": 2, ""collect"": 1, ""outputlookup"": 5, ""sendemail"": 9, ""outputcsv"": 4, ""fit"": 3, ""sendalert"": 8, ""tscollect"": 11}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 3}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 12, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEyKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoJ2Llwab8rQCiu/el44vc/na1wqPt5BUBS9m4eUPILQBonfIHA8+a/Q0WJRaS/+T/DP5bBdcwNQLrfbPF6Pf0/omPwe8XB/D+FXV6Y32kDQIhuphupZSTA/h5iZ49Q8D8=""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAriY5zOOr0qwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoKAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""DetectRiskySPL"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" ->>>>>>> b6fbbcfe7c6af0751ecfe29881fef410930280f7 From c35c786b09f889763c782c6ca48d4ae5975ac7a4 Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Wed, 22 Jun 2022 17:39:17 +0200 Subject: [PATCH 12/19] model to detect risky commands --- ..._command_and_scripting_interpreter_detect_risky_spl_mltk.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml index 0e2d20c699..8a6b87b22f 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml @@ -12,8 +12,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | dedup spl_text | apply DetectRiskySPL | where risk_score > 0.6 - | table Search_Activity.search, Search_Activity.user, Search_Activity.search_type, risk_score | `drop_dm_object_name(Search_Activity)` + | table search, user, search_type, risk_score |`splunk_command_and_scripting_interpreter_detect_risky_spl_mltk_filter`' how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. known_false_positives: False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords. From 26d6664e7cbf3d13c881d75132ec6119f26acc3c Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Wed, 22 Jun 2022 17:41:34 +0200 Subject: [PATCH 13/19] model to detect risky commands --- ..._command_and_scripting_interpreter_detect_risky_spl_mltk.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml index 8a6b87b22f..b86c43eab0 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name(Search_Activity)` | table search, user, search_type, risk_score |`splunk_command_and_scripting_interpreter_detect_risky_spl_mltk_filter`' -how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. +how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. known_false_positives: False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning From 7328ea1aa34643d2d36d587f572135b80126f5ad Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Wed, 22 Jun 2022 19:34:06 +0200 Subject: [PATCH 14/19] model to detect risky commands --- lookups/__mlspl_DetectRiskySPL.mlmodel | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lookups/__mlspl_DetectRiskySPL.mlmodel b/lookups/__mlspl_DetectRiskySPL.mlmodel index abaf42646b..5d0d91e8ab 100644 --- a/lookups/__mlspl_DetectRiskySPL.mlmodel +++ b/lookups/__mlspl_DetectRiskySPL.mlmodel @@ -1,2 +1,2 @@ algo,model,options -DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": "" collect | delete | fit | outputcsv | outputlookup | adhoc | sendalert | sendemail | splunk\\-system\\-user | tscollect | run | script | runshellscript "", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94066371038656, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {"" outputlookup "": 4, "" run "": 5, "" collect "": 0, "" delete "": 1, "" script "": 7, "" sendemail "": 9, "" fit "": 2, "" sendalert "": 8, "" outputcsv "": 3, "" runshellscript "": 6, "" tscollect "": 10}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 10}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 11, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDExKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAaYLWqI8UQN0ZBmBI2wFAA2e/KLovHkAcQ6Ch+SiXv6D1hjY1+R9A1Atx/fgw3z9OyCic/2sVQPoFccfeeu4/fuPwqBnhHUAwqOnz71ggQO9NB0zB2SBA""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAr3/VNu+p4YwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoJAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""DetectRiskySPL"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" +DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": "" collect | delete | fit | outputcsv | outputlookup |adhoc| sendalert | sendemail |splunk\\-system\\-user| tscollect | run | script | runshellscript "", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 93945751375296, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""splunk-system-user"": 12, "" run "": 5, ""adhoc"": 11, "" outputlookup "": 4, "" script "": 7, "" collect "": 0, "" delete "": 1, "" sendemail "": 9, "" outputcsv "": 3, "" fit "": 2, "" sendalert "": 8, "" runshellscript "": 6, "" tscollect "": 10}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 10}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 13, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEzKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIArRdMbIM2UTQLPPLSBIYeo/c4UnLzRpFUDIICwU5pEyP7kO8itKkhxAOuHlrw4i5j+E2SY9bV/qP4PO0bJFnwlAaAVjj7oWE0BcuweNQTYaQGbwINQQWRZAsglNErMgHEBRVDjra6YTwA==""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIApY19iilM4jwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoLAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""DetectRiskySPL"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" From 8d568ae4165eba9b758b0ab51b6b87ea8aaae506 Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Thu, 23 Jun 2022 22:43:22 +0200 Subject: [PATCH 15/19] model to detect risky commands --- ... => detect_risky_spl_using_pretrained_ml_model.yml} | 10 +++++----- lookups/__mlspl_DetectRiskySPL.mlmodel | 2 -- lookups/__mlspl_DetectRiskySPL.yml | 6 ------ lookups/__mlspl_risky_spl_pre_trained_model.mlmodel | 2 ++ lookups/__mlspl_risky_spl_pre_trained_model.yml | 6 ++++++ ...isky_spl_using_pretrained_ml_model_filter.test.yml} | 4 ++-- 6 files changed, 15 insertions(+), 15 deletions(-) rename detections/application/{splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml => detect_risky_spl_using_pretrained_ml_model.yml} (73%) delete mode 100644 lookups/__mlspl_DetectRiskySPL.mlmodel delete mode 100644 lookups/__mlspl_DetectRiskySPL.yml create mode 100644 lookups/__mlspl_risky_spl_pre_trained_model.mlmodel create mode 100644 lookups/__mlspl_risky_spl_pre_trained_model.yml rename tests/application/{splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.test.yml => detect_risky_spl_using_pretrained_ml_model_filter.test.yml} (75%) diff --git a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml similarity index 73% rename from detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml rename to detections/application/detect_risky_spl_using_pretrained_ml_model.yml index b86c43eab0..a1cfa7dea4 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml +++ b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml @@ -1,4 +1,4 @@ -name: Splunk Command and Scripting Interpreter Detect Risky SPL MLTK +name: Detect Risky SPL using Pretrained ML Model id: b4aefb5f-1037-410d-a149-1e091288ba33 version: 1 date: '2022-06-16' @@ -6,15 +6,15 @@ author: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk type: Anomaly datamodel: - Splunk_Audit -description: 'The following analytic uses a pre-trained machine learning text classifier to detect potentially risky commands. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky.' +description: 'The following analytic uses a pretrained machine learning text classifier to detect potentially risky commands. The model is trained independently and then packaged within MLTK for usage. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model uses custom features to predict whether a SPL is risky using text classification. The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user Search_Activity.search_type | eval spl_text = 'Search_Activity.search'. " " .'Search_Activity.user'. " " .'Search_Activity.search_type' | dedup spl_text - | apply DetectRiskySPL - | where risk_score > 0.6 + | apply risky_spl_pre_trained_model + | where risk_score > 0.5 | `drop_dm_object_name(Search_Activity)` | table search, user, search_type, risk_score - |`splunk_command_and_scripting_interpreter_detect_risky_spl_mltk_filter`' + |`detect_risky_spl_using_pretrained_ml_model_filter`' how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. known_false_positives: False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords. references: diff --git a/lookups/__mlspl_DetectRiskySPL.mlmodel b/lookups/__mlspl_DetectRiskySPL.mlmodel deleted file mode 100644 index 5d0d91e8ab..0000000000 --- a/lookups/__mlspl_DetectRiskySPL.mlmodel +++ /dev/null @@ -1,2 +0,0 @@ -algo,model,options -DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": "" collect | delete | fit | outputcsv | outputlookup |adhoc| sendalert | sendemail |splunk\\-system\\-user| tscollect | run | script | runshellscript "", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 93945751375296, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""splunk-system-user"": 12, "" run "": 5, ""adhoc"": 11, "" outputlookup "": 4, "" script "": 7, "" collect "": 0, "" delete "": 1, "" sendemail "": 9, "" outputcsv "": 3, "" fit "": 2, "" sendalert "": 8, "" runshellscript "": 6, "" tscollect "": 10}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 10}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 13, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEzKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIArRdMbIM2UTQLPPLSBIYeo/c4UnLzRpFUDIICwU5pEyP7kO8itKkhxAOuHlrw4i5j+E2SY9bV/qP4PO0bJFnwlAaAVjj7oWE0BcuweNQTYaQGbwINQQWRZAsglNErMgHEBRVDjra6YTwA==""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIApY19iilM4jwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoLAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""DetectRiskySPL"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" diff --git a/lookups/__mlspl_DetectRiskySPL.yml b/lookups/__mlspl_DetectRiskySPL.yml deleted file mode 100644 index db6ad8d752..0000000000 --- a/lookups/__mlspl_DetectRiskySPL.yml +++ /dev/null @@ -1,6 +0,0 @@ -description: An MLTK model for detecting Risky SPL -filename: __mlspl_DetectRiskySPL.mlmodel.mlmodel -name: __mlspl_DetectRiskySPL.mlmodel -case_sensitive_match: 'false' -min_matches: 1 -default_match: 'false' diff --git a/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel b/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel new file mode 100644 index 0000000000..9bffe05f86 --- /dev/null +++ b/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel @@ -0,0 +1,2 @@ +algo,model,options +risky_spl_pre_trained_model,"{""__mlspl_type"": [""algos.risky_spl_pre_trained_model"", ""risky_spl_pre_trained_model""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": "" collect | delete | fit | outputcsv | outputlookup |adhoc| sendalert | sendemail |splunk\\-system\\-user| tscollect | run | script | runshellscript "", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 93945751375296, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""splunk-system-user"": 12, "" run "": 5, ""adhoc"": 11, "" outputlookup "": 4, "" script "": 7, "" collect "": 0, "" delete "": 1, "" sendemail "": 9, "" outputcsv "": 3, "" fit "": 2, "" sendalert "": 8, "" runshellscript "": 6, "" tscollect "": 10}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 10}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 13, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEzKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIArRdMbIM2UTQLPPLSBIYeo/c4UnLzRpFUDIICwU5pEyP7kO8itKkhxAOuHlrw4i5j+E2SY9bV/qP4PO0bJFnwlAaAVjj7oWE0BcuweNQTYaQGbwINQQWRZAsglNErMgHEBRVDjra6YTwA==""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIApY19iilM4jwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoLAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""risky_spl_pre_trained_model"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" diff --git a/lookups/__mlspl_risky_spl_pre_trained_model.yml b/lookups/__mlspl_risky_spl_pre_trained_model.yml new file mode 100644 index 0000000000..da0fe9b35e --- /dev/null +++ b/lookups/__mlspl_risky_spl_pre_trained_model.yml @@ -0,0 +1,6 @@ +description: Detect Risky SPL using Pretrained ML Model +filename: __mlspl_risky_spl_pre_trained_model.mlmodel +name: __mlspl_risky_spl_pre_trained_model +case_sensitive_match: 'false' +min_matches: 1 +default_match: 'false' diff --git a/tests/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.test.yml b/tests/application/detect_risky_spl_using_pretrained_ml_model_filter.test.yml similarity index 75% rename from tests/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.test.yml rename to tests/application/detect_risky_spl_using_pretrained_ml_model_filter.test.yml index bc3f68a213..7a19efffe2 100644 --- a/tests/application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.test.yml +++ b/tests/application/detect_risky_spl_using_pretrained_ml_model_filter.test.yml @@ -1,6 +1,6 @@ -name: Splunk Command and Scripting Interpreter Detect Risky SPL MLTK Unit Test +name: Detect Risky SPL using Pretrained ML Model Unit Test tests: -- name: Splunk Command and Scripting Interpreter Detect Risky SPL MLTK +- name: Detect Risky SPL using Pretrained ML Model file: application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml pass_condition: '| stats count | where count > 0' earliest_time: -10y From 967bc6e113a2e1fa7e672174b6f1339fe9e6b342 Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Thu, 23 Jun 2022 23:02:44 +0200 Subject: [PATCH 16/19] model to detect risky commands --- ...st.yml => detect_risky_spl_using_pretrained_ml_model.test.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/application/{detect_risky_spl_using_pretrained_ml_model_filter.test.yml => detect_risky_spl_using_pretrained_ml_model.test.yml} (100%) diff --git a/tests/application/detect_risky_spl_using_pretrained_ml_model_filter.test.yml b/tests/application/detect_risky_spl_using_pretrained_ml_model.test.yml similarity index 100% rename from tests/application/detect_risky_spl_using_pretrained_ml_model_filter.test.yml rename to tests/application/detect_risky_spl_using_pretrained_ml_model.test.yml From cb150c258e89bbac983a403680812ffb272d3eae Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 23 Jun 2022 15:21:30 -0700 Subject: [PATCH 17/19] minor edits for yml validation and test file name update --- ...etect_risky_spl_using_pretrained_ml_model.yml | 16 +++++++--------- ...risky_spl_using_pretrained_ml_model.test.yml} | 4 ++-- 2 files changed, 9 insertions(+), 11 deletions(-) rename tests/application/{detect_risky_spl_using_pretrained_ml_model_filter.test.yml => detect_risky_spl_using_pretrained_ml_model.test.yml} (80%) diff --git a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml index a1cfa7dea4..becba97869 100644 --- a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml +++ b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml @@ -6,15 +6,13 @@ author: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk type: Anomaly datamodel: - Splunk_Audit -description: 'The following analytic uses a pretrained machine learning text classifier to detect potentially risky commands. The model is trained independently and then packaged within MLTK for usage. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model uses custom features to predict whether a SPL is risky using text classification. The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky.' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user Search_Activity.search_type - | eval spl_text = 'Search_Activity.search'. " " .'Search_Activity.user'. " " .'Search_Activity.search_type' - | dedup spl_text - | apply risky_spl_pre_trained_model - | where risk_score > 0.5 - | `drop_dm_object_name(Search_Activity)` - | table search, user, search_type, risk_score - |`detect_risky_spl_using_pretrained_ml_model_filter`' +description: 'The following analytic uses a pretrained machine learning text classifier to detect potentially risky commands. The model is trained independently and then the model file packaged within ESCU for usage. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model uses custom features to predict whether a SPL is risky using text classification. The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky.' +search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user Search_Activity.search_type | eval spl_text = 'Search_Activity.search'. \" \" .'Search_Activity.user'. \" \" .'Search_Activity.search_type'| dedup spl_text +| apply risky_spl_pre_trained_model +| where risk_score > 0.5 +| `drop_dm_object_name(Search_Activity)` +| table search, user, search_type, risk_score +| `detect_risky_spl_using_pretrained_ml_model_filter`" how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. known_false_positives: False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords. references: diff --git a/tests/application/detect_risky_spl_using_pretrained_ml_model_filter.test.yml b/tests/application/detect_risky_spl_using_pretrained_ml_model.test.yml similarity index 80% rename from tests/application/detect_risky_spl_using_pretrained_ml_model_filter.test.yml rename to tests/application/detect_risky_spl_using_pretrained_ml_model.test.yml index 7a19efffe2..b9cd1cf580 100644 --- a/tests/application/detect_risky_spl_using_pretrained_ml_model_filter.test.yml +++ b/tests/application/detect_risky_spl_using_pretrained_ml_model.test.yml @@ -1,7 +1,7 @@ name: Detect Risky SPL using Pretrained ML Model Unit Test tests: - name: Detect Risky SPL using Pretrained ML Model - file: application/splunk_command_and_scripting_interpreter_detect_risky_spl_mltk.yml + file: application/detect_risky_spl_using_pretrained_ml_model.yml pass_condition: '| stats count | where count > 0' earliest_time: -10y latest_time: now @@ -11,4 +11,4 @@ tests: source: audittrail sourcetype: audittrail update_timestamp: true - custom_index: _audit + custom_index: _audit \ No newline at end of file From 28c799e8299a7ad2c3126367e5d405d7956b0030 Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Wed, 29 Jun 2022 23:45:27 +0200 Subject: [PATCH 18/19] model to detect risky commands --- .../detect_risky_spl_using_pretrained_ml_model.yml | 4 ++-- lookups/__mlspl_risky_spl_pre_trained_model.mlmodel | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml index becba97869..3542c85964 100644 --- a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml +++ b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml @@ -13,7 +13,7 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name(Search_Activity)` | table search, user, search_type, risk_score | `detect_risky_spl_using_pretrained_ml_model_filter`" -how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. +how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. The detection uses a custom MLTK model hence we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb. known_false_positives: False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning @@ -34,7 +34,7 @@ tags: impact: 50 kill_chain_phases: - Actions on Objectives - message: A potentially risky Splunk command has been run by $(Search_Activity.user), kindly review. + message: A potentially risky Splunk command has been run by $user$, kindly review. mitre_attack_id: - T1059 nist: diff --git a/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel b/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel index 9bffe05f86..5aa2f7fd9c 100644 --- a/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel +++ b/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel @@ -1,2 +1,2 @@ algo,model,options -risky_spl_pre_trained_model,"{""__mlspl_type"": [""algos.risky_spl_pre_trained_model"", ""risky_spl_pre_trained_model""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": "" collect | delete | fit | outputcsv | outputlookup |adhoc| sendalert | sendemail |splunk\\-system\\-user| tscollect | run | script | runshellscript "", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 93945751375296, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""splunk-system-user"": 12, "" run "": 5, ""adhoc"": 11, "" outputlookup "": 4, "" script "": 7, "" collect "": 0, "" delete "": 1, "" sendemail "": 9, "" outputcsv "": 3, "" fit "": 2, "" sendalert "": 8, "" runshellscript "": 6, "" tscollect "": 10}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 10}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 13, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEzKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIArRdMbIM2UTQLPPLSBIYeo/c4UnLzRpFUDIICwU5pEyP7kO8itKkhxAOuHlrw4i5j+E2SY9bV/qP4PO0bJFnwlAaAVjj7oWE0BcuweNQTYaQGbwINQQWRZAsglNErMgHEBRVDjra6YTwA==""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIApY19iilM4jwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoLAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""risky_spl_pre_trained_model"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" +DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": "" collect | delete | fit | outputcsv | outputlookup |adhoc| sendalert | sendemail |splunk\\-system\\-user| tscollect | run | script | runshellscript "", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94300723879360, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""splunk-system-user"": 12, "" delete "": 1, ""adhoc"": 11, "" outputlookup "": 4, "" script "": 7, "" run "": 5, "" collect "": 0, "" sendemail "": 9, "" sendalert "": 8, "" outputcsv "": 3, "" fit "": 2, "" runshellscript "": 6, "" tscollect "": 10}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 10}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 13, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEzKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAqulbT8VG8TQJU6VfC9QuY/kCCmapJVFUDQl14TS2ApPw5vYc32jBxAxVuQ3Sv35D8Y+azG/kDmP9vpUE0rTwlALsMVcoUGE0ASjjFaKyMaQA2zZ/yMQRZAQLZHc97OHEAfrzTDBGwSwA==""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAqBnhyKtBckwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoLAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""risky_spl_pre_trained_model"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" From 4cdbe51506a3f58f87fdfb9f1b3e908788676014 Mon Sep 17 00:00:00 2001 From: Kumar Sharad Date: Thu, 14 Jul 2022 16:37:47 +0200 Subject: [PATCH 19/19] model to detect risky commands --- .../application/detect_risky_spl_using_pretrained_ml_model.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml index 3542c85964..fbd9951d54 100644 --- a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml +++ b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml @@ -6,7 +6,7 @@ author: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk type: Anomaly datamodel: - Splunk_Audit -description: 'The following analytic uses a pretrained machine learning text classifier to detect potentially risky commands. The model is trained independently and then the model file packaged within ESCU for usage. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model uses custom features to predict whether a SPL is risky using text classification. The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky.' +description: 'The following analytic uses a pretrained machine learning text classifier to detect potentially risky commands. The model is trained independently and then the model file is packaged within ESCU for usage. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model uses custom features to predict whether a SPL is risky using text classification. The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky. This model is on-prem only.' search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user Search_Activity.search_type | eval spl_text = 'Search_Activity.search'. \" \" .'Search_Activity.user'. \" \" .'Search_Activity.search_type'| dedup spl_text | apply risky_spl_pre_trained_model | where risk_score > 0.5