admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' of github.com:splunk/security-content into tf23

Browse Source
This commit is contained in:
Xiao Lin
2021-10-06 09:47:25 -07:00
parent 980bc2a3b8 7e55d63c64
commit aa9dc8cacc
115 changed files with 1476 additions and 18083 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-and-validate.yml
+4 -9
View File
@@ -148,10 +148,10 @@ jobs:
python3 contentctl.py --path . --verbose generate --product ESCU --output dist/escu
python3 contentctl.py --path . --verbose generate --product SAAWS --output dist/saaws
python3 contentctl.py --path . --verbose generate --product DevSecOps --output dist/devsecops
#make a copy of use_case_lib in order to have ES work :-(
cp dist/escu/default/use_case_library.conf dist/escu/default/analyticstories.conf
cp dist/saaws/default/use_case_library.conf dist/saaws/default/analyticstories.conf
cp dist/devsecops/default/use_case_library.conf dist/devsecops/default/analyticstories.conf
# make a copy of use_case_lib in order to have ES work :-(
# cp dist/escu/default/use_case_library.conf dist/escu/default/analyticstories.conf
# cp dist/saaws/default/use_case_library.conf dist/saaws/default/analyticstories.conf
# cp dist/devsecops/default/use_case_library.conf dist/devsecops/default/analyticstories.conf
- name: Copy lookups .csv files
run: |
@@ -474,11 +474,6 @@ jobs:
source venv/bin/activate
python3 bin/pretty_yaml.py --path . -v
- name: Run generate-actors-map
run: |
source venv/bin/activate
python3 bin/generate-actors-map.py --projects_path . --output docs/mitre-map/
- name: Run generate-coverage-map
run: |
source venv/bin/activate
README.md
-5
View File
@@ -80,11 +80,6 @@ To view an up-to-date detection coverage map for all the content tagged with MIT
![](docs/mitre-map/coverage.png)
### Detection Priority by Threat Actors
If curious about how the Threat Research team prioritizes what content to build refer to our **Detection Priority by Threat Actors** layer in [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/). Using the actor data from [MITRE CTI](https://github.com/mitre/cti) we add a point for every threat actor that uses a particular technique, and then subtract a point of every detection we have mapped to that technique. The resulting map below is how we prioritize what techniques and detections to focus on next. This map is automatically updated on every release and is generated by the [generate-actors-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-actors-map.py) script.
![](docs/mitre-map/priority.png)
# Customize to your Environment 🏗
Customize your content to change how [often detections run](https://github.com/splunk/security_content/wiki/Customize-to-Your-Environment#customizing-scheduling-and-alert-actions-with-deployments), or what the right source type for [sysmon](https://github.com/splunk/security_content/wiki/Customize-to-Your-Environment#customizing-source-types-with-macros) in your environment is please follow this [guide](https://github.com/splunk/security_content/wiki/Customize-to-Your-Environment).
automated_detection_testing/requirements.txt
+1 -1
View File
@@ -72,7 +72,7 @@ splunk-sdk==1.6.16
tabulate==0.8.9
termcolor==1.1.0
toml==0.10.2
urllib3<=1.26.6
urllib3<1.26.8
virtualenv==20.4.6
wcwidth==0.2.5
wget==3.2
bin/generate-actors-map.py
-251
View File
@@ -1,251 +0,0 @@
#!/usr/bin/python
import sys
import argparse
import json
import glob
import yaml
import os
import csv
from os import path
from stix2 import FileSystemSource
from stix2 import Filter
VERSION = "4.2"
NAME = "Detection Priority by Threat Actors"
DESCRIPTION = "security_content detection priorty by common techniques used from threat actors"
DOMAIN = "mitre-enterprise"
def main(argv):
# parse input variables
parser = argparse.ArgumentParser(description='Detection Priority based on APT groups')
parser.add_argument('-p', '--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma')
parser.add_argument('-o', '--output', default='output', action='store', help='result output directory, defaults to output')
cmdargs = parser.parse_args()
print("get all techniques for group")
techniques, all_techniques = get_all_techniques_for_groups(cmdargs.projects_path)
print("count techniques")
counted_techniques, max_count = count_techniques(techniques, all_techniques)
print("load detections techniques")
detections = []
detections = load_objects(path.join(cmdargs.projects_path),'detections/*/*.yml')
print("get matched techniques")
matched_techniques = get_matched_techniques(counted_techniques, detections)
print("generate navigator layer")
generate_navigator_layer(matched_techniques, max_count, cmdargs.output)
print("generate csv file")
generate_csv_file(matched_techniques, cmdargs.output)
def count_techniques(techniques, all_techniques):
counted_techniques = []
final_counted_techniques = []
max_count = 0
actors = []
for all_technique in all_techniques:
count_technique = sum(t['name'] == all_technique['name'] for t in techniques)
if count_technique > 0:
counted_techniques.append({'name': all_technique['name'], 'object': all_technique, 'count': count_technique})
max_count = count_technique if count_technique > max_count else max_count
for all_technique in all_techniques:
if "." in all_technique["external_references"][0]["external_id"]:
parent_id = all_technique["external_references"][0]["external_id"].split(".")[0]
for counted in counted_techniques:
if parent_id == counted["object"]["external_references"][0]["external_id"]:
counted['count'] += 1
final_counted_techniques.append(counted)
counted_techniques = sorted(final_counted_techniques, key = lambda i: i['count'], reverse=True)
return counted_techniques, max_count
def get_all_techniques_for_groups(projects_path):
path_cti = path.join(projects_path,'cti/enterprise-attack')
fs = FileSystemSource(path_cti)
all_techniques = get_all_techniques(fs)
techniques = []
groups = get_all_groups(fs)
for group_obj in groups:
techniques.extend(get_technique_by_group(fs, group_obj))
# ONLY FOR TESTING
#if len(techniques) > 50 :
# return techniques, all_techniques
return techniques, all_techniques
def get_all_techniques(src):
filt = [Filter('type', '=', 'attack-pattern')]
return src.query(filt)
def get_all_groups(src):
filt = [Filter('type', '=', 'intrusion-set')]
return src.query(filt)
def get_technique_by_group(src, stix_id):
relations = src.relationships(stix_id, 'uses', source_only=True)
return src.query([
Filter('type', '=', 'attack-pattern'),
Filter('id', 'in', [r.target_ref for r in relations])
])
def get_matched_techniques(counted_techniques, detections):
matched_techniques = []
for technique in counted_techniques:
matched_splunk_detections = []
# find detections from Splunks security content
# https://github.com/splunk/security_content
for detection in detections:
if 'mitre_attack_id' in detection['object']['tags']:
for mitreid in detection['object']['tags']['mitre_attack_id']:
if mitreid == technique["object"]["external_references"][0]["external_id"]:
matched_splunk_detections.append(detection)
matched_techniques.append({
"ID": technique["object"]["external_references"][0]["external_id"],
# substract the amount of detections we have from the score
"score": technique["count"] - len(matched_splunk_detections),
"splunk_rules": matched_splunk_detections,
})
return matched_techniques
def generate_navigator_layer(matched_techniques, max_count, output):
# Base ATT&CK Navigator layer
layer_json = {
"version": VERSION,
"name": NAME,
"description": DESCRIPTION,
"domain": DOMAIN,
"techniques": []
}
for technique in matched_techniques:
comments = []
layer_technique = {
"techniqueID": technique["ID"],
"score" : technique["score"],
"showSubtechniques": False
}
if len(technique["splunk_rules"]) > 0:
for splunk_rule in technique["splunk_rules"]:
comments.append("https://github.com/splunk/security_content/blob/develop/detections/" + splunk_rule['filename'])
if len(comments) > 0:
layer_technique["comment"] = "\n\n".join(comments)
layer_json["techniques"].append(layer_technique)
# add a color gradient (white -> red) to layer
# ranging from zero (white) to the maximum score in the file (red)
layer_json["gradient"] = {
"colors": [
"#66b1ff",
"#ff66f4",
"#ff6666"
],
"minValue": 0,
"maxValue": max_count
}
layer_json["filters"] = {
"platforms":
["Windows",
"Linux",
"macOS",
"AWS",
"GCP",
"Azure",
"Office 365",
"SaaS"
]
}
layer_json["legendItems"] = [
{
"label": "Low Priority",
"color": "#66b1ff"
},
{
"label": "Medium Priority",
"color": "#ff66f4"
},
{
"label": "High Priority",
"color": "#ff6666"
}
]
layer_json['showTacticRowBackground'] = True
layer_json['tacticRowBackground'] = "#dddddd"
# output JSON
with open(output + '/detections.json', 'w') as f:
json.dump(layer_json, f, indent=4)
# print("Mitre ATT&CK Navigator overlay was successfully written to output/detections.json")
def generate_csv_file(matched_techniques, output):
security_content_url = 'https://github.com/splunk/security_content/blob/develop/detections/'
with open(output + '/detections.csv', 'w') as f:
writer = csv.writer(f, quoting=csv.QUOTE_ALL)
writer.writerow(['Technique ID', 'Detection Available', 'Link', 'score'])
for technique in matched_techniques:
if len(technique['splunk_rules']) > 0:
for splunk_rule in technique["splunk_rules"]:
writer.writerow([technique["ID"], "Yes", \
security_content_url + splunk_rule["filename"], technique['score']])
else:
writer.writerow([technique["ID"], "No", \
"-", technique['score']])
# print("Recommended detections were successfully written to output/detections.csv")
def load_objects(security_content_path, file_path):
files = []
detection_files = path.join(path.expanduser(security_content_path), file_path)
for file in glob.glob(detection_files):
file_name = file.replace('./detections/', '')
files.append({
"filename": file_name,
"object": load_file(file)
})
return files
def load_file(file_path):
with open(file_path, 'r') as stream:
try:
file = list(yaml.safe_load_all(stream))[0]
except yaml.YAMLError as exc:
sys.exit("ERROR: reading {0}".format(file_path))
return file
if __name__ == "__main__":
main(sys.argv)
bin/generate.py
+15 -15
View File
@@ -113,26 +113,26 @@ def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_P
return output_path
def generate_analytic_story_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH):
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
# def generate_analytic_story_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH):
# utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
trim_blocks=True)
template = j2_env.get_template('analytic_stories.j2')
output_path = path.join(OUTPUT_PATH, 'default/analytic_stories.conf')
output = template.render(stories=stories, time=utc_time)
with open(output_path, 'w', encoding="utf-8") as f:
f.write(output)
# j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
# trim_blocks=True)
# template = j2_env.get_template('analytic_stories.j2')
# output_path = path.join(OUTPUT_PATH, 'default/analytic_stories.conf')
# output = template.render(stories=stories, time=utc_time)
# with open(output_path, 'w', encoding="utf-8") as f:
# f.write(output)
return output_path
# return output_path
def generate_use_case_library_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH):
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
trim_blocks=True)
template = j2_env.get_template('use_case_library.j2')
output_path = path.join(OUTPUT_PATH, 'default/use_case_library.conf')
template = j2_env.get_template('analyticstories.j2')
output_path = path.join(OUTPUT_PATH, 'default/analyticstories.conf')
output = template.render(stories=stories, detections=detections,
time=utc_time)
with open(output_path, 'w', encoding="utf-8") as f:
@@ -480,7 +480,7 @@ def prepare_stories(stories, detections, playbooks):
sto_to_nists = {}
sto_to_det = {}
preface = " The following Splunk SOAR playbooks can be used in the response to this story's analytics: "
preface = " /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics: "
baselines = [object for object in detections if 'Baseline' in object['type']]
for detection in detections:
@@ -665,7 +665,7 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
story_path = generate_analytic_story_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
# story_path = generate_analytic_story_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
@@ -680,7 +680,7 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
deprecated.append(d)
if VERBOSE:
print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), story_path))
print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path))
print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
bin/jinja2_templates/analytic_stories.j2
-45
View File
@@ -1,45 +0,0 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: {{ time }} UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
### STORIES ###
{% for story in stories %}
[{{ story.name }}]
category = {{ story.tags.category[0] }}
creation_date = {{ story.date }}
modification_date = {{ story.date }}
id = {{ story.id }}
version = {{ story.version }}
reference = {{ story.references | tojson }}
detection_searches = {{ story.detections | tojson }}
{% if story.mappings is defined %}
mappings = {{ story.mappings | tojson }}
{% endif %}
{% if story.response_tasks is defined %}
investigative_searches = {{ story.response_tasks | tojson }}
{% else %}
investigative_searches = []
{% endif %}
{% if story.baselines is defined %}
support_searches = {{ story.baselines | tojson }}
{% else %}
support_searches = []
{% endif %}
{% if story.data_models is defined %}
data_models = {{ story.data_models | tojson }}
{% else %}
data_models = []
{% endif %}
providing_technologies = none
description = {{ story.description }}
{% if story.narrative is defined %}
narrative = {{ story.narrative }}
{% endif %}
product = {{ story.tags.product}}
{% endfor %}
#### END STORIES ####
bin/jinja2_templates/use_case_library.j2 → bin/jinja2_templates/analyticstories.j2
View File
bin/jinja2_templates/savedsearches.j2
-73
View File
@@ -210,76 +210,3 @@ search = {{ detection.search }}
### END ESCU RESPONSE TASKS ###
### USAGE DASHBOARD CONFIGURATIONS ###
[escu-metrics-usage]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
dispatchAs = user
search = index=_audit sourcetype="audittrail" \
"ESCU - "\
| stats count(search) by search savedsearch_name user\
| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
| rex field=search "\"(?<savedsearch_name>.*)\""\
| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*
[escu-metrics-search]
action.email.useNSSubject = 1
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
enableSched = 1
cron_schedule = 0 0 * * *
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = index=_audit action=search | transaction search_id maxspan=3m | search ESCU | stats sum(total_run_time) avg(total_run_time) max(total_run_time) sum(result_count)
[escu-metrics-search-events]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 0 * * *
enableSched = 1
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = [search index=_audit sourcetype="audittrail" \"ESCU NOT "index=_audit" | where search !="" | dedup search_id | rex field=search "\"(?<search_name>.*)\"" | rex field=_raw "user=(?<user>[a-zA-Z0-9_\-]+)" | eval usage=if(savedsearch_name!="", "scheduled", "adhoc") | eval savedsearch_name=if(savedsearch_name != "", savedsearch_name, search_name) | table savedsearch_name search_id user _time usage | outputlookup escu_search_id.csv | table search_id] index=_audit total_run_time event_count result_count NOT "index=_audit" | lookup escu_search_id.csv search_id | stats count(savedsearch_name) AS search_count avg(total_run_time) AS search_avg_run_time sum(total_run_time) AS search_total_run_time sum(result_count) AS search_total_results earliest(_time) AS firsts latest(_time) AS lasts by savedsearch_name user usage| eval first_run=strftime(firsts, "%B %d %Y") | eval last_run=strftime(lasts, "%B %d %Y")
[escu-metrics-search-longest-runtime]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
enableSched = 1
cron_schedule = 0 0 * * *
disabled = 1
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
search = index=_* ESCU [search index=_* action=search latest=-2h earliest=-1d| transaction search_id maxspan=3m | search ESCU | stats values(total_run_time) AS run by search_id | sort -run | head 1| table search_id] | table search search_id
[escu-metrics-usage-search]
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 0 * * *
dispatch.earliest_time = -4h@h
dispatch.latest_time = -1h@h
enableSched = 1
dispatchAs = user
search = index=_audit sourcetype="audittrail" \
"ESCU - "\
| stats count(search) by search savedsearch_name user\
| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
| rex field=search "\"(?<savedsearch_name>.*)\""\
| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*
### END OF USAGE DASHBOARD CONFIGURATIONS ###
bin/validate.py
+3 -4
View File
@@ -73,7 +73,7 @@ def validate_objects(REPO_PATH, objects, verbose):
for lookup in objects['lookups']:
errors = errors + validate_lookups_content(REPO_PATH, "lookups/%s", lookup)
objects_array = objects['stories'] + objects['detections'] + objects['response_tasks'] + objects['responses']
objects_array = objects['stories'] + objects['detections']
for object in objects_array:
validation_errors, uuids = validate_standard_fields(object, uuids)
errors = errors + validation_errors
@@ -244,7 +244,7 @@ def validate_tests(REPO_PATH, object):
def main(REPO_PATH, verbose):
validation_objects = ['macros','lookups','stories','detections','response_tasks','responses','deployments', 'tests']
validation_objects = ['macros','lookups','stories','detections','deployments', 'tests']
objects = {}
schema_error = False
@@ -272,8 +272,7 @@ def main(REPO_PATH, verbose):
if __name__ == "__main__":
# grab arguments
parser = argparse.ArgumentParser(description="validates security content manifest files", epilog="""
Validates security manifest for correctness, adhering to spec and other common items.
VALIDATE DOES NOT PROCESS RESPONSES SPEC for the moment.""")
Validates security manifest for correctness, adhering to spec and other common items.""")
parser.add_argument("-p", "--path", required=True, help="path to security-security content repo")
parser.add_argument("-v", "--verbose", required=False, action='store_true', help="prints verbose output")
# parse them
detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
+1 -1
View File
@@ -27,7 +27,7 @@ references:
- https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/
tags:
analytic_story:
- meterpreter
- Meterpreter
automated_detection_testing: passed
confidence: 100
context:
detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
+2 -2
View File
@@ -35,8 +35,8 @@ tags:
automated_detection_testing: passed
confidence: 50
context:
- source:endpoint
- stage:Discovery
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log
impact: 50
dist/devsecops/default/analytic_stories.conf
Vendored
+2 -26
View File
@@ -1,27 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-09-13T10:57:27 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
### STORIES ###
[Dev Sec Ops]
category = Cloud Security
creation_date = 2021-08-18
modification_date = 2021-08-18
id = 0ca8c38e-631e-4b81-940c-f9c5450ce41e
version = 1
reference = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"]
detection_searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Circle CI Disable Security Job - Rule", "ESCU - Circle CI Disable Security Step - Rule", "ESCU - Correlation by Repository and Risk - Rule", "ESCU - Correlation by User and Risk - Rule", "ESCU - GitHub Dependabot Alert - Rule", "ESCU - GitHub Pull Request from Unknown User - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule"]
mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001", "T1204.003", "T1212", "T1526", "T1554"], "nist": ["DE.CM", "PR.AC", "PR.DS"]}
investigative_searches = []
support_searches = []
data_models = []
providing_technologies = none
description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud', 'Dev Sec Ops Analytics']
#### END STORIES ####
### Using one single file analyticstories.conf that will be used both by ES and ESCU
dist/devsecops/default/use_case_library.conf
Vendored
+2 -248
View File
@@ -1,249 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-09-13T10:57:27 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
### STORIES ###
[analytic_story://Dev Sec Ops]
category = Cloud Security
last_updated = 2021-08-18
version = 1
references = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}]
spec_version = 3
searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Circle CI Disable Security Job - Rule", "ESCU - Circle CI Disable Security Step - Rule", "ESCU - Correlation by Repository and Risk - Rule", "ESCU - Correlation by User and Risk - Rule", "ESCU - GitHub Dependabot Alert - Rule", "ESCU - GitHub Pull Request from Unknown User - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule"]
description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter.
### END STORIES ###
### DETECTIONS ###
[savedsearch://ESCU - AWS ECR Container Scanning Findings High - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - AWS ECR Container Scanning Findings Medium - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - AWS ECR Container Upload Outside Business Hours - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = When your development is spreaded in different time zones, applying this rule can be difficult.
providing_technologies = []
[savedsearch://ESCU - AWS ECR Container Upload Unknown User - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Circle CI Disable Security Job - Rule]
type = detection
asset_type = CircleCI
confidence = medium
explanation = This search looks for disable security job in CircleCI pipeline.
how_to_implement = You must index CircleCI logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1554"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Circle CI Disable Security Step - Rule]
type = detection
asset_type = CircleCI
confidence = medium
explanation = This search looks for disable security step in CircleCI pipeline.
how_to_implement = You must index CircleCI logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1554"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Correlation by Repository and Risk - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search correlations detections by repository and risk_score
how_to_implement = For Dev Sec Ops POC
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Correlation by User and Risk - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search correlations detections by user and risk_score
how_to_implement = For Dev Sec Ops POC
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - GSuite Email Suspicious Attachment - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
providing_technologies = []
[savedsearch://ESCU - GitHub Dependabot Alert - Rule]
type = detection
asset_type = GitHub
confidence = medium
explanation = This search looks for Dependabot Alerts in Github logs.
how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - GitHub Pull Request from Unknown User - Rule]
type = detection
asset_type = GitHub
confidence = medium
explanation = This search looks for Pull Request from unknown user.
how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Github Commit Changes In Master - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a pushed or commit to master or main branch. This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch
how_to_implement = To successfully implement this search, you need to be ingesting logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"]}
known_false_positives = admin can do changes directly to master branch
providing_technologies = []
[savedsearch://ESCU - Github Commit In Develop - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a pushed or commit to develop branch. This is to avoid unwanted modification to develop without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch
how_to_implement = To successfully implement this search, you need to be ingesting logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"]}
known_false_positives = admin can do changes directly to develop branch
providing_technologies = []
[savedsearch://ESCU - Gsuite Drive Share In External Email - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]}
known_false_positives = network admin or normal user may share files to customer and external team.
providing_technologies = []
[savedsearch://ESCU - Gsuite Email Suspicious Subject With Attachment - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search.
providing_technologies = []
[savedsearch://ESCU - Gsuite Email With Known Abuse Web Service Link - Rule]
type = detection
asset_type =
confidence = medium
explanation = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
known_false_positives = normal email contains this link that are known application within the organization or network can be catched by this detection.
providing_technologies = []
[savedsearch://ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"]}
known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
providing_technologies = []
[savedsearch://ESCU - Gsuite Suspicious Shared File Name - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search
providing_technologies = []
[savedsearch://ESCU - Kubernetes Nginx Ingress LFI - Rule]
type = detection
asset_type = Kubernetes
confidence = medium
explanation = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Kubernetes Nginx Ingress RFI - Rule]
type = detection
asset_type = Kubernetes
confidence = medium
explanation = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Kubernetes Scanner Image Pulling - Rule]
type = detection
asset_type = Kubernetes
confidence = medium
explanation = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
### END DETECTIONS ###
### RESPONSE TASKS ###
### END RESPONSE TASKS ###
### Using one single file analyticstories.conf that will be used both by ES and ESCU
dist/escu/default/analytic_stories.conf
Vendored
+2 -1969
View File
File diff suppressed because it is too large Load Diff
dist/escu/default/analyticstories.conf
Vendored
+655 -655
View File
File diff suppressed because it is too large Load Diff
dist/escu/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-09-27T18:20:04 UTC
# On Date: 2021-09-30T19:01:47 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/data/ui/nav/default.xml
Vendored
-1
View File
@@ -2,6 +2,5 @@
<view name="escu_summary" default="true"/>
<view name="feedback"/>
<view name="search"/>
<view name="escu_usage"/>
<a href="http://docs.splunk.com/Documentation/ESSOC">Docs</a>
</nav>
dist/escu/default/data/ui/views/analytic_story_details.xml
Vendored
-21
View File
@@ -1,21 +0,0 @@
<form script="analytic_story_details.js" hideFilters="false" version="1.1">
<label>Analytic Story Detail</label>
<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="analytic_story_name">
<label>Choose an Analytic Story from the drop-down menu to view more detail and run the searches.</label>
<search>
<query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | fields title | sort title</query>
</search>
<fieldForLabel>title</fieldForLabel>
<fieldForValue>title</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<html>
<div id="analytic_story_details">
</div>
</html>
</panel>
</row>
</form>
dist/escu/default/data/ui/views/escu_summary.xml
Vendored
+41 -90
View File
@@ -3,16 +3,11 @@
<!-- Example uses stats transforming command -->
<!-- This limits evnts passed to post-process search -->
<title>Splunk Security Content</title>
<row>
<html>
<h2 style="color:red">Explore the Analytic Stories included with Splunk Security via <a href="https://www.splunk.com/en_us/resources/videos/splunk-enterprise-security-use-case-library.html">ES Use Case Library</a> or <a href="https://splunkbase.splunk.com/app/3435/">Splunk Security Essentials</a>.</h2>
</html>
</row>
<search id="baseSS">
<query>| rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *"</query>
</search>
<search id="baseAS">
<query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0</query>
<query>| rest /services/configs/conf-analyticstories splunk_server=local count=0 |search eai:acl.app = "DA-ESS-ContentUpdate"</query>
</search>
<init>
<set token="form.as_category">*</set>
@@ -24,11 +19,11 @@
<!-- Rows for Analytic Story Table -->
<!-- Rows for Search Stats -->
<fieldset submitButton="false"></fieldset>
<row depends="$explore-use-case-es-show$">
<row>
<panel>
<html>
<div id="explore-use-case-es-info"/>
</html>
<h2 style="color:red">Explore the Analytic Stories included with Splunk Security via <a href="https://www.splunk.com/en_us/resources/videos/splunk-enterprise-security-use-case-library.html">ES Use Case Library</a> or <a href="https://splunkbase.splunk.com/app/3435/">Splunk Security Essentials</a>.</h2>
</html>
</panel>
</row>
<row id="analytic_stories_header_stats">
@@ -36,7 +31,7 @@
<single>
<title>Total Analytic Stories</title>
<search base="baseAS">
<query>stats count</query>
<query> search title="analytic_story://*" |stats count</query>
</search>
<!-- post-process search -->
<option name="colorBy">value</option>
@@ -58,7 +53,7 @@
<single>
<title>Total Detections</title>
<search base="baseSS">
<query>stats count by action.correlationsearch.label| eventstats sum(count) as total_detection_count| fields total_detection_count</query>
<query>stats count by action.correlationsearch.label| eventstats sum(count) as total_detection_count| fields total_detection_count</query>
</search>
<!-- post-process search -->
<option name="colorBy">value</option>
@@ -104,7 +99,7 @@
<title>Story Categories</title>
<chart>
<search>
<query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | stats count by category</query>
<query>| rest /services/configs/conf-analyticstories splunk_server=local count=0 | search eai:acl.app = "DA-ESS-ContentUpdate"| search title="analytic_story://*"| stats count by category</query>
</search>
<drilldown>
<set token="form.as_category">$click.value$</set>
@@ -123,9 +118,10 @@
<chart>
<search>
<query>
| rest /services/configs/conf-analytic_stories splunk_server=local count=0
| spath input=mappings path=mitre_attack{} output="MITRE Technique ID"
| stats dc(title) as "Analytic Stories" by "MITRE Technique ID"
| rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *"
| spath input=action.correlationsearch.annotations path=mitre_attack{} output="MITRE Technique ID"
| spath input=action.correlationsearch.annotations path=analytic_story{} output=story_name
| stats dc(story_name) as "Analytic Stories" by "MITRE Technique ID"
</query>
</search>
<drilldown>
@@ -138,92 +134,52 @@
</row>
<row id="analytic_stories_details_table">
<panel>
<input type="dropdown" token="as_story">
<input type="dropdown" token="story">
<label>Analytic Story</label>
<choice value="*">All</choice>
<search base="baseAS">
<search>
<latest>now</latest>
<query>| dedup title | rename title as story | fields story</query>
<query>| rest /services/configs/conf-savedsearches splunk_server=local count=0
| search action.escu.search_type = detection
| spath input=action.correlationsearch.annotations path=analytic_story{} output="story"
| mvexpand story
| dedup story | fields story</query>
</search>
<fieldForLabel>story</fieldForLabel>
<fieldForValue>story</fieldForValue>
<default>*</default>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
<input type="dropdown" token="detection">
<label>Detections</label>
<choice value="*">All</choice>
<search base="baseSS">
<latest>now</latest>
<query>rename action.correlationsearch.label as Detection | dedup Detection | fields Detection</query>
</search>
<fieldForLabel>Detection</fieldForLabel>
<fieldForValue>Detection</fieldForValue>
<prefix>"</prefix>
<suffix>"</suffix>
<default>*</default>
</input>
<input type="dropdown" token="as_category">
<label>Category</label>
<choice value="*">All</choice>
<search base="baseAS">
<latest>now</latest>
<query>| dedup category | fields category</query>
</search>
<fieldForLabel>category</fieldForLabel>
<fieldForValue>category</fieldForValue>
<default>*</default>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
<input type="dropdown" token="as_attack_id">
<label>MITRE Technique ID</label>
<choice value="*">All</choice>
<search base="baseAS">
<latest>now</latest>
<query>| spath input=mappings path=mitre_attack{} output="MITRE Technique ID" | mvexpand "MITRE Technique ID"| dedup "MITRE Technique ID" | fields "MITRE Technique ID"</query>
</search>
<fieldForLabel>MITRE Technique ID</fieldForLabel>
<fieldForValue>MITRE Technique ID</fieldForValue>
<prefix>"</prefix>
<suffix>"</suffix>
<default>*</default>
</input>
<input type="dropdown" token="as_data_models">
<label>Data Models</label>
<choice value="*">All</choice>
<search base="baseAS">
<latest>now</latest>
<query>| spath input=data_models path={} output=dm | mvexpand dm | dedup dm | fields dm</query>
</search>
<fieldForLabel>dm</fieldForLabel>
<fieldForValue>dm</fieldForValue>
<default>*</default>
<prefix>"</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<html>
<input id="analytic_filter_clear" class="btn btn-primary" type="button" value="Clear All"/>
</html>
<table>
<title>Analytic Story Details</title>
<search base="baseAS">
<query>
spath input=data_models path={} output="Data Models"
| spath input=mappings path=kill_chain_phases{} output="Kill Chain Phases"
| spath input=detection_searches path={} output="Detections"
| spath input=mappings path=mitre_attack{} output="MITRE Technique ID"
| rename title as "Analytic Story" description as "Description" category as "Category" modification_date as "Last Updated"
| fillnull value="-"
| search "Analytic Story"=$as_story$
| search "Data Models"=$as_data_models$
| search "Category"=$as_category$
| search "MITRE Technique ID"=$as_attack_id$
| search "Detections"=$detection$
| table "Analytic Story", Description, Category, "MITRE Technique ID", "Data Models", Detections, "Last Updated"
</query>
<search>
<query>| rest /services/configs/conf-savedsearches splunk_server=local count=0
| search action.escu.search_type = detection
| spath input=action.correlationsearch.annotations path=analytic_story{} output="analytic_story"
| spath input=action.correlationsearch.annotations path=mitre_attack{} output="mitre_attack"
| spath input=action.escu.data_models path={} output="Data Models"
| rename title as "Detections"
| join analytic_story
[| rest /services/configs/conf-analyticstories splunk_server=local count=0
| search title="analytic_story://*"
| eval "analytic_story"=replace(title,"analytic_story://","" )
]
| search analytic_story= $story$
|stats values(Detections) as Detections values(mitre_attack) as "MITRE Technique ID" values(last_updated) as "Last Updated" by analytic_story description| rename analytic_story as "Analytic Story"| rename description as Description| table "Analytic Story" Description Detections "MITRE Technique ID" "Last Updated"</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="count">5</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="wrap">true</option>
<drilldown>
<link target="_blank">
<![CDATA[
@@ -231,11 +187,6 @@
]]>
</link>
</drilldown>
<option name="drilldown">row</option>
<option name="wrap">true</option>
<option name="rowNumbers">true</option>
<option name="dataOverlayMode">none</option>
<option name="count">5</option>
</table>
</panel>
</row>
dist/escu/default/data/ui/views/escu_usage.xml
Vendored
-152
View File
@@ -1,152 +0,0 @@
<form version="1.1">
<label>Usage Details</label>
<search id="escu_usage" ref="escu-metrics-search-events">
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="field1" searchWhenChanged="true">
<label></label>
<default>
<earliest>-7d</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<search base="escu_usage">
<query>| stats sum(search_count)</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x091448","0xd93f3c"]</option>
<option name="rangeValues">[1000]</option>
<option name="underLabel">Searches Ran</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query>| stats dc(savedsearch_name)</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x091448","0xd93f3c"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Unique Searches</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query>| stats sum(search_count) by savedsearch_name | sort -sum(search_count) | head 1 | table savedsearch_name</query>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0x091448","0x091448"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Most Run</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
<row>
<panel>
<single>
<search base="escu_usage">
<query> | stats sum(search_count) AS sum_search_count by usage| search usage=adhoc | table sum_search_count</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x066661","0x091448"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Ad hoc searches</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query> | stats sum(search_count) AS sum_search_count by usage| search usage=scheduled | table sum_search_count</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x066661","0x066661"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Scheduled</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query>| stats sum(search_count) AS search_count by user | sort -search_count | head 1 | table user</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x066661","0x066661"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Most Active User</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query>| stats dc(user)</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x066661","0x066661"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Total Active Users</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
<row>
<panel>
<single>
<search base="escu_usage">
<query>| stats sum(search_total_run_time)</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x334907","0x334907"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Total Search Run Time (seconds)</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query> | stats avg(search_total_run_time)</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x334907","0x334907"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Average Run Time (seconds)</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query>|sort -search_total_run_time | head 1| table search_total_run_time</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x334907","0x334907"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Max Run Time (seconds)</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
<row>
<panel>
<table>
<search base="escu_usage">
<query>| table savedsearch_name search_count last_run first_run search_avg_run_time search_total_run_time search_total_results </query>
</search>
</table>
</panel>
</row>
</form>
dist/escu/default/macros.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-09-27T18:20:05 UTC
# On Date: 2021-09-30T19:01:48 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/savedsearches.conf
Vendored
+4 -4
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-09-27T18:20:04 UTC
# On Date: 2021-09-30T19:01:47 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -11675,7 +11675,7 @@ action.escu.full_search_name = ESCU - Excessive number of distinct processes cre
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["meterpreter"]
action.escu.analytic_story = ["Meterpreter"]
action.risk = 1
action.risk.param._risk_message = Multiple processes were executed out of windows\temp within a short amount of time on $dest$.
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}]
@@ -11685,7 +11685,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule
action.correlationsearch.annotations = {"analytic_story": ["meterpreter"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Meterpreter"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user', 'dest']
@@ -23106,7 +23106,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - SchCache Change By App Connect And Create ADSI Object - Rule
action.correlationsearch.annotations = {"analytic_story": ["blackMatter ransomware"], "confidence": 50, "context": ["source:endpoint", "stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["blackMatter ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = This analytic is to detect an application try to connect and create ADSI Object to do LDAP query. Every time an application connects to the directory and attempts to create an ADSI object, the Active Directory Schema is checked for changes. If it has changed since the last connection, the schema is downloaded and stored in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious application like blackmatter ransomware that use ADS object api to execute ldap query. having a good list of ldap or normal AD query tool used within the network is a good start to reduce the noise.
dist/escu/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-09-27T18:20:04 UTC
# On Date: 2021-09-30T19:01:47 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/use_case_library.conf
Vendored
+2 -8454
View File
File diff suppressed because it is too large Load Diff
dist/escu/lookups/mitre_enrichment.csv
Vendored
+564 -440
View File
File diff suppressed because it is too large Load Diff
dist/saaws/default/analytic_stories.conf
Vendored
+2 -240
View File
@@ -1,240 +1,2 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-09-27T18:20:24 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
### STORIES ###
[AWS IAM Privilege Escalation]
category = Cloud Security
creation_date = 2021-03-08
modification_date = 2021-03-08
id = ced74200-8465-4bc3-bd2c-22782eec6750
version = 1
reference = ["https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect", "https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws"]
detection_searches = ["ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS UpdateLoginProfile - Rule"]
mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "mitre_attack": ["T1069.003", "T1078.004", "T1098", "T1110", "T1136.003", "T1580"], "nist": ["DE.CM", "PR.AC", "PR.DS"]}
investigative_searches = []
support_searches = []
data_models = []
providing_technologies = none
description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.
narrative = Amazon Web Services provides a neat feature called Identity and Access Management (IAM) that enables organizations to manage various AWS services and resources in a secure way. All IAM users have roles, groups and policies associated with them which governs and sets permissions to allow a user to access specific restrictions.\
However, if these IAM policies are misconfigured and have specific combinations of weak permissions; it can allow attackers to escalate their privileges and further compromise the organization. Rhino Security Labs have published comprehensive blogs detailing various AWS Escalation methods. By using this as an inspiration, Splunk’s research team wants to highlight how these attack vectors look in AWS Cloudtrail logs and provide you with detection queries to uncover these potentially malicious events via this Analytic Story. \
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[AWS Network ACL Activity]
category = Cloud Security
creation_date = 2018-05-21
modification_date = 2018-05-21
id = 2e8948a5-5239-406b-b56b-6c50ff268af4
version = 2
reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect shared ec2 snapshot - Rule"]
mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.DP"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
support_searches = []
data_models = []
providing_technologies = none
description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[AWS Security Hub Alerts]
category = Cloud Security
creation_date = 2020-08-04
modification_date = 2020-08-04
id = 2f2f610a-d64d-48c2-b57c-96722b49ab5a
version = 1
reference = ["https://aws.amazon.com/security-hub/features/"]
detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect shared ec2 snapshot - Rule"]
mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
support_searches = []
data_models = []
providing_technologies = none
description = This story is focused around detecting Security Hub alerts generated from AWS
narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Cloud Cryptomining]
category = Cloud Security
creation_date = 2019-10-02
modification_date = 2019-10-02
id = 3b96d13c-fdc7-45dd-b3ad-c132b31cdd2a
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Detect shared ec2 snapshot - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Regions - Update"]
data_models = ["Change"]
providing_technologies = none
description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \
When malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \
This Analytic Story is focused on detecting suspicious new instances in your cloud environment to help prevent cryptominers from gaining a foothold. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Cloud Federated Credential Abuse]
category = Cloud Security
creation_date = 2021-01-26
modification_date = 2021-01-26
id = cecdc1e7-0af2-4a55-8967-b9ea62c0317d
version = 1
reference = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"]
detection_searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule"]
mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1078", "T1136.003", "T1556"]}
investigative_searches = []
support_searches = []
data_models = []
providing_technologies = none
description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.
narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Office 365 Detections]
category = Cloud Security
creation_date = 2020-12-16
modification_date = 2020-12-16
id = 1a51dd71-effc-48b2-abc4-3e9cdb61e5b9
version = 1
reference = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"]
detection_searches = ["ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"]
mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Not Applicable"], "mitre_attack": ["T1110", "T1114", "T1114.002", "T1114.003", "T1136.003", "T1556", "T1562.007"], "nist": ["DE.AE", "DE.DP"]}
investigative_searches = []
support_searches = []
data_models = []
providing_technologies = none
description = This story is focused around detecting Office 365 Attacks.
narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Ransomware Cloud]
category = Malware
creation_date = 2020-10-27
modification_date = 2020-10-27
id = f52f6c43-05f8-4b19-a9d3-5b8c56da91c2
version = 1
reference = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"]
detection_searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule"]
mappings = {"mitre_attack": ["T1486"]}
investigative_searches = []
support_searches = []
data_models = []
providing_technologies = none
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features.
narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Suspicious AWS Login Activities]
category = Cloud Security
creation_date = 2019-05-01
modification_date = 2019-05-01
id = 2e8948a5-5239-406b-b56b-6c59f1268af3
version = 1
reference = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"]
mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"]
support_searches = []
data_models = ["Authentication"]
providing_technologies = none
description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.
narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Suspicious AWS S3 Activities]
category = Cloud Security
creation_date = 2018-07-24
modification_date = 2018-07-24
id = 2e8948a5-5239-406b-b56b-6c50w3168af3
version = 2
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect shared ec2 snapshot - Rule"]
mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "PR.AC", "PR.DS"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
support_searches = []
data_models = []
providing_technologies = none
description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Suspicious Cloud Authentication Activities]
category = Cloud Security
creation_date = 2020-06-04
modification_date = 2020-06-04
id = 6380ebbb-55c5-4fce-b754-01fd565fb73c
version = 1
reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect shared ec2 snapshot - Rule"]
mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP", "PR.AC", "PR.DS"]}
investigative_searches = ["ESCU - Investigate AWS User Activities by user field - Response Task"]
support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen Users in CloudTrail - Initial"]
data_models = ["Authentication"]
providing_technologies = none
description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity.
narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\
This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Suspicious Cloud Instance Activities]
category = Cloud Security
creation_date = 2020-08-25
modification_date = 2020-08-25
id = 8168ca88-392e-42f4-85a2-767579c660ce
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"]
data_models = ["Change"]
providing_technologies = none
description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Suspicious Cloud Provisioning Activities]
category = Cloud Security
creation_date = 2018-08-20
modification_date = 2018-08-20
id = 51045ded-1575-4ba6-aef7-af6c73cffd86
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"]
mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
investigative_searches = []
support_searches = ["ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial", "ESCU - Previously Seen Cloud Provisioning Activity Sources - Update"]
data_models = ["Change"]
providing_technologies = none
description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\
This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Suspicious Cloud User Activities]
category = Cloud Security
creation_date = 2020-09-04
modification_date = 2020-09-04
id = 1ed5ce7d-5469-4232-92af-89d1a3595b39
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "mitre_attack": ["T1078", "T1078.004", "T1580"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"]
support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Previously Seen Cloud API Calls Per User Role - Update"]
data_models = ["Change"]
providing_technologies = none
description = Detect and investigate suspicious activities by users and roles in your cloud environments.
narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\
In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
#### END STORIES ####
### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
### Using one single file analyticstories.conf that will be used both by ES and ESCU
dist/saaws/default/use_case_library.conf
Vendored
+2 -804
View File
@@ -1,804 +1,2 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-09-27T18:20:24 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
### STORIES ###
[analytic_story://AWS IAM Privilege Escalation]
category = Cloud Security
last_updated = 2021-03-08
version = 1
references = ["https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect", "https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
spec_version = 3
searches = ["ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS UpdateLoginProfile - Rule"]
description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.
narrative = Amazon Web Services provides a neat feature called Identity and Access Management (IAM) that enables organizations to manage various AWS services and resources in a secure way. All IAM users have roles, groups and policies associated with them which governs and sets permissions to allow a user to access specific restrictions.\
However, if these IAM policies are misconfigured and have specific combinations of weak permissions; it can allow attackers to escalate their privileges and further compromise the organization. Rhino Security Labs have published comprehensive blogs detailing various AWS Escalation methods. By using this as an inspiration, Splunk’s research team wants to highlight how these attack vectors look in AWS Cloudtrail logs and provide you with detection queries to uncover these potentially malicious events via this Analytic Story. \
[analytic_story://AWS Network ACL Activity]
category = Cloud Security
last_updated = 2018-05-21
version = 2
references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
spec_version = 3
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.
[analytic_story://AWS Security Hub Alerts]
category = Cloud Security
last_updated = 2020-08-04
version = 1
references = ["https://aws.amazon.com/security-hub/features/"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
spec_version = 3
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
description = This story is focused around detecting Security Hub alerts generated from AWS
narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.
[analytic_story://Cloud Cryptomining]
category = Cloud Security
last_updated = 2019-10-02
version = 1
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
spec_version = 3
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \
When malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \
This Analytic Story is focused on detecting suspicious new instances in your cloud environment to help prevent cryptominers from gaining a foothold. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches.
[analytic_story://Cloud Federated Credential Abuse]
category = Cloud Security
last_updated = 2021-01-26
version = 1
references = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}]
spec_version = 3
searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule"]
description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.
narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches.
[analytic_story://Office 365 Detections]
category = Cloud Security
last_updated = 2020-12-16
version = 1
references = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}]
spec_version = 3
searches = ["ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"]
description = This story is focused around detecting Office 365 Attacks.
narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks.
[analytic_story://Ransomware Cloud]
category = Malware
last_updated = 2020-10-27
version = 1
references = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"]
maintainers = [{"company": "David Dorsey, Splunk", "email": "-", "name": "Rod Soto"}]
spec_version = 3
searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule"]
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features.
narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources.
[analytic_story://Suspicious AWS Login Activities]
category = Cloud Security
last_updated = 2019-05-01
version = 1
references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
spec_version = 3
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.
narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker.
[analytic_story://Suspicious AWS S3 Activities]
category = Cloud Security
last_updated = 2018-07-24
version = 2
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
spec_version = 3
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants.
[analytic_story://Suspicious Cloud Authentication Activities]
category = Cloud Security
last_updated = 2020-06-04
version = 1
references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
spec_version = 3
searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"]
description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity.
narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\
This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS.
[analytic_story://Suspicious Cloud Instance Activities]
category = Cloud Security
last_updated = 2020-08-25
version = 1
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
spec_version = 3
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.
[analytic_story://Suspicious Cloud Provisioning Activities]
category = Cloud Security
last_updated = 2018-08-20
version = 1
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
spec_version = 3
searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"]
description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\
This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.
[analytic_story://Suspicious Cloud User Activities]
category = Cloud Security
last_updated = 2020-09-04
version = 1
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
spec_version = 3
searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
description = Detect and investigate suspicious activities by users and roles in your cloud environments.
narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\
In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage.
### END STORIES ###
### DETECTIONS ###
[savedsearch://ESCU - AWS Create Policy Version to allow all resources - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
providing_technologies = []
[savedsearch://ESCU - AWS CreateAccessKey - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
providing_technologies = []
[savedsearch://ESCU - AWS CreateLoginProfile - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user.
providing_technologies = []
[savedsearch://ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for AssumeRole events where an IAM role in a different account is requested for the first time.
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen AWS Cross Account Activity - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen AWS Cross Account Activity - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.AC", "PR.DS", "DE.AE"]}
known_false_positives = Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request.
providing_technologies = []
[savedsearch://ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search provides detection of KMS keys where action kms:Encrypt is accessible for everyone (also outside of your organization). This is an indicator that your account is compromised and the attacker uses the encryption key to compromise another company.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
annotations = {"mitre_attack": ["T1486"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule]
type = detection
asset_type = S3 Bucket
confidence = medium
explanation = This search provides detection of users with KMS keys performing encryption specifically against S3 buckets.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
annotations = {"mitre_attack": ["T1486"]}
known_false_positives = bucket with S3 encryption
providing_technologies = []
[savedsearch://ESCU - AWS Excessive Security Scanning - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = While this search has no known false positives.
providing_technologies = []
[savedsearch://ESCU - AWS IAM AccessDenied Discovery Events - Rule]
type = detection
asset_type =
confidence = medium
explanation = The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery events. In these instances, the access is not available with the key stolen therefore these events will be generated.
how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580"]}
known_false_positives = It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives.
providing_technologies = []
[savedsearch://ESCU - AWS IAM Assume Role Policy Brute Force - Rule]
type = detection
asset_type =
confidence = medium
explanation = The following detection identifies any malformed policy document exceptions with a status of `failure`. A malformed policy document exception occurs in instances where roles are attempted to be assumed, or brute forced. In a brute force attempt, using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur. This detection focuses on the errors of a remote attempt that is failing.
how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. Set the `where count` greater than a value to identify suspicious activity in your environment.
annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580", "T1110"]}
known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users.
providing_technologies = []
[savedsearch://ESCU - AWS IAM Delete Policy - Rule]
type = detection
asset_type =
confidence = medium
explanation = The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"]}
known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.
providing_technologies = []
[savedsearch://ESCU - AWS IAM Failure Group Deletion - Rule]
type = detection
asset_type =
confidence = medium
explanation = This detection identifies failure attempts to delete groups. We want to identify when a group is attempting to be deleted, but either access is denied, there is a conflict or there is no group. This is indicative of administrators performing an action, but also could be suspicious behavior occurring. Review parallel IAM events - recently added users, new groups and so forth.
how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"]}
known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
providing_technologies = []
[savedsearch://ESCU - AWS IAM Successful Group Deletion - Rule]
type = detection
asset_type =
confidence = medium
explanation = The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner.
how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1069.003", "T1098"]}
known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
providing_technologies = []
[savedsearch://ESCU - AWS Network Access Control List Created with All Open Ports - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR.
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs.
annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
providing_technologies = []
[savedsearch://ESCU - AWS Network Access Control List Deleted - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs.
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs.
annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = It's possible that a user has legitimately deleted a network ACL.
providing_technologies = []
[savedsearch://ESCU - AWS SAML Access by Provider User and Principal - Rule]
type = detection
asset_type = AWS Federated Account
confidence = medium
explanation = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
annotations = {"mitre_attack": ["T1078"]}
known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks.
providing_technologies = []
[savedsearch://ESCU - AWS SAML Update identity provider - Rule]
type = detection
asset_type = AWS Federated Account
confidence = medium
explanation = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"mitre_attack": ["T1078"]}
known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored.
providing_technologies = []
[savedsearch://ESCU - AWS SetDefaultPolicyVersion - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
providing_technologies = []
[savedsearch://ESCU - AWS UpdateLoginProfile - Rule]
type = detection
asset_type = AWS Account
confidence = medium
explanation = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B)
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
providing_technologies = []
[savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
known_false_positives =
providing_technologies = []
[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
type = detection
asset_type = Cloud Instance
confidence = medium
explanation = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
providing_technologies = []
[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
type = detection
asset_type = Cloud Instance
confidence = medium
explanation = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
providing_technologies = []
[savedsearch://ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
known_false_positives =
providing_technologies = []
[savedsearch://ESCU - Cloud API Calls From Previously Unseen User Roles - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for new commands from each user role.
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud API Calls Per User Role - Initial` to build the initial table of user roles, commands, and times. You must also enable the second baseline search `Previously Seen Cloud API Calls Per User Role - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_api_calls_from_previously_unseen_user_roles_filter`
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
known_false_positives = .
providing_technologies = []
[savedsearch://ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule]
type = detection
asset_type = Cloud Compute Instance
confidence = medium
explanation = This search looks for cloud compute instances created by users who have not created them before.
how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users.
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
known_false_positives = It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
providing_technologies = []
[savedsearch://ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule]
type = detection
asset_type = Cloud Compute Instance
confidence = medium
explanation = This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created.
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Regions - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` macro.
annotations = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
providing_technologies = []
[savedsearch://ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule]
type = detection
asset_type = Cloud Compute Instance
confidence = medium
explanation = This search looks for cloud compute instances being created with previously unseen image IDs.
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Images - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Images - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter` macro.
annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
known_false_positives = After a new image is created, the first systems created with that image will cause this alert to fire. Verify that the image being used was created by a legitimate user.
providing_technologies = []
[savedsearch://ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule]
type = detection
asset_type = Cloud Compute Instance
confidence = medium
explanation = Find EC2 instances being created with previously unseen instance types.
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Instance Types - Initial` to build the initial table of instance types observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Instance Types - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` macro.
annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
known_false_positives = It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type.
providing_technologies = []
[savedsearch://ESCU - Cloud Instance Modified By Previously Unseen User - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for cloud instances being modified by users who have not previously modified them.
how_to_implement = This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search "Previously Seen Cloud Instance Modifications By User - Update" should be enabled for this detection to properly work.
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
providing_technologies = []
[savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something.
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_city_filter` macro.
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
providing_technologies = []
[savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something.
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` macro.
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
providing_technologies = []
[savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something.
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` macro.
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
providing_technologies = []
[savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something.
how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_region_filter` macro.
annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
providing_technologies = []
[savedsearch://ESCU - Detect AWS Console Login by New User - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
providing_technologies = []
[savedsearch://ESCU - Detect AWS Console Login by User from New City - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
providing_technologies = []
[savedsearch://ESCU - Detect AWS Console Login by User from New Country - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
providing_technologies = []
[savedsearch://ESCU - Detect AWS Console Login by User from New Region - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour
how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
providing_technologies = []
[savedsearch://ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
type = detection
asset_type = S3 Bucket
confidence = medium
explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
how_to_implement =
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
providing_technologies = []
[savedsearch://ESCU - Detect New Open S3 buckets - Rule]
type = detection
asset_type = S3 Bucket
confidence = medium
explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket.
how_to_implement = You must install the AWS App for Splunk.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
providing_technologies = []
[savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
known_false_positives = None
providing_technologies = []
[savedsearch://ESCU - Detect shared ec2 snapshot - Rule]
type = detection
asset_type = EC2 Snapshot
confidence = medium
explanation = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose.
providing_technologies = []
[savedsearch://ESCU - O365 Add App Role Assignment Grant User - Rule]
type = detection
asset_type = Office 365
confidence = medium
explanation = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]}
known_false_positives = The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
providing_technologies = []
[savedsearch://ESCU - O365 Added Service Principal - Rule]
type = detection
asset_type = Office 365
confidence = medium
explanation = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation.
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]}
known_false_positives = The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
providing_technologies = []
[savedsearch://ESCU - O365 Bypass MFA via Trusted IP - Rule]
type = detection
asset_type = Office 365
confidence = medium
explanation = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system.
how_to_implement = You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007"]}
known_false_positives = Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.
providing_technologies = []
[savedsearch://ESCU - O365 Disable MFA - Rule]
type = detection
asset_type = Office 365
confidence = medium
explanation = This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]}
known_false_positives = Unless it is a special case, it is uncommon to disable MFA or Strong Authentication
providing_technologies = []
[savedsearch://ESCU - O365 Excessive Authentication Failures Alert - Rule]
type = detection
asset_type = Office 365
confidence = medium
explanation = This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
annotations = {"kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110"]}
known_false_positives = The threshold for alert is above 10 attempts and this should reduce the number of false positives.
providing_technologies = []
[savedsearch://ESCU - O365 Excessive SSO logon errors - Rule]
type = detection
asset_type = Office 365
confidence = medium
explanation = This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse.
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]}
known_false_positives = Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack.
providing_technologies = []
[savedsearch://ESCU - O365 New Federated Domain Added - Rule]
type = detection
asset_type = Office 365
confidence = medium
explanation = This search detects the addition of a new Federated domain.
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity.
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]}
known_false_positives = The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.
providing_technologies = []
[savedsearch://ESCU - O365 PST export alert - Rule]
type = detection
asset_type = Office 365
confidence = medium
explanation = This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1114"]}
known_false_positives = PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.
providing_technologies = []
[savedsearch://ESCU - O365 Suspicious Admin Email Forwarding - Rule]
type = detection
asset_type = Office 365
confidence = medium
explanation = This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination.
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - O365 Suspicious Rights Delegation - Rule]
type = detection
asset_type = Office 365
confidence = medium
explanation = This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account.
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = Service Accounts
providing_technologies = []
[savedsearch://ESCU - O365 Suspicious User Email Forwarding - Rule]
type = detection
asset_type = Office 365
confidence = medium
explanation = This search detects when multiple user configured a forwarding rule to the same destination.
how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = unknown
providing_technologies = []
### END DETECTIONS ###
### RESPONSE TASKS ###
[savedsearch://ESCU - AWS Investigate Security Hub alerts by dest - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - AWS Investigate User Activities By ARN - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - AWS Investigate User Activities By AccessKeyId - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - AWS Network ACL Details from ID - Response Task]
type = investigation
explanation = none
how_to_implement = In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - AWS Network Interface details via resourceId - Response Task]
type = investigation
explanation = none
how_to_implement = In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS configuration inputs
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - AWS S3 Bucket details via bucketName - Response Task]
type = investigation
explanation = none
how_to_implement = To implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later) and configure your AWS inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Amazon EKS Kubernetes activity by src ip - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch EKS inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Get All AWS Activity From City - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Get All AWS Activity From Country - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Get All AWS Activity From IP Address - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Get All AWS Activity From Region - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Get EC2 Instance Details by instanceId - Response Task]
type = investigation
explanation = none
how_to_implement = In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Get EC2 Launch Details - Response Task]
type = investigation
explanation = none
how_to_implement = In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Investigate AWS User Activities by user field - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Investigate AWS activities via region name - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
### END RESPONSE TASKS ###
### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
### Using one single file analyticstories.conf that will be used both by ES and ESCU
docs/_pages/ooo.md
+8
View File
@@ -0,0 +1,8 @@
---
permalink: /ooo/
title: "OOO"
author_profile: false
layout: single
---
![ooo](https://media.giphy.com/media/lPuW5AlR9AeWzSsIqi/giphy.gif)
docs/_pages/tag-archive.md
+1 -1
View File
@@ -2,5 +2,5 @@
title: "Posts by Tag"
permalink: /tags/
layout: tags
author_profile: true
author_profile: false
---
docs/mitre-map/priority.png
BIN
View File
Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 802 KiB

docs/spec/baselines.md
-308
View File
@@ -1,308 +0,0 @@
# Baseline Schema Schema
```txt
http://example.com/example.json
```
schema for baselines
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
| :------------------ | :--------- | :------------- | :----------- | :---------------- | :-------------------- | :------------------ | :--------------------------------------------------------------------------- |
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | [baselines.spec.json](../../spec/baselines.spec.json "open original schema") |
## Baseline Schema Type
`object` ([Baseline Schema](baselines.md))
# Baseline Schema Properties
| Property | Type | Required | Nullable | Defined by |
| :------------------------------------ | :-------- | :------- | :------------- | :----------------------------------------------------------------------------------------------------------------------- |
| [author](#author) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-author.md "#/properties/author#/properties/author") |
| [date](#date) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-date.md "#/properties/date#/properties/date") |
| [description](#description) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-description.md "#/properties/description#/properties/description") |
| [how_to_implement](#how_to_implement) | `string` | Optional | cannot be null | [Baseline Schema](baselines-properties-how_to_implement.md "#/properties/how_to_implement#/properties/how_to_implement") |
| [id](#id) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-id.md "#/properties/id#/properties/id") |
| [name](#name) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-name-of-baseline.md "#/properties/name#/properties/name") |
| [search](#search) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-search.md "#/properties/search#/properties/search") |
| [tags](#tags) | `object` | Required | cannot be null | [Baseline Schema](baselines-properties-tags.md "#/properties/tags#/properties/tags") |
| [datamodel](#datamodel) | `array` | Optional | cannot be null | [Baseline Schema](baselines-properties-datamodel.md "#/properties/datamodel#/properties/datamodel") |
| [version](#version) | `integer` | Required | cannot be null | [Baseline Schema](baselines-properties-version.md "#/properties/version#/properties/version") |
| Additional Properties | Any | Optional | can be null | |
## author
Author of the baseline
`author`
* is required
* Type: `string`
* cannot be null
* defined in: [Baseline Schema](baselines-properties-author.md "#/properties/author#/properties/author")
### author Type
`string`
### author Examples
```yaml
Bahvin Patel, Splunk
```
## date
date of creation or modification, format yyyy-mm-dd
`date`
* is required
* Type: `string`
* cannot be null
* defined in: [Baseline Schema](baselines-properties-date.md "#/properties/date#/properties/date")
### date Type
`string`
### date Examples
```yaml
'2019-12-06'
```
## description
A detailed description of the baseline
`description`
* is required
* Type: `string`
* cannot be null
* defined in: [Baseline Schema](baselines-properties-description.md "#/properties/description#/properties/description")
### description Type
`string`
### description Examples
```yaml
>-
This search looks for CloudTrail events where an AWS instance is started and
creates a baseline of most recent time (latest) and the first time (earliest)
we've seen this region in our dataset grouped by the value awsRegion for the
last 30 days
```
## how_to_implement
information about how to implement. Only needed for non standard implementations.
`how_to_implement`
* is optional
* Type: `string`
* cannot be null
* defined in: [Baseline Schema](baselines-properties-how_to_implement.md "#/properties/how_to_implement#/properties/how_to_implement")
### how_to_implement Type
`string`
### how_to_implement Examples
```yaml
>-
This search requires Sysmon Logs and a Sysmon configuration, which includes
EventCode 10 for lsass.exe.
```
## id
UUID as unique identifier
`id`
* is required
* Type: `string`
* cannot be null
* defined in: [Baseline Schema](baselines-properties-id.md "#/properties/id#/properties/id")
### id Type
`string`
### id Examples
```yaml
fc0edc95-ff2b-48b0-9f6f-63da3789fd63
```
## name
`name`
* is required
* Type: `string` ([Name of baseline](baselines-properties-name-of-baseline.md))
* cannot be null
* defined in: [Baseline Schema](baselines-properties-name-of-baseline.md "#/properties/name#/properties/name")
### name Type
`string` ([Name of baseline](baselines-properties-name-of-baseline.md))
### name Examples
```yaml
Previously Seen AWS Regions
```
## search
The Splunk search for the baseline
`search`
* is required
* Type: `string`
* cannot be null
* defined in: [Baseline Schema](baselines-properties-search.md "#/properties/search#/properties/search")
### search Type
`string`
### search Examples
```yaml
>-
cloudtrail StartInstances | stats earliest(_time) as earliest latest(_time) as
latest by awsRegion | outputlookup previously_seen_aws_regions.csv
```
## tags
An array of key value pairs for tagging
`tags`
* is required
* Type: `object` ([Details](baselines-properties-tags.md))
* cannot be null
* defined in: [Baseline Schema](baselines-properties-tags.md "#/properties/tags#/properties/tags")
### tags Type
`object` ([Details](baselines-properties-tags.md))
### tags Constraints
**minimum number of items**: the minimum number of items for this array is: `1`
**unique items**: all items in this array must be unique. Duplicates are not allowed.
### tags Default Value
The default value is:
```json
{}
```
### tags Examples
```yaml
analytic_story: suspicious_aws_ec2_activities
custom_key: custom_value
```
## datamodel
datamodel used in the search
`datamodel`
* is optional
* Type: `string[]`
* cannot be null
* defined in: [Baseline Schema](baselines-properties-datamodel.md "#/properties/datamodel#/properties/datamodel")
### datamodel Type
`string[]`
### datamodel Examples
```yaml
Endpoint
```
## version
version of baseline, e.g. 1 or 2 ...
`version`
* is required
* Type: `integer`
* cannot be null
* defined in: [Baseline Schema](baselines-properties-version.md "#/properties/version#/properties/version")
### version Type
`integer`
### version Examples
```yaml
1
```
## Additional Properties
Additional properties are allowed and do not have to follow a specific schema
docs/spec/response_tasks.md
-395
View File
@@ -1,395 +0,0 @@
# Response Schema Schema
```txt
https://raw.githubusercontent.com/splunk/security_content/develop/docs/spec/response_tasks.spec.json
```
schema for response task
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
| :------------------ | :--------- | :------------- | :----------- | :---------------- | :-------------------- | :------------------ | :------------------------------------------------------------------------------------- |
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | [response_tasks.spec.json](../../spec/response_tasks.spec.json "open original schema") |
## Response Schema Type
`object` ([Response Schema](response_tasks.md))
## Response Schema Default Value
The default value is:
```json
{}
```
# Response Schema Properties
| Property | Type | Required | Nullable | Defined by |
| :-------------------------- | :-------- | :------- | :------------- | :------------------------------------------------------------------------------------------------------------- |
| [author](#author) | `string` | Required | cannot be null | [Response Schema](response_tasks-properties-author.md "#/properties/author#/properties/author") |
| [date](#date) | `string` | Required | cannot be null | [Response Schema](response_tasks-properties-date.md "#/properties/date#/properties/date") |
| [description](#description) | `string` | Required | cannot be null | [Response Schema](response_tasks-properties-description.md "#/properties/description#/properties/description") |
| [id](#id) | `string` | Required | cannot be null | [Response Schema](response_tasks-properties-id.md "#/properties/id#/properties/id") |
| [name](#name) | `string` | Required | cannot be null | [Response Schema](response_tasks-properties-name.md "#/properties/name#/properties/name") |
| [sla](#sla) | `integer` | Optional | cannot be null | [Response Schema](response_tasks-properties-sla.md "#/properties/sla#/properties/sla") |
| [sla_type](#sla_type) | `string` | Optional | cannot be null | [Response Schema](response_tasks-properties-sla_type.md "#/properties/sla_type#/properties/sla_type") |
| [automation](#automation) | `object` | Optional | cannot be null | [Response Schema](response_tasks-properties-automation.md "#/properties/automation#/properties/automation") |
| [tags](#tags) | `object` | Required | cannot be null | [Response Schema](response_tasks-properties-tags.md "#/properties/tags#/properties/tags") |
| [version](#version) | `integer` | Required | cannot be null | [Response Schema](response_tasks-properties-version.md "#/properties/version#/properties/version") |
| [references](#references) | `array` | Optional | cannot be null | [Response Schema](response_tasks-properties-references.md "#/properties/references#/properties/references") |
| Additional Properties | Any | Optional | can be null | |
## author
Author of the response task
`author`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](response_tasks-properties-author.md "#/properties/author#/properties/author")
### author Type
`string`
### author Examples
```yaml
ButterCup, Splunk
```
## date
date of creation or modification, format yyyy-mm-dd
`date`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](response_tasks-properties-date.md "#/properties/date#/properties/date")
### date Type
`string`
### date Examples
```yaml
'2019-12-06'
```
## description
Description of response task
`description`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](response_tasks-properties-description.md "#/properties/description#/properties/description")
### description Type
`string`
### description Examples
```yaml
Response example.
```
## id
UUID as unique identifier
`id`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](response_tasks-properties-id.md "#/properties/id#/properties/id")
### id Type
`string`
### id Examples
```yaml
fb4c31b0-13e8-4155-8aa5-24de4b8d6717
```
## name
Name of response task
`name`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](response_tasks-properties-name.md "#/properties/name#/properties/name")
### name Type
`string`
### name Examples
```yaml
Response Example
```
## sla
Measured integer for Service Level Agreement for completion of the phase
`sla`
* is optional
* Type: `integer`
* cannot be null
* defined in: [Response Schema](response_tasks-properties-sla.md "#/properties/sla#/properties/sla")
### sla Type
`integer`
### sla Examples
```yaml
5
```
```yaml
30
```
## sla_type
Duration for measured integer for Service Level Agreement for completion of the phase (e.g. minutes, or hours, etc)
`sla_type`
* is optional
* Type: `string`
* cannot be null
* defined in: [Response Schema](response_tasks-properties-sla_type.md "#/properties/sla_type#/properties/sla_type")
### sla_type Type
`string`
### sla_type Default Value
The default value is:
```json
"minutes"
```
### sla_type Examples
```yaml
minutes
```
```yaml
hours
```
```yaml
days
```
## automation
An array of key value pairs for defining actions and playbooks
`automation`
* is optional
* Type: `object` ([Details](response_tasks-properties-automation.md))
* cannot be null
* defined in: [Response Schema](response_tasks-properties-automation.md "#/properties/automation#/properties/automation")
### automation Type
`object` ([Details](response_tasks-properties-automation.md))
### automation Constraints
**minimum number of items**: the minimum number of items for this array is: `1`
**unique items**: all items in this array must be unique. Duplicates are not allowed.
### automation Default Value
The default value is:
```json
{
"is_note_required": false,
"sla_type": "minutes",
"sla": "",
"role": "",
"action": [],
"playbooks": []
}
```
### automation Examples
```yaml
is_note_required: false
sla_type: minutes
sla: 30
action:
- run_query
playbooks:
- scm: local
playbook: automate something
- scm: local
playbook: automate something else
```
## tags
An array of key value pairs for tagging
`tags`
* is required
* Type: `object` ([Details](response_tasks-properties-tags.md))
* cannot be null
* defined in: [Response Schema](response_tasks-properties-tags.md "#/properties/tags#/properties/tags")
### tags Type
`object` ([Details](response_tasks-properties-tags.md))
### tags Constraints
**minimum number of items**: the minimum number of items for this array is: `1`
**unique items**: all items in this array must be unique. Duplicates are not allowed.
### tags Default Value
The default value is:
```json
{}
```
### tags Examples
```yaml
analytic_story: credential_dumping
```
## version
version of detection, e.g. 1 or 2 ...
`version`
* is required
* Type: `integer`
* cannot be null
* defined in: [Response Schema](response_tasks-properties-version.md "#/properties/version#/properties/version")
### version Type
`integer`
### version Examples
```yaml
1
```
## references
A list of references for this response, phase or task (e.g. web or printed citation)
`references`
* is optional
* Type: `string[]` ([Blue Team Handbook by Don Murdoch - Amazon](response_tasks-properties-references-blue-team-handbook-by-don-murdoch---amazon.md))
* cannot be null
* defined in: [Response Schema](response_tasks-properties-references.md "#/properties/references#/properties/references")
### references Type
`string[]` ([Blue Team Handbook by Don Murdoch - Amazon](response_tasks-properties-references-blue-team-handbook-by-don-murdoch---amazon.md))
### references Default Value
The default value is:
```json
[]
```
### references Examples
```yaml
- Blue Team Handbook by Don Murdoch - Alarm Triage Overview pages 146-148
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
```
## Additional Properties
Additional properties are allowed and do not have to follow a specific schema
docs/spec/responses.md
-340
View File
@@ -1,340 +0,0 @@
# Response Schema Schema
```txt
https://raw.githubusercontent.com/splunk/security_content/develop/docs/spec/response.spec.json
```
schema for response
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
| :------------------ | :--------- | :------------- | :----------- | :---------------- | :-------------------- | :------------------ | :--------------------------------------------------------------------------- |
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | [responses.spec.json](../../spec/responses.spec.json "open original schema") |
## Response Schema Type
`object` ([Response Schema](responses.md))
## Response Schema Default Value
The default value is:
```json
{}
```
# Response Schema Properties
| Property | Type | Required | Nullable | Defined by |
| :------------------------------------ | :-------- | :------- | :------------- | :----------------------------------------------------------------------------------------------------------------------- |
| [author](#author) | `string` | Required | cannot be null | [Response Schema](responses-properties-author.md "#/properties/author#/properties/author") |
| [date](#date) | `string` | Required | cannot be null | [Response Schema](responses-properties-date.md "#/properties/date#/properties/date") |
| [description](#description) | `string` | Required | cannot be null | [Response Schema](responses-properties-description.md "#/properties/description#/properties/description") |
| [id](#id) | `string` | Required | cannot be null | [Response Schema](responses-properties-id.md "#/properties/id#/properties/id") |
| [name](#name) | `string` | Required | cannot be null | [Response Schema](responses-properties-name.md "#/properties/name#/properties/name") |
| [response_phase](#response_phase) | `array` | Required | cannot be null | [Response Schema](responses-properties-response_phase.md "#/properties/response_phases#/properties/response_phase") |
| [tags](#tags) | `object` | Required | cannot be null | [Response Schema](responses-properties-tags.md "#/properties/tags#/properties/tags") |
| [version](#version) | `integer` | Required | cannot be null | [Response Schema](responses-properties-version.md "#/properties/version#/properties/version") |
| [is_note_required](#is_note_required) | `boolean` | Optional | cannot be null | [Response Schema](responses-properties-is_note_required.md "#/properties/is_note_required#/properties/is_note_required") |
| [references](#references) | `array` | Optional | cannot be null | [Response Schema](responses-properties-references.md "#/properties/references#/properties/references") |
| Additional Properties | Any | Optional | can be null | |
## author
Author of the response
`author`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](responses-properties-author.md "#/properties/author#/properties/author")
### author Type
`string`
### author Examples
```yaml
Rico Valdez, Patrick Bareiß, Splunk
```
## date
date of creation or modification, format yyyy-mm-dd
`date`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](responses-properties-date.md "#/properties/date#/properties/date")
### date Type
`string`
### date Examples
```yaml
'2019-12-06'
```
## description
Description of response
`description`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](responses-properties-description.md "#/properties/description#/properties/description")
### description Type
`string`
### description Examples
```yaml
Response example.
```
## id
UUID as unique identifier
`id`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](responses-properties-id.md "#/properties/id#/properties/id")
### id Type
`string`
### id Examples
```yaml
fb4c31b0-13e8-4155-8aa5-24de4b8d6717
```
## name
Name of response
`name`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](responses-properties-name.md "#/properties/name#/properties/name")
### name Type
`string`
### name Examples
```yaml
Response Example
```
## response_phase
Response divided into phases. These will used to referenced known response_phase parameters
`response_phase`
* is required
* Type: `array`
* cannot be null
* defined in: [Response Schema](responses-properties-response_phase.md "#/properties/response_phases#/properties/response_phase")
### response_phase Type
`array`
### response_phase Constraints
**minimum number of items**: the minimum number of items for this array is: `1`
### response_phase Default Value
The default value is:
```json
{}
```
### response_phase Examples
```yaml
preparation:
- id: 7c72d944-3995-4485-8e57-67b4c353989b
name: Preparation NIST
identification:
- id: c36f3f48-e0bb-4c20-a62a-cdc8f6418892
name: Detection and Analysis
- id: 0dc849b2-2eb4-4fd2-add1-b6cc475765f0
name: Analysis
```
## tags
An array of key value pairs for tagging
`tags`
* is required
* Type: `object` ([Details](responses-properties-tags.md))
* cannot be null
* defined in: [Response Schema](responses-properties-tags.md "#/properties/tags#/properties/tags")
### tags Type
`object` ([Details](responses-properties-tags.md))
### tags Constraints
**minimum number of items**: the minimum number of items for this array is: `1`
**unique items**: all items in this array must be unique. Duplicates are not allowed.
### tags Default Value
The default value is:
```json
{}
```
### tags Examples
```yaml
analytic_story: credential_dumping
```
## version
version of detection, e.g. 1 or 2 ...
`version`
* is required
* Type: `integer`
* cannot be null
* defined in: [Response Schema](responses-properties-version.md "#/properties/version#/properties/version")
### version Type
`integer`
### version Examples
```yaml
1
```
## is_note_required
Global assignment for notes being required for tasks, can be individually set in the task
`is_note_required`
* is optional
* Type: `boolean`
* cannot be null
* defined in: [Response Schema](responses-properties-is_note_required.md "#/properties/is_note_required#/properties/is_note_required")
### is_note_required Type
`boolean`
### is_note_required Examples
```yaml
true
```
```yaml
false
```
## references
A list of references for this response, phase or task (e.g. web or printed citation)
`references`
* is optional
* Type: `string[]` ([Blue Team Handbook by Don Murdoch - Amazon](responses-properties-references-blue-team-handbook-by-don-murdoch---amazon.md))
* cannot be null
* defined in: [Response Schema](responses-properties-references.md "#/properties/references#/properties/references")
### references Type
`string[]` ([Blue Team Handbook by Don Murdoch - Amazon](responses-properties-references-blue-team-handbook-by-don-murdoch---amazon.md))
### references Default Value
The default value is:
```json
[]
```
### references Examples
```yaml
- Blue Team Handbook by Don Murdoch - Alarm Triage Overview pages 146-148
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
```
## Additional Properties
Additional properties are allowed and do not have to follow a specific schema
docs/spec/responses_phase.md
-389
View File
@@ -1,389 +0,0 @@
# Response Schema Schema
```txt
http://example.com/example.json
```
schema for phase
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
| :------------------ | :--------- | :------------- | :----------- | :---------------- | :-------------------- | :------------------ | :--------------------------------------------------------------------------------------- |
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | [responses_phase.spec.json](../../spec/responses_phase.spec.json "open original schema") |
## Response Schema Type
`object` ([Response Schema](responses_phase.md))
## Response Schema Default Value
The default value is:
```json
{}
```
# Response Schema Properties
| Property | Type | Required | Nullable | Defined by |
| :------------------------------ | :-------- | :------- | :------------- | :-------------------------------------------------------------------------------------------------------------------- |
| [author](#author) | `string` | Required | cannot be null | [Response Schema](responses_phase-properties-author.md "#/properties/author#/properties/author") |
| [date](#date) | `string` | Required | cannot be null | [Response Schema](responses_phase-properties-date.md "#/properties/date#/properties/date") |
| [description](#description) | `string` | Required | cannot be null | [Response Schema](responses_phase-properties-description.md "#/properties/description#/properties/description") |
| [id](#id) | `string` | Required | cannot be null | [Response Schema](responses_phase-properties-id.md "#/properties/id#/properties/id") |
| [name](#name) | `string` | Required | cannot be null | [Response Schema](responses_phase-properties-name.md "#/properties/name#/properties/name") |
| [response_task](#response_task) | `array` | Required | cannot be null | [Response Schema](responses_phase-properties-response_task.md "#/properties/response_task#/properties/response_task") |
| [tags](#tags) | `object` | Required | cannot be null | [Response Schema](responses_phase-properties-tags.md "#/properties/tags#/properties/tags") |
| [version](#version) | `integer` | Required | cannot be null | [Response Schema](responses_phase-properties-version.md "#/properties/version#/properties/version") |
| [sla](#sla) | `integer` | Optional | cannot be null | [Response Schema](responses_phase-properties-sla.md "#/properties/sla#/properties/sla") |
| [sla_type](#sla_type) | `string` | Optional | cannot be null | [Response Schema](responses_phase-properties-sla_type.md "#/properties/sla_type#/properties/sla_type") |
| [references](#references) | `array` | Optional | cannot be null | [Response Schema](responses_phase-properties-references.md "#/properties/references#/properties/references") |
| Additional Properties | Any | Optional | can be null | |
## author
Author of the phase
`author`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](responses_phase-properties-author.md "#/properties/author#/properties/author")
### author Type
`string`
### author Examples
```yaml
Rico Valdez, Patrick Bareiß, Splunk
```
## date
date of creation or modification, format yyyy-mm-dd
`date`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](responses_phase-properties-date.md "#/properties/date#/properties/date")
### date Type
`string`
### date Examples
```yaml
'2019-12-06'
```
## description
Description of phase
`description`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](responses_phase-properties-description.md "#/properties/description#/properties/description")
### description Type
`string`
### description Examples
```yaml
Response phase descripion.
```
## id
UUID as unique identifier
`id`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](responses_phase-properties-id.md "#/properties/id#/properties/id")
### id Type
`string`
### id Examples
```yaml
fb4c31b0-13e8-4155-8aa5-24de4b8d6717
```
## name
Name of phase
`name`
* is required
* Type: `string`
* cannot be null
* defined in: [Response Schema](responses_phase-properties-name.md "#/properties/name#/properties/name")
### name Type
`string`
### name Examples
```yaml
Preparation
```
## response_task
Response phase is divided into task(s) to be completed. These will used to referenced known response_task parameters. Order is as positioned and with unique name.
`response_task`
* is required
* Type: `array`
* cannot be null
* defined in: [Response Schema](responses_phase-properties-response_task.md "#/properties/response_task#/properties/response_task")
### response_task Type
`array`
### response_task Constraints
**minimum number of items**: the minimum number of items for this array is: `1`
### response_task Default Value
The default value is:
```json
{}
```
### response_task Examples
```yaml
id: 7c72d944-3995-4485-8e57-67b4c353989b
name: Prepare for Incident Handling
```
```yaml
id: c36f3f48-e0bb-4c20-a62a-cdc8f6418892
name: Preventing Incidents
```
```yaml
id: 0dc849b2-2eb4-4fd2-add1-b6cc475765f0
name: Practice
```
## tags
An array of key value pairs for tagging
`tags`
* is required
* Type: `object` ([Details](responses_phase-properties-tags.md))
* cannot be null
* defined in: [Response Schema](responses_phase-properties-tags.md "#/properties/tags#/properties/tags")
### tags Type
`object` ([Details](responses_phase-properties-tags.md))
### tags Constraints
**minimum number of items**: the minimum number of items for this array is: `1`
**unique items**: all items in this array must be unique. Duplicates are not allowed.
### tags Default Value
The default value is:
```json
{}
```
### tags Examples
```yaml
analytic_story: credential_dumping
```
## version
version of detection, e.g. 1 or 2 ...
`version`
* is required
* Type: `integer`
* cannot be null
* defined in: [Response Schema](responses_phase-properties-version.md "#/properties/version#/properties/version")
### version Type
`integer`
### version Examples
```yaml
1
```
## sla
Measured integer for Service Level Agreement for completion of the phase
`sla`
* is optional
* Type: `integer`
* cannot be null
* defined in: [Response Schema](responses_phase-properties-sla.md "#/properties/sla#/properties/sla")
### sla Type
`integer`
### sla Examples
```yaml
5
```
```yaml
30
```
## sla_type
Duration for measured integer for Service Level Agreement for completion of the phase (e.g. minutes, or hours, etc)
`sla_type`
* is optional
* Type: `string`
* cannot be null
* defined in: [Response Schema](responses_phase-properties-sla_type.md "#/properties/sla_type#/properties/sla_type")
### sla_type Type
`string`
### sla_type Default Value
The default value is:
```json
"minutes"
```
### sla_type Examples
```yaml
minutes
```
```yaml
hours
```
```yaml
days
```
## references
A list of references for this response, phase or task (e.g. web or printed citation)
`references`
* is optional
* Type: `string[]` ([3.1 Preparation](responses_phase-properties-references-31-preparation.md))
* cannot be null
* defined in: [Response Schema](responses_phase-properties-references.md "#/properties/references#/properties/references")
### references Type
`string[]` ([3.1 Preparation](responses_phase-properties-references-31-preparation.md))
### references Default Value
The default value is:
```json
[]
```
### references Examples
```yaml
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
```
## Additional Properties
Additional properties are allowed and do not have to follow a specific schema
playbooks/ransomware_investigate_and_contain.yml
+2 -3
View File
@@ -21,9 +21,8 @@ tags:
detections:
- Conti Common Exec parameter
platform_tags:
- tag1
- tag2
- tag3
- Ransomware
- Response
playbook_fields:
- ComputerName
- Username
requirements.txt
+1 -1
View File
@@ -68,7 +68,7 @@ toml==0.10.2
tomli==1.2.1
typing==3.7.4.3
tzlocal==3.0
urllib3==1.26.6
urllib3==1.26.7
virtualenv==20.7.2
wcwidth==0.2.5
webencodings==0.5.1
response_phases/contain_eradicate_recover.yml
-43
View File
@@ -1,43 +0,0 @@
author: ButterCup, Splunk
date: '2020-07-30'
description: The containment, eradication and recovery phase is for the acquiring,
preserving, securing, and documenting of evidence that leads to the appropriate
containment or mititgation of the incident. Eradication is focused on removing any
future threats from vulnerabiliies, malware or activities that produced the incident.
Recovery is the restoration of normal operations for system(s) and customers affected
by the incident.
id: 15442b70-49a1-4e4b-afea-bc1acd63f4bc
name: Containment, Eradication, Recovery
references:
- 3.3 Containment, Eradication, and Recovery - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
response_task:
- id: 3d481dd1-4f30-4262-a846-78af6bdce11c
name: identify_additional_affected_hosts
- id: 735335a5-7ac0-4bdf-b1d3-6f4a6767d02f
name: contain_incident
- id: edb7867c-2e81-4356-a422-92781f4fa34c
name: implement_additional_monitoring
- id: f28177ae-78de-43c9-8692-e972e8a0aa62
name: identify_vunlerabilities
- id: 70362de1-bfef-4a0f-893f-3e0d605ed9b7
name: mitigate_or_remediate_any_vulnerabilities
- id: 26cd22c6-4b67-4dc5-b8d1-f5ef9b5d8226
name: remove_malicious_content
- id: b678705c-12a6-428b-a631-ed579332bc99
name: validate_hosts_eradicated
- id: bb515cf6-40b5-4005-af04-6f63439df7b4
name: restore_systems_to_operational_status
- id: 8218bcf6-739b-4f76-8952-eb133480ad8d
name: validate_restored_hosts
- id: ecf89e9b-106a-46d1-b236-a2716f71d7ae
name: implement_monitoring
sla: null
sla_type: minutes
tags:
analytic_story: NIST SP 800-61r2 Response Plan
nist: RS.RP
product:
- Splunk Phantom
usecase: Advanced Threat Detection
type: response
version: 2
response_phases/containment.yml
-29
View File
@@ -1,29 +0,0 @@
author: ButterCup
date: '2020-07-30'
description: The containment phase is for the acquiring, preserving, securing, and
documenting of evidence that leads to the appropriate containment or mititgation
of the incident. This phase will identify additional hosts and known vulnerabilities
and implememt monitoring of the containment.
id: 5d790fae-8ba6-4fc9-b288-78b67ef8370c
name: Containment
references:
- 3.3 Containment, Eradication, and Recovery - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
response_task:
- id: 3d481dd1-4f30-4262-a846-78af6bdce11c
name: identify_additional_affected_hosts
- id: 735335a5-7ac0-4bdf-b1d3-6f4a6767d02f
name: contain_incident
- id: edb7867c-2e81-4356-a422-92781f4fa34c
name: implement_additional_monitoring
- id: f28177ae-78de-43c9-8692-e972e8a0aa62
name: identify_vunlerabilities
sla: null
sla_type: minutes
tags:
analytic_story: NIST SP 800-61r2 Response Plan
nist: RS.RP
product:
- Splunk Phantom
usecase: Advanced Threat Detection
type: response
version: 2
response_phases/detection_analysis.yml
-33
View File
@@ -1,33 +0,0 @@
author: ButterCup, Splunk
date: '2020-07-17'
description: Events are occurances of a systems or systems. Incidents are declared
violations and incidents can occur in countless ways. Detection and analysis phase
is about identifying an event as an incident and properly categorizing and prioritizing
incident notification and documentation. It is infeasible to develop step-by-step
instructions for handling every incident. This generic detection and analysis process
is a template to ensure the right process is being followed.
id: a6eec2aa-3ec8-4f16-9c09-b8537873047d
name: Detection and Analysis
references:
- 3.2 Detection and Analysis - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
response_task:
- id: 92ba5c50-717d-44e7-bb88-72bf6907ec83
name: Determine if an incident has occurred
- id: ef9e7a25-73f0-4b63-b43b-2f4171518931
name: Analyze precursors to the event
- id: 994298f0-75fc-4c14-b044-9b81944d3a03
name: Confirm Incident
- id: 91f1c863-c080-4b3c-921c-e1ca1c0e7ae1
name: Determine incident prioritization
- id: 3890e0b3-bb46-4b9b-8134-184dbe644a8a
name: Document and Notify of Incident
sla: null
sla_type: minutes
tags:
analytic_story: NIST SP 800-61r2 Response Plan
nist: RS.RP
product:
- Splunk Phantom
usecase: Advanced Threat Detection
type: response
version: 1
response_phases/eradication.yml
-25
View File
@@ -1,25 +0,0 @@
author: ButterCup, Splunk
date: '2020-07-17'
description: The eradication phase is focused on removing any further exposure from
vulnerabiliies, malware or activities that produced the incident.
id: d3b80e0e-4e85-4259-a13c-69ef20987e1c
name: Eradication
references:
- 3.3 Containment, Eradication, and Recovery - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
response_task:
- id: 70362de1-bfef-4a0f-893f-3e0d605ed9b7
name: mitigate_or_remediate_any_vulnerabilities
- id: 26cd22c6-4b67-4dc5-b8d1-f5ef9b5d8226
name: remove_malicious_content
- id: b678705c-12a6-428b-a631-ed579332bc99
name: validate_hosts_eradicated
sla: null
sla_type: minutes
tags:
analytic_story: NIST SP 800-61r2 Response Plan
nist: RS.RP
product:
- Splunk Phantom
usecase: Advanced Threat Detection
type: response
version: 1
response_phases/identification.yml
-43
View File
@@ -1,43 +0,0 @@
author: ButterCup, Splunk
date: '2020-07-17'
description: Events are occurances of a systems or systems. Incidents are declared
violations and incidents can occur in countless ways. Detection and analysis phase
is about identifying an event as an incident and properly categorizing and prioritizing
incident notification and documentation. It is infeasible to develop step-by-step
instructions for handling every incident. This generic detection and analysis process
is a template to ensure the right process is being followed.
id: 6cdd56ba-5ffd-46a9-9dde-d25ce755c100
name: Identification
references:
- 3.2 Detection and Analysis - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
response_task:
- id: 92ba5c50-717d-44e7-bb88-72bf6907ec83
name: Determine if an incident has occurred
- id: ef9e7a25-73f0-4b63-b43b-2f4171518931
name: Analyze precursors to the event
- id: be7cce5c-29b9-405c-923a-d4565705da2e
name: Analyze host indicator and reputation
- id: a194130b-f5a8-4bfe-b09f-35f58f4397d5
name: Analyze IP address indicator and reputation
- id: 7744864c-5446-47ab-8118-4cbaa1649747
name: Analyze domain indicator and reputation
- id: 65a23d95-7b5a-405c-b5bf-893983478d35
name: Analyze url indicator and reputation
- id: 9e2d3e51-2e8f-4d49-8206-fb3e5fbf6620
name: Analyze email indicator and reputation
- id: 994298f0-75fc-4c14-b044-9b81944d3a03
name: Confirm Incident
- id: 91f1c863-c080-4b3c-921c-e1ca1c0e7ae1
name: Determine incident prioritization
- id: 3890e0b3-bb46-4b9b-8134-184dbe644a8a
name: Document and Notify of Incident
sla: null
sla_type: minutes
tags:
analytic_story: NIST SP 800-61r2 Response Plan
nist: RS.RP
product:
- Splunk Phantom
usecase: Advanced Threat Detection
type: response
version: 1
response_phases/preparation.yml
-35
View File
@@ -1,35 +0,0 @@
author: ButterCup, Splunk
date: '2020-07-17'
description: Incident response methodologies typically emphasize preparation not only
for establishing an incident response capability so that the organization is ready
to respond to incidents, but also preventing incidents by ensuring that systems,
networks, and applications are sufficiently secure. Incident response teams need
to know what they have available and what they need to prepare, aquire or configure
for success within the incident response process.
id: d360707d-9214-4449-b15d-9d3cf134209a
name: Preparation NIST
references:
- 3.1 Preparation - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
response_task:
- id: 91d4566e-a292-4f0a-b894-dde23bde3f08
name: Prepare for Incident Handling
- id: 5b7c5d18-6598-412b-a4f1-e66e92890503
name: Preventing Incidents
- id: 97d00b14-dd01-47e4-b7eb-0a82f4998c4e
name: Practice Real World Events
- id: df493538-e598-463b-8835-a109022c2968
name: Conduct Training
- id: 145a82b5-cafd-468e-b487-737fdf13d6a4
name: Raise Personnel Awareness
- id: f83abcae-3734-45ff-99ef-b17eb937c057
name: Make Personnel Report Suspicious Activity
sla: null
sla_type: minutes
tags:
analytic_story: NIST SP 800-61r2 Response Plan
nist: RS.RP
product:
- Splunk Phantom
usecase: Advanced Threat Detection
type: response
version: 1
response_phases/recovery.yml
-25
View File
@@ -1,25 +0,0 @@
author: ButterCup, Splunk
date: '2020-04-21'
description: The recovery phase is the restoration of normal operations for system(s)
and customers affected by the incident.
id: cae4dcdb-f81b-45ec-b0d6-a00cec468e9a
references:
- 3.3 Containment, Eradication, and Recovery - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
response_task:
- id: bb515cf6-40b5-4005-af04-6f63439df7b4
name: restore_systems_to_operational_status
- id: 8218bcf6-739b-4f76-8952-eb133480ad8d
name: validate_restored_hosts
- id: ecf89e9b-106a-46d1-b236-a2716f71d7ae
name: implement_monitoring
sla: null
sla_type: minutes
tags:
analytic_story: NIST SP 800-61r2 Response Plan
nist: RS.RP
product:
- Splunk Phantom
usecase: Advanced Threat Detection
title: Recovery
type: response
version: 1
response_tasks/deprecated/analyze_malicious_file.yml
-20
View File
@@ -1,20 +0,0 @@
author: Patrick Bareiss, Splunk
date: '2020-04-29'
description: Perform a static and dynamic malware analysis for the malicious file.
Use the findings for further response tasks.
id: 6ee5c067-8228-4926-abb2-54f2c59d726e
name: Analyze Malicious File
tags:
analytic_story:
- 'Emotet Malware DHS Report TA18-201A '
- Hidden Cobra Malware
- Lateral Movement
- Malicious PowerShell
- Orangeworm Attack Group
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
- Ransomware
- SamSam Ransomware
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/aws_investigate_user_activities_by_source_user.yml
-23
View File
@@ -1,23 +0,0 @@
author: Bhavin Patel, Splunk
date: '2018-06-08'
description: This search retrieves the times, ARN, source IPs, AWS regions, event
names, and the result of the event for specific ARNs.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.
id: b0d2e6a8-75fa-4b1b-9486-3d32acadf891
inputs:
- src_user
name: AWS Investigate User Activities By Source User
search: '| search sourcetype=aws:cloudtrail userIdentity.arn=$src_user$ | spath output=user
path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip,
awsRegion, eventName, errorCode, errorMessage'
tags:
analytic_story:
- AWS Cross Account Activity
- Suspicious Cloud Instance Activities
- Suspicious Cloud Provisioning Activities
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/get_authentication_logs_for_endpoint.yml
-60
View File
@@ -1,60 +0,0 @@
author: Bhavin Patel, Splunk
date: '2017-11-01'
description: This search returns all users that have attempted to access a particular
endpoint.
how_to_implement: To successfully implement this search you need to be ingesting authentication
logs from your various systems and populating the Authentication data model.
id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
inputs:
- dest
name: Get Authentication Logs For Endpoint
search: '| tstats count from datamodel=Authentication where Authentication.dest=$dest$
by _time, Authentication.dest, Authentication.user, Authentication.app, Authentication.action
| `drop_dm_object_name("Authentication")`'
tags:
analytic_story:
- AWS Network ACL Activity
- Account Monitoring and Controls
- Apache Struts Vulnerability
- Brand Monitoring
- ColdRoot MacOS RAT
- Collection and Staging
- Command and Control
- DHS Report TA18-074A
- Data Protection
- Disabling Security Tools
- Dynamic DNS
- 'Emotet Malware DHS Report TA18-201A '
- Hidden Cobra Malware
- Host Redirection
- Lateral Movement
- Malicious PowerShell
- Monitor for Unauthorized Software
- Netsh Abuse
- Orangeworm Attack Group
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
- Prohibited Traffic Allowed or Protocol Mismatch
- Ransomware
- Router and Infrastructure Security
- SQL Injection
- SamSam Ransomware
- Spectre And Meltdown Vulnerabilities
- Suspicious AWS Traffic
- Suspicious Command-Line Executions
- Suspicious DNS Traffic
- Suspicious Emails
- Suspicious MSHTA Activity
- Suspicious WMI Use
- Suspicious Windows Registry Activities
- Unusual Processes
- Windows Defense Evasion Tactics
- Windows File Extension and Association Abuse
- Windows Log Manipulation
- Windows Persistence Techniques
- Windows Privilege Escalation
- Windows Service Abuse
- Suspicious Zoom Child Processes
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/get_notable_info.yml
-76
View File
@@ -1,76 +0,0 @@
author: Bhavin Patel, Splunk
date: '2017-09-20'
description: This search queries the notable index to retrieve detailed information
captured within the notable. Every notable has a unique ID associated with it, which
is used to point us directly to the notable event under investigation.
how_to_implement: If you are using Enterprise Security you are likely already creating
notable events with your correlation rules. No additional configuration is necessary.
id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
inputs:
- event_id
name: Get Notable Info
search: '| search `notable_by_id($event_id$)` | table time, rule_name, dest, dest_asset_id,
dest_owner, priority, severity, owner, status_description'
tags:
analytic_story:
- AWS Cryptomining
- AWS Network ACL Activity
- AWS User Monitoring
- Account Monitoring and Controls
- Apache Struts Vulnerability
- Asset Tracking
- Brand Monitoring
- Cloud Cryptomining
- Collection and Staging
- Command and Control
- DHS Report TA18-074A
- DNS Amplification Attacks
- Data Protection
- Disabling Security Tools
- Dynamic DNS
- 'Emotet Malware DHS Report TA18-201A '
- Hidden Cobra Malware
- Host Redirection
- JBoss Vulnerability
- Kubernetes Scanning Activity
- Lateral Movement
- Malicious PowerShell
- Monitor for Unauthorized Software
- Monitor for Updates
- Netsh Abuse
- Orangeworm Attack Group
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
- Prohibited Traffic Allowed or Protocol Mismatch
- Ransomware
- Router and Infrastructure Security
- SQL Injection
- SamSam Ransomware
- Spectre And Meltdown Vulnerabilities
- Splunk Enterprise Vulnerability
- Splunk Enterprise Vulnerability CVE-2018-11409
- Suspicious AWS EC2 Activities
- Suspicious AWS S3 Activities
- Suspicious AWS Traffic
- Suspicious Command-Line Executions
- Suspicious DNS Traffic
- Suspicious Emails
- Suspicious MSHTA Activity
- Suspicious WMI Use
- Suspicious Windows Registry Activities
- Unusual Processes
- Use of Cleartext Protocols
- Web Fraud Detection
- Windows Defense Evasion Tactics
- Windows File Extension and Association Abuse
- Windows Log Manipulation
- Windows Persistence Techniques
- Windows Privilege Escalation
- Windows Service Abuse
- Kubernetes Sensitive Role Activity
- Kubernetes Sensitive Object Access Activity
- F5 TMUI RCE CVE-2020-5902
- Windows DNS SIGRed CVE-2020-1350
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/get_process_registry_activity.yml
-24
View File
@@ -1,24 +0,0 @@
author: David Dorsey, Splunk
date: '2019-11-06'
description: This search returns the registry activity for a specific process on a
specific endpoint
how_to_implement: To successfully implement this search you must be ingesting endpoint
data and populating the Endpoint data model.
id: d8362a34-b78a-4364-9733-59b505f5b8d5
inputs:
- process_id
- dest
name: Get Process Registry Activity
search: '| tstats `security_content_summariesonly` values(Registry.registry_key_name)
as registry_key_name, values(Registry.dest) as dest, values(Registry.process_id)
as process_id from datamodel=Endpoint.Registry where Registry.process_id=$process_id$
AND Registry.dest=$dest$ by Registry.registry_path, Registry.action, _time | `drop_dm_object_name(Registry)`
| sort _time | table _time, process_id, dest, action, registry_key_name, registry_path'
tags:
analytic_story:
- DHS Report TA18-074A
- Suspicious Zoom Child Processes
product:
- Splunk Phantom
type: response
version: 2
response_tasks/deprecated/get_registry_activities.yml
-36
View File
@@ -1,36 +0,0 @@
author: Bhavin Patel, Splunk
date: '2019-03-01'
description: This search queries the Endpoint Datamodel to give you details of the
latest registry values for a specific destination computer.
how_to_implement: To successfully implement this search you need to be ingesting information
on registry changes that include the name of the process responsible for the changes
from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry`
nodes.
id: fecf2918-670d-4f1c-872b-3d7317a41xf9
inputs:
- dest
name: Get Registry Activities
search: '| tstats `security_content_summariesonly` values(Registry.registry_path)
as registry_path values(Registry.registry_key_name) as registry_key_name count FROM
datamodel=Endpoint.Registry where Registry.dest = "$dest$" by Registry.process_id
Registry.dest | `drop_dm_object_name("Registry")` | join [| tstats `security_content_summariesonly`
count values(Processes.user) as user values(Processes.process_name) as process_name
values(Processes.parent_process_name) as parent_process_name FROM datamodel=Endpoint.Processes
where Processes.process_name = reg.exe by Processes.process_id | `drop_dm_object_name("Processes")`]'
tags:
analytic_story:
- DHS Report TA18-074A
- 'Emotet Malware DHS Report TA18-201A '
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
- Ransomware
- Suspicious Command-Line Executions
- Suspicious MSHTA Activity
- Suspicious Windows Registry Activities
- Windows Defense Evasion Tactics
- Windows File Extension and Association Abuse
- Windows Persistence Techniques
- Windows Privilege Escalation
product:
- Splunk Phantom
type: response
version: 2
response_tasks/deprecated/get_risk_modifiers_for_endpoint.yml
-68
View File
@@ -1,68 +0,0 @@
author: Bhavin Patel, Splunk
date: '2017-10-19'
description: 'For the last 7 days, the search will query the Risk data model in Splunk
Enterprise Security and calculate the count, sum of the risk\_scores, names of the
correlation searches that contributed to create a risk score for a specific endpoint(machine\_name) '
how_to_implement: Enable the correlation searches included in Splunk Enterprise Security
that include Risk Analysis alert actions by leveraging the Risk Analysis Framework
id: fdcfb369-1725-4c24-824a-22972d7f0d65
inputs:
- dest
name: Get Risk Modifiers For Endpoint
search: '| from datamodel:Risk.All_Risk | search risk_object_type=system risk_object=$dest$
| stats count sum(risk_score) as risk_score values(search_name) min(_time) as firstTime
max(_time) as lastTime by risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
tags:
analytic_story:
- AWS Network ACL Activity
- Account Monitoring and Controls
- Apache Struts Vulnerability
- Brand Monitoring
- ColdRoot MacOS RAT
- Collection and Staging
- Command and Control
- DHS Report TA18-074A
- DNS Amplification Attacks
- Data Protection
- Disabling Security Tools
- Dynamic DNS
- 'Emotet Malware DHS Report TA18-201A '
- Hidden Cobra Malware
- Host Redirection
- JBoss Vulnerability
- Kubernetes Scanning Activity
- Lateral Movement
- Malicious PowerShell
- Monitor Backup Solution
- Monitor for Unauthorized Software
- Monitor for Updates
- Netsh Abuse
- Orangeworm Attack Group
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
- Prohibited Traffic Allowed or Protocol Mismatch
- Ransomware
- Router and Infrastructure Security
- SQL Injection
- SamSam Ransomware
- Spectre And Meltdown Vulnerabilities
- Splunk Enterprise Vulnerability
- Splunk Enterprise Vulnerability CVE-2018-11409
- Suspicious AWS Traffic
- Suspicious Command-Line Executions
- Suspicious DNS Traffic
- Suspicious Emails
- Suspicious MSHTA Activity
- Suspicious WMI Use
- Suspicious Windows Registry Activities
- Unusual Processes
- Use of Cleartext Protocols
- Windows Defense Evasion Tactics
- Windows File Extension and Association Abuse
- Windows Log Manipulation
- Windows Persistence Techniques
- Windows Privilege Escalation
- Windows Service Abuse
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/get_risk_modifiers_for_user.yml
-62
View File
@@ -1,62 +0,0 @@
author: Bhavin Patel, Splunk
date: '2017-10-19'
description: 'For the last 7 days, the search will query the Risk data model in Splunk
Enterprise Security and calculate the count, sum of the risk_scores, names of the
correlation searches that contributed to create a risk score for a specific user '
how_to_implement: Enable the correlation searches included in Splunk Enterprise Security
that include Risk Analysis alert actions by leveraging the Risk Analysis Framework
id: fdcfb369-1725-4c24-824a-22972d7f0d55
inputs:
- user
name: Get Risk Modifiers For User
search: '| from datamodel:Risk.All_Risk | search risk_object_type=user risk_object=$user$
| stats count sum(risk_score) as risk_score values(search_name) min(_time) as firstTime
max(_time) as lastTime by risk_object |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` '
tags:
analytic_story:
- AWS Network ACL Activity
- Account Monitoring and Controls
- Apache Struts Vulnerability
- Brand Monitoring
- ColdRoot MacOS RAT
- Collection and Staging
- Command and Control
- DHS Report TA18-074A
- DNS Amplification Attacks
- Data Protection
- Disabling Security Tools
- Dynamic DNS
- 'Emotet Malware DHS Report TA18-201A '
- Hidden Cobra Malware
- Host Redirection
- Lateral Movement
- Malicious PowerShell
- Monitor Backup Solution
- Monitor for Unauthorized Software
- Netsh Abuse
- Orangeworm Attack Group
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
- Prohibited Traffic Allowed or Protocol Mismatch
- Ransomware
- Router and Infrastructure Security
- SamSam Ransomware
- Spectre And Meltdown Vulnerabilities
- Suspicious AWS Traffic
- Suspicious Command-Line Executions
- Suspicious DNS Traffic
- Suspicious Emails
- Suspicious MSHTA Activity
- Suspicious WMI Use
- Suspicious Windows Registry Activities
- Unusual Processes
- Use of Cleartext Protocols
- Windows Defense Evasion Tactics
- Windows File Extension and Association Abuse
- Windows Log Manipulation
- Windows Persistence Techniques
- Windows Privilege Escalation
- Windows Service Abuse
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/get_update_logs_for_endpoint.yml
-21
View File
@@ -1,21 +0,0 @@
author: David Dorsey, Splunk
date: '2017-08-24'
description: This search will tell you give you the update logs for a specific endpoint
for the last week.
how_to_implement: You need to be ingesting the update logs from your various systems.
id: d98675ed-da43-4a7e-96a7-eeca3232ba8e
inputs:
- dest
name: Get Update Logs For Endpoint
search: '| from datamodel Updates.Updates | search (vendor_product="Microsoft Windows"
OR vendor_product="OSX:Update" OR vendor_product="Linux:Update") dest=$dest$'
tags:
analytic_story:
- 'Emotet Malware DHS Report TA18-201A '
- Monitor for Unauthorized Software
- Ransomware
- SamSam Ransomware
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/get_user_information_from_identity_table.yml
-61
View File
@@ -1,61 +0,0 @@
author: Bhavin Patel, Splunk
date: '2017-09-20'
description: Gather more information about the user identified in the Notable Event.
how_to_implement: To successfully implement this search you must have populated the
identity table with information about your users.
id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
inputs:
- user
name: Get User Information from Identity Table
search: '| `identities` | search identity=$user$ | table _time, identity, first, last,
email, category, watchlist'
tags:
analytic_story:
- AWS Cryptomining
- AWS Network ACL Activity
- Account Monitoring and Controls
- Apache Struts Vulnerability
- Brand Monitoring
- Cloud Cryptomining
- ColdRoot MacOS RAT
- Collection and Staging
- Command and Control
- DHS Report TA18-074A
- Data Protection
- Disabling Security Tools
- Dynamic DNS
- 'Emotet Malware DHS Report TA18-201A '
- Hidden Cobra Malware
- Host Redirection
- Lateral Movement
- Malicious PowerShell
- Monitor for Unauthorized Software
- Netsh Abuse
- Orangeworm Attack Group
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
- Prohibited Traffic Allowed or Protocol Mismatch
- Ransomware
- Router and Infrastructure Security
- SamSam Ransomware
- Spectre And Meltdown Vulnerabilities
- Suspicious AWS EC2 Activities
- Suspicious AWS S3 Activities
- Suspicious AWS Traffic
- Suspicious Command-Line Executions
- Suspicious DNS Traffic
- Suspicious Emails
- Suspicious MSHTA Activity
- Suspicious WMI Use
- Suspicious Windows Registry Activities
- Unusual Processes
- Use of Cleartext Protocols
- Windows Defense Evasion Tactics
- Windows File Extension and Association Abuse
- Windows Log Manipulation
- Windows Persistence Techniques
- Windows Privilege Escalation
- Windows Service Abuse
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/get_vulnerability_logs_for_endpoint.yml
-25
View File
@@ -1,25 +0,0 @@
author: David Dorsey, Splunk
date: '2017-09-10'
description: This search will show you any vulnerabilities noted for a specific endpoint
for the last week.
how_to_implement: You need to be ingesting the logs from your vulnerability scanner.
id: df7a7f50-30f2-4cde-8448-69d2d5f9b3c5
inputs:
- dest
name: Get Vulnerability Logs For Endpoint
search: '| from datamodel Vulnerabilities.Vulnerabilities | search dest=$dest$'
tags:
analytic_story:
- ColdRoot MacOS RAT
- DHS Report TA18-074A
- 'Emotet Malware DHS Report TA18-201A '
- Hidden Cobra Malware
- JBoss Vulnerability
- Monitor for Unauthorized Software
- Ransomware
- SamSam Ransomware
- Windows Log Manipulation
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/investigate_aws_ecr_container_listing_activity.yml
-26
View File
@@ -1,26 +0,0 @@
author: Rod Soto, Rico Valdez, Splunk
date: '2020-02-20'
description: This search lists all the users performing a list image operation on
AWS Elastic Container Registry. Listing source user, image id, source IP, user type,
http user agent. This search also gives counts of unique user agents per listing
source.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.You must also install Cloud Infrastructure Data Model.
id: 6027623f-7d10-4847-af3b-8d7e87970451
inputs:
- Compute.event_name
name: Investigate AWS ECR container listing activity
search: '|tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Compute
where Compute.user_type!="AssumeRole" AND Compute.event_name="ListImages" by Compute.image_id
Compute.src_user Compute.src Compute.http_user_agent Compute.user_type | rename
"Compute.*" as * |stats values(http_user_agent) as http_user_agent distinct_count(http_user_agent)
as unique_ua_count by src_user, image_id, src, user_type | where unique_ua_count
> 1'
tags:
analytic_story:
- Container Implantation Monitoring and Investigation
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/investigate_cloud_compute_instance_activities.yml
-18
View File
@@ -1,18 +0,0 @@
author: David Dorsey, Splunk
date: '2018-03-12'
description: This search returns a logs of events that operated on the compute instance.
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the Security Research cloud data model installed.
id: 33a95cf2-900c-4636-8fca-5c5f71474720
inputs:
- dest
name: Investigate Cloud Compute Instance Activities
search: '| from datamodel:Cloud_Infrastructure.Compute | search dest=$dest$ | fields
- _*'
tags:
analytic_story:
- Cloud Cryptomining
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/investigate_user_activities_in_all_cloud_regions.yml
-20
View File
@@ -1,20 +0,0 @@
author: David Dorsey, Splunk
date: '2019-04-30'
description: This search lists all the logged cloud infrastructure activities by a
specific cloud user
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the Security Research cloud data model installed.
id: 2ef6310f-8e79-42af-b20b-b4eeaba9608a
inputs:
- region
- src_user
name: Investigate User Activities In All Cloud Regions
search: '| from datamodel:Cloud_Infrastructure.Compute | search user=$src_user$ |
fields - _*'
tags:
analytic_story:
- Cloud Cryptomining
product:
- Splunk Phantom
type: response
version: 2
response_tasks/deprecated/investigate_user_activities_in_single_cloud_region.yml
-20
View File
@@ -1,20 +0,0 @@
author: David Dorsey, Splunk
date: '2019-04-30'
description: This search lists all the logged cloud infrastructure activities by a
specific cloud user in a specific cloud region
how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
and have the Security Research cloud data model installed.
id: 3dc3a8e7-394b-44ae-8262-4ef8e90b723d
inputs:
- region
- src_user
name: Investigate User Activities In Single Cloud Region
search: '| from datamodel:Cloud_Infrastructure.Compute | search region=$region$ user=$src_user$
| fields - _*'
tags:
analytic_story:
- Cloud Cryptomining
product:
- Splunk Phantom
type: response
version: 2
response_tasks/deprecated/investigate_web_activity_from_host.yml
-38
View File
@@ -1,38 +0,0 @@
author: Bhavin Patel, Splunk
date: '2017-11-09'
description: This search allows you to find all the web activity from a specific host.
During an investigation, it is important to profile web activity to characterize
user or host activity.
how_to_implement: To successfully implement this search you must be ingesting your
web traffic and populating the Web data model.
id: bc91a8cf-35e7-4bb2-8140-e756cc06fd22
inputs:
- dest
name: Investigate Web Activity From Host
search: '| from datamodel Web.Web | search src=$dest$'
tags:
analytic_story:
- Brand Monitoring
- DHS Report TA18-074A
- Disabling Security Tools
- 'Emotet Malware DHS Report TA18-201A '
- Hidden Cobra Malware
- JBoss Vulnerability
- Monitor for Unauthorized Software
- Netsh Abuse
- Orangeworm Attack Group
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
- Ransomware
- SamSam Ransomware
- Suspicious Command-Line Executions
- Suspicious Emails
- Suspicious MSHTA Activity
- Suspicious Windows Registry Activities
- Unusual Processes
- Windows Log Manipulation
- Windows Persistence Techniques
- Windows Privilege Escalation
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/investigate_web_activity_from_src_ip.yml
-21
View File
@@ -1,21 +0,0 @@
author: David Dorsey, Splunk
date: '2018-06-15'
description: This search searches for all web activity from a specific host. During
an investigation, it is important to profile web activity to characterize user or
host activity.
how_to_implement: To successfully implement this search, you must be ingesting your
web traffic and populating the web data model.
id: 2f5b960b-71df-49c0-affc-74992ce60e45
inputs:
- src_ip
name: Investigate Web Activity From src ip
search: '| from datamodel Web.Web | search src=$src_ip$'
tags:
analytic_story:
- ColdRoot MacOS RAT
- Dynamic DNS
- Splunk Enterprise Vulnerability CVE-2018-11409
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/process_chain_analysis.yml
-59
View File
@@ -1,59 +0,0 @@
author: Patrick Bareiss, Splunk
date: '2020-04-29'
description: Analyze the Process Chain and identify the malicious file. By analyzing
the parent process guid and searching for the process guid, the spawning process
chain can be identified.
id: c5506139-ef86-4cd9-8535-0512aa732e79
inputs:
- process_guid
name: Process Chain Analysis
search: '`sysmon` EventCode=1 NOT process=*Splunk* | rename process_guid AS out_process_guid
process_name AS out_process_name parent_process_guid AS out_parent_process_guid
parent_process_name AS out_parent_process_name | stats count by out_process_guid
out_process_name out_parent_process_guid out_parent_process_name | eval join_process_guid
= out_process_guid | join join_process_guid [ search `sysmon` process_guid={process_guid}
EventCode=1 | rename process_name AS sub_process_name process_guid AS sub_process_guid
parent_process_name AS sub_parent_process_name parent_process_guid AS sub_parent_process_guid
| stats count by sub_process_name sub_process_guid sub_parent_process_name sub_parent_process_guid
| eval join_process_guid = sub_parent_process_guid] | rename sub_process_guid AS
process_guid sub_process_name AS process_name out_process_guid AS parent_process_guid
out_process_name AS parent_process_name out_parent_process_guid AS grandparent_process_guid
out_parent_process_name AS grandparent_process_name | stats count by process_guid
process_name parent_process_guid parent_process_name grandparent_process_guid grandparent_process_name
| head 1 | fields - count'
tags:
analytic_story:
- AWS Network ACL Activity
- Collection and Staging
- Command and Control
- DHS Report TA18-074A
- Data Protection
- Disabling Security Tools
- 'Emotet Malware DHS Report TA18-201A '
- Hidden Cobra Malware
- Lateral Movement
- Malicious PowerShell
- Monitor for Unauthorized Software
- Netsh Abuse
- Orangeworm Attack Group
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
- Prohibited Traffic Allowed or Protocol Mismatch
- Ransomware
- SamSam Ransomware
- Suspicious AWS Traffic
- Suspicious Command-Line Executions
- Suspicious DNS Traffic
- Suspicious MSHTA Activity
- Suspicious WMI Use
- Suspicious Windows Registry Activities
- Unusual Processes
- Windows Defense Evasion Tactics
- Windows File Extension and Association Abuse
- Windows Log Manipulation
- Windows Persistence Techniques
- Windows Privilege Escalation
- Windows Service Abuse
product:
- Splunk Phantom
type: response
version: 1
response_tasks/deprecated/quarantaine_infected_host.yml
-14
View File
@@ -1,14 +0,0 @@
author: Patrick Bareiss, Splunk
date: '2020-04-29'
description: Quarantine the infected hosts in order to stop the malware from spreading
to further hosts. This is a short-term containment with the focus on limiting the
damage as soon as possible.
id: 60c4cfa5-81b7-44e2-9ad4-71524e4a3e78
name: Quarantaine Infected Host
tags:
analytic_story:
- Ransomware
product:
- Splunk Phantom
type: response
version: 1
response_tasks/dns_hijack_enrichment.yml
-39
View File
@@ -1,39 +0,0 @@
author: Bhavin Patel, Splunk
date: '2019-02-14'
description: 'This Playbook is part of the Splunk Analytic Story called DNS Hijacking.
It is made to be run when the Detection Search within that story called "DNS Record
Changed" is used to identify DNS record changes for cloud and corporate domains
used in your environment. The detection search is dependent on a support searched
called "Discover DNS Records" which finds the common DNS responses for the last
30 days of monitored corporate domains and cloud providers (located in lookups:
cim_corporate_email_domains.csv, cim_corporate_web_domains.csv, and cloud_domains.csv
from Splunk CIM App). These responses are stored under the lookup called discovered_dns_records.csv.
The playbook starts with the changed DNS records and uses MaxMind, whois, Censys,
Malware Domain List, and PassiveTotal to gather attributes of the DNS records for
comparison against expected values. The resulting enrichment is displayed in Mission
Control and posted back to the Notable Event in Splunk ES.'
how_to_implement: 'If Splunk>Phantom is also configured in your environment, a Playbook
called "DNS Hijack Enrichment" can be configured to run when any results are found
by this detection search. The playbook takes in the DNS record changed and uses
Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this
integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`,
add the correct hostname to the "Phantom Instance" field in the Adaptive Response
Actions when configuring this detection search, and set the corresponding Playbook
to active. \
(Playbook Link:`https://my.phantom.us/4.2/playbook/dns-hijack-enrichment/`).\
'
id: c096f721-8842-42ce-bfc7-74bd9a72c712
name: DNS Hijack Enrichment
playbook:
name: dns_hijack_enrichment
url_json: https://github.com/phantomcyber/playbooks/blob/4.6/dns_hijack_enrichment.json
url_python: https://github.com/phantomcyber/playbooks/blob/4.6/dns_hijack_enrichment.py
tags:
analytic_story:
- DNS Hijacking
product:
- Splunk Phantom
type: response
version: 1
response_tasks/domain_certificate_investigation.yml
-29
View File
@@ -1,29 +0,0 @@
author: Philip Royer, Splunk
date: '2019-04-29'
description: Investigate domain names and URLs of a potentially malicious website.
These domain names and URLs could come from anywhere, but this Playbook was designed
to work with the Splunk Analytic Story focused on evilginx2 phishing techniques
that harvest credentials from fake login sites. The full investigation is only completed
if at least one of the TLS certificates of the domains matches the issuer distinguished
name of Let's Encrypt, which is a free service that provides automatically issued
TLS certificates. This Playbook gathers certificate information for the domains,
queries whois for the domains, takes a screenshot of each of the URLs, and does
a urlscan.io scan of each of the URLs. Finally, all the results are formatted together
and posted to the event comments.
how_to_implement: To successfully implement this phantom playbook, you must integrate
Enterprise Security with Phantom. Configure this playbook in the correlation search
`Detect DNS requests to Phishing Sites leveraging EvilGinx2` ,as an adaptive response
action.
id: c096f721-8842-42ce-2fc7-742d8272b712
name: Domain Certificate Investigation
playbook:
name: lets_encrypt_domain_investigate
url_json: https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.json
url_python: https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.py
tags:
analytic_story:
- Common Phishing Frameworks
product:
- Splunk Phantom
type: response
version: 1
response_tasks/excessive_account_lockouts_enrichment_and_response.yml
-26
View File
@@ -1,26 +0,0 @@
author: Bhavin Patel, Splunk
date: '2019-02-14'
description: This Playbook is part of the Splunk Analytic Story called Account Monitoring
and Controls. It is made to be run when the Detection Search within that story called
"Detect Excessive Account Lockouts From Endpoint" is used to identify a potential
attack in which multiple Active Directory user accounts are locked out from logging
in because an adversary attempted incorrect credentials repeatedly against many
user accounts. This Playbook runs the Context-gathering and Investigative searches
linked in the Splunk Analytic Story to enrich the event with a broad array of information
about the users and computers involved. Then the Playbook uses Windows Remote Management
to login to the source of the lockouts, gather more information, and allow Phantom
to shutdown the server after prompting an analyst or responder.
how_to_implement: Import playbook into phantom
id: ab62b5c1-95d4-4e71-8fd7-53a55db33da4
name: Excessive Account Lockouts Enrichment And Response
playbook:
name: excessive_account_lockouts_enrichment_and_response
url_json: https://github.com/phantomcyber/playbooks/blob/4.6/excessive_account_lockouts_enrichment_and_response.json
url_python: https://github.com/phantomcyber/playbooks/blob/4.6/excessive_account_lockouts_enrichment_and_response.py
tags:
analytic_story:
- Account Monitoring and Controls
product:
- Splunk Phantom
type: response
version: 2
response_tasks/playbooks/accept_and_assign_event.yml
-35
View File
@@ -1,35 +0,0 @@
author: ButterCup
automation:
actions:
- set status
is_note_required: false
playbooks:
- playook: Accept event and assign owner
scm: local
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Accepts the event and starts the response plan process by assigning
the event to the person executing the playbook and assigns them to this task and
closes this step as completed.
'
id: 667b8d15-2564-4994-929d-bda2532341bf
name: Accept and assign event
references:
- 3.2.2 Signs of an Incident - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: 'This task is a default accept task and allows the analyst to start the
response process and start the timer for mean time to detect (MTTD). This allows
measurement of analyst review and acceptance of the task at hand. This can be superceded
by assign other tasks to individuals (if the owner is coordinating processor). The
event owner can accept the event, and then retask other sub-phase and/or task to
other individuals or teams. This is considered a procedural or policy task.
'
response_tasks/playbooks/analyze_domain_indicator_and_reputation.yml
-42
View File
@@ -1,42 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- run query
- whois domain
- domain reputation
- hunt domain
is_note_required: false
playbooks:
- playbook: ''
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-04-21'
description: 'Validate indicator existence, reputation, detonation and determine if
Known APT, Commodity, Suspicious or Not Malicious?
'
id: 7744864c-5446-47ab-8118-4cbaa1649747
name: Analyze domain indicator and reputation
references:
- 3.2.3 Sources of Precursors and Indicators - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: "These are domains that are not related to urls and should be separately\
\ reviewed.\n1. If Splunk present, run Splunk Query on each indictor and prevelence\
\ in the environment. Summarize # of times indicator seen in the last 24 hrs, 7\
\ days, 1 month, six months increments. Return the hosts that have used this indictor.\
\ (make an artifact for each host?)\n a. search -> ```| stats ...```\n1. Gather\
\ reputational, intelligence and general information regarding indicator into a\
\ note (a note for each indicator)\n1. Perform any additional research regarding\
\ indicators and understanding what normal behaviour is or should be by using using\
\ search engines, knowledge bases etc.\n1. Make a determination of indicator, Known\
\ APT, Commodity, Suspicous or Not Malicious and whether to tag to block indicator\n\
\ a. This should align to a severity change (Known APT = High, Commodity = Med,\
\ Suspicous = Low, Not Malicious = Info)\n a. hange container and artifact severity\
\ and tag artifact & indicator(s) with blocked and determination tag\n"
response_tasks/playbooks/analyze_email_indicators_and_reputation.yml
-43
View File
@@ -1,43 +0,0 @@
author: ButterCup
automation:
actions:
- run query
is_note_required: false
playbooks:
- playook: null
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-04-21'
description: 'Validate email indicators existence, reputation, detonation and determine
if Phish, Spam, Suspicious or Clean ?
Analyst should be reviewing SPF, DKIM, DMARC along with To: and Reply to: fields
for non-matching data. Does the subject contain suspicious content. Is there a file
or url? Does the x-origin-ip come from the same location and the sending domains?
Does the email body seem too good to be true or create a sense of urgency?
'
id: 9e2d3e51-2e8f-4d49-8206-fb3e5fbf6620
name: Analyze email indicators and reputation
references:
- 3.2.3 Sources of Precursors and Indicators - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: "1. If Splunk present, run Splunk Query on each indictor and prevalence\
\ in the environment. Summarize # of times indicator seen in the last 24 hrs, 7\
\ days, 1 month, six months increments. Return the hosts that have used this indictor.\
\ (make an artifact for each host?)\n a. search -> ```| stats ...```\n1. Gather\
\ reputation, intelligence and general information regarding indicator into a note\
\ (a note for each indicator)\n1. Perform any additional research regarding indicators\
\ and understanding what normal behaviour is or should be by using using search\
\ engines, knowledge bases etc.\n1. Make a determination of indicator, Known APT,\
\ Commodity, Suspicious or Not Malicious and whether to tag to block indicator\n\
\ a. This should align to a severity change (Known APT = High, Commodity = Med,\
\ Suspicious = Low, Not Malicious = Info)\n a. Change container and artifact severity\
\ and tag artifact & indicator(s) with blocked and determination tag\n"
response_tasks/playbooks/analyze_host_indicator_and_reputation.yml
-37
View File
@@ -1,37 +0,0 @@
author: ButterCup
automation:
actions: null
is_note_required: false
playbooks:
- playook: ''
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Validate indicator existence, reputation, detonation and determine if
Known APT, Commodity, Suspicious or Not Malicious?
'
id: be7cce5c-29b9-405c-923a-d4565705da2e
name: Analyze host indicator and reputation
references:
- 3.2.3 Sources of Precursors and Indicators - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: "1. If Splunk present, run Splunk Query on each indictor and prevalence\
\ in the environment. Summarize # of times indicator seen in the last 24 hrs, 7\
\ days, 1 month, six months increments. Return the hosts that have used this indictor.\
\ (make an artifact for each host?)\n a. search -> ```| stats ...```\n1. Gather\
\ repetitional, intelligence and general information regarding indicator into a\
\ note (a note for each indicator)\n1. Perform any additional research regarding\
\ indicators and understanding what normal behaviour is or should be by using using\
\ search engines, knowledge bases etc.\n1. Make a determination of indicator, Known\
\ APT, Commodity, Suspicious or Not Malicious and whether to tag to block indicator\n\
\ a. This should align to a severity change (Known APT = High, Commodity = Med,\
\ Suspicious = Low, Not Malicious = Info)\n a. Change container and artifact severity\
\ and tag artifact & indicator(s) with blocked and determination tag\n"
response_tasks/playbooks/analyze_ip_address_indicator_and_reputation.yml
-44
View File
@@ -1,44 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- run query
- whois ip
- geolocate ip
- ip reputation
- ip intelligence
- hunt ip
- lookup ip
is_note_required: false
playbooks:
- playook: ''
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Validate indicator existence, reputation, detonation and determine if
Known APT, Commodity, Suspicious or Not Malicious?
'
id: a194130b-f5a8-4bfe-b09f-35f58f4397d5
name: Analyze IP address indicator and reputation
references:
- 3.2.3 Sources of Precursors and Indicators - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: "1. If Splunk present, run Splunk Query on each indictor and prevalence\
\ in the environment. Summarize # of times indicator seen in the last 24 hrs, 7\
\ days, 1 month, six months increments. Return the hosts that have used this indictor.\
\ (make an artifact for each host?)\n a. search -> ```| stats ...```\n1. Gather\
\ repetitional, intelligence and general information regarding indicator into a\
\ note (a note for each indicator)\n1. Perform any additional research regarding\
\ indicators and understanding what normal behaviour is or should be by using using\
\ search engines, knowledge bases etc.\n1. Make a determination of indicator, Known\
\ APT, Commodity, Suspicious or Not Malicious and whether to tag to block indicator\n\
\ a. This should align to a severity change (Known APT = High, Commodity = Med,\
\ Suspicious = Low, Not Malicious = Info)\n a. Change container and artifact severity\
\ and tag artifact & indicator(s) with blocked and determination tag\n"
response_tasks/playbooks/analyze_network_indicators_and_reputation.yml
-51
View File
@@ -1,51 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- run query
- whois ip
- whois domain
- geolocate ip
- ip reputation
- domain reputation
- url reputation
- ip intelligence
- domain intelligence
- url intelligence
- hunt ip
- hunt domain
- hunt url
- detonate url
is_note_required: false
playbooks:
- playook: ''
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Validate indicator existance, reputation, detonation and determine if
Known APT, Commodity, Suspicous or Not Malicious?
'
id: 710b1249-88b4-4dfd-95cc-541cc688e1a3
name: Analyze network indicators and reputation
references:
- 3.2.3 Sources of Precursors and Indicators - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: "1. If Splunk present, run Splunk Query on each indictor and prevelence\
\ in the environment. Summarize # of times indicator seen in the last 24 hrs, 7\
\ days, 1 month, six months increments. Return the hosts that have used this indictor.\
\ (make an artifact for each host?)\n a. search -> ```| stats ...```\n1. Gather\
\ reputational, intelligence and general information regarding indicator into a\
\ note (a note for each indicator)\n1. Perform any additional research regarding\
\ indicators and understanding what normal behaviour is or should be by using using\
\ search engines, knowledge bases etc.\n1. Make a determination of indicator, Known\
\ APT, Commodity, Suspicous or Not Malicious and whether to tag to block indicator\n\
\ a. This should align to a severity change (Known APT = High, Commodity = Med,\
\ Suspicous = Low, Not Malicious = Info)\n a. hange container and artifact severity\
\ and tag artifact & indicator(s) with blocked and determination tag\n"
response_tasks/playbooks/analyze_precursors_to_the_event.yml
-41
View File
@@ -1,41 +0,0 @@
author: ButterCup, Splunk
automation:
actions: null
is_note_required: false
playbooks:
- playook: null
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-04-21'
description: 'Review precursor and indicator data and try to prove the data observed
is normal activity. This analysis is provided by reviewing additional logs and sources
to include ids''s, siem, network logs, host and host application event logs and
vulnerabiltiy information. This is not an exhaustive list, but a summary of the
data available. Data available should be aligned the type of event and resources
available to the customer.
'
id: ef9e7a25-73f0-4b63-b43b-2f4171518931
name: Analyze precursors to the event
references:
- 3.2.3 Sources of Precursors and Indicators - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
requirements: null
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: '1. Depending the attack vector, use your siem or logging collector to find
logs regarding the host, application and network connections surrounding the event
detected.
2. Identify evidence information that proves the incident occurred as detected or
corraborates the event(s).
3. Perform research regarding indicators and understanding what normal behaviour
is or should be by using using search engines, knowledge bases etc.
'
response_tasks/playbooks/analyze_url_indicator_and_reputation.yml
-46
View File
@@ -1,46 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- whois domain
- domain reputation
- url reputation
- domain intelligence
- url intelligence
- hunt domain
- hunt url
- detonate url
is_note_required: false
playbooks:
- playook: ''
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Validate indicator existance, reputation, detonation and determine if
Known APT, Commodity, Suspicous or Not Malicious?
'
id: 65a23d95-7b5a-405c-b5bf-893983478d35
name: Analyze url indicator and reputation
references:
- 3.2.3 Sources of Precursors and Indicators - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: "This should be TLD domain and url combinations analysis.\n1. If Splunk\
\ present, run Splunk Query on each indictor and prevelence in the environment.\
\ Summarize # of times indicator seen in the last 24 hrs, 7 days, 1 month, six months\
\ increments. Return the hosts that have used this indictor. (make an artifact for\
\ each host?)\n a. search -> ```| stats ...```\n1. Gather reputational, intelligence\
\ and general information regarding indicator into a note (a note for each indicator)\n\
1. Perform any additional research regarding indicators and understanding what normal\
\ behaviour is or should be by using using search engines, knowledge bases etc.\n\
1. Make a determination of indicator, Known APT, Commodity, Suspicous or Not Malicious\
\ and whether to tag to block indicator\n a. This should align to a severity change\
\ (Known APT = High, Commodity = Med, Suspicous = Low, Not Malicious = Info)\n \
\ a. Change container and artifact severity and tag artifact & indicator(s) with\
\ blocked and determination tag\n"
response_tasks/playbooks/conduct_training.yml
-50
View File
@@ -1,50 +0,0 @@
author: ButterCup
automation:
action: null
is_note_required: false
playbook: ''
role: null
sla: null
sla_type: minutes
date: '2020-07-17'
description: Take training courses to gain relevant knowledge - Sharpen the saw.
id: df493538-e598-463b-8835-a109022c2968
name: Conduct training
references:
- ''
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: "We do not rise to the level of our expectations. We fall to the level of\
\ our training. - @atc_project\n> \u201CThe more that you read, the more things\
\ you will know. The more that you learn, the more places you\u2019ll go.\u201D\
\ \u2015 Dr. Seuss\nWe assume that you already have a strong technical background\
\ in fundamental disciplines \u2014 Networking, Operating Systems, and Programming.\n\
Here are some relevant training courses that will help you in the Incident Response\
\ activities:\n1. [Investigation Theory](https://chrissanders.org/training/investigationtheory/)\
\ by Chris Sanders. We recommend you to have it as a mandatory training for every\
\ member of your Incident Response team\n1. [SANS Digital Forensics & Incident Response](https://digital-forensics.sans.org/training/courses)\
\ trainings\n * SEC450: Blue Team Fundamentals: Security Operations and Analysis\
\ - https://www.sans.org/course/blue-team-fundamentals-security-operations-analysis.\
\ We recommend you to have it as a mandatory training for every member of your Incident\
\ Response team\n * SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling\
\ - https://www.sans.org/course/hacker-techniques-exploits-incident-handling We\
\ recommend you to have it as a mandatory training for every member of your Incident\
\ Response team\n * FOR500: Windows Forensic Analysis - https://www.sans.org/course/windows-forensic-analysis\n\
\ * FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics -\
\ https://www.sans.org/course/advanced-incident-response-threat-hunting-training\n\
\ * SEC503: Intrusion Detection In-Depth - https://www.sans.org/course/intrusion-detection-in-depth\n\
\ * FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident\
\ Response - https://www.sans.org/course/advanced-network-forensics-threat-hunting-incident-response\n\
\ * SEC560: Network Penetration Testing and Ethical Hacking - https://www.sans.org/course/network-penetration-testing-ethical-hacking\
\ OR Offensive Security trainings mentioned below\n * SEC599: Defeating Advanced\
\ Adversaries - Purple Team Tactics & Kill Chain Defenses - https://www.sans.org/course/defeating-advanced-adversaries-kill-chain-defenses\n\
1. [Offensive Security](https://www.offensive-security.com/courses-and-certifications/)\
\ trainings. We recommend [PWK](https://www.offensive-security.com/pwk-oscp/) by\
\ Offensive Security trainings are in the list because to fight a threat, you need\
\ to understand their motivation, tactics, and techniques.\nThe training above is\
\ a recommendation and certainly the size of the organization will depend on the\
\ amount of training possible.\n"
response_tasks/playbooks/confirm_incident.yml
-38
View File
@@ -1,38 +0,0 @@
author: ButterCup
automation:
actions:
- update event
is_note_required: false
playbooks:
- playook: Update TLP, attack vector, disposition and category of event
scm: local
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Upon analysis, determination of incident status is either confirmation,
suspicious, false positive or authorized exception. Update the event metadata and
process event as determined.
'
id: 994298f0-75fc-4c14-b044-9b81944d3a03
name: Confirm incident
references:
- 3.2.4 Incident Analysis - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
- 3.2.5 Incident Documentation - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
requirements: null
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: '1. Determine if confirmed, suspicious, a false positive, or authorized
exception event
2. Update TLP, attack vector, disposition and category of event
3. Proceed on the next task of prioritizing incident or lessons learned or escalate
for additional investigation
'
response_tasks/playbooks/contain_incident.yml
-38
View File
@@ -1,38 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- block ip
- block domain
- block url
- block process
- terminate process
- quarantine host
- quarantine device
is_note_required: false
playbooks:
- playook: quarantine device and block external network access
scm: community
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Use atomic indicators to block and contain malicious activity. Use host
and network protection tools to block, pause, drop, or quarantine affected machines.
'
id: 735335a5-7ac0-4bdf-b1d3-6f4a6767d02f
name: Contain Incident
references:
- 3.3.1 Choosing a Containment Strategy - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
requirements: null
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: '1. Determine the appropriate containment technique either with soft block
(localized blocking of a specific indictors) or hard block (regionalized blocking,
quarantine whole hosts, net blocks, etc) techniques
'
response_tasks/playbooks/create_follow-up_report.yml
-43
View File
@@ -1,43 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- update ticket
is_note_required: false
playbooks:
- playook: null
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Build an after actions report that discusses about what happened and
a timeline. Provide what went well and what improvements can be made, information
timeliness, steps or actions that might have delayed recovery, what information
was shared or could have been shared, any corrective actions that would have prevent
the incident, identify precursors and indicators should be watched for in the future
or tools that could be used to mitigate future incidents. Conduct an Incident Review
Meeting.
'
id: 69d25415-408f-462a-899f-9bc8eef8c299
name: Create follow-up report
references:
- 3.4.1 Lessons Learned - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: "1. Create a follow up report\n a. Exactly what happened, and at what times?\n\
\ b. How well did staff and management perform in dealing with the incident?\n\
\ c. Were the documented procedures followed? Were they adequate?\n d. What information\
\ was needed sooner?\n e. Were any steps or actions taken that might have inhibited\
\ the recovery?\n f. What would the staff and management do differently the next\
\ time a similar incident occurs?\n g. How could information sharing with other\
\ organizations have been improved?\n h. What corrective actions can prevent similar\
\ incidents in the future?\n i. What precursors or indicators should be watched\
\ for in the future to detect similar incidents?\n j. What additional tools or\
\ resources are needed to detect, analyze, and mitigate future incidents?\n2. Schedule\
\ and conduct a Incident Review Meeting with necessary leadership and incident response\
\ team\n"
response_tasks/playbooks/determine_if_an_incident_has_occurred.yml
-35
View File
@@ -1,35 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- set status
is_note_required: false
playbooks:
- playook: Accept event and assign owner
scm: local
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Review precursor and indicator data and try to prove the data observed
is normal activity. Knowledge of false positives detractors will support this assessment.
The object of this step is to remove confirmation bias and validate the detection
as a true positive and anomalous behavior.
'
id: 92ba5c50-717d-44e7-bb88-72bf6907ec83
name: Determine if an incident has occurred
references:
- 3.2.2 Signs of an Incident - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: 'Incident handlers are responsible for analyzing ambiguous, contradictory,
and incomplete symptoms to determine what has happened.
The process here is to remove bias and support investigation based on indicators
that validate compromise or violdation for continued investigation
'
response_tasks/playbooks/determine_incident_prioritization.yml
-57
View File
@@ -1,57 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- update container
is_note_required: false
playbooks:
- playook: Determine impact and effort
scm: local
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Determine Functional Impact of the Incident. Incidents targeting IT
systems typically impact the business functionality that those systems provide,
resulting in some type of negative impact to the users of those systems.
Determine Information Impact of the Incident. Incidents may affect the confidentiality,
integrity, and availability of the organizations information.
Determine Recoverability from the Incident. The size of the incident and the type
of resources it affects will determine the amount of time and resources that must
be spent on recovering from that incident.
'
id: 91f1c863-c080-4b3c-921c-e1ca1c0e7ae1
name: Determine Incident Prioritization
references:
- 3.2.6 Incident Prioritization - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: "1. Determine Functional Impact of the Incident. By determining,\n a.\
\ None | No effect to the organization\u2019s ability to provide all services\
\ to all users\n b. Low | Minimal effect; the organization can still provide\
\ all critical services to all users but has lost efficiency\n c. Medium | Organization\
\ has lost the ability to provide a critical service to a subset of system users\n\
\ d. High | Organization is no longer able to provide some critical services\
\ to any users\n2. Determine Information Impact of the Incident. Incidents may affect\
\ the confidentiality, integrity, and availability of the organization\u2019s information.\n\
\ a. None | No information was exfiltrated, changed, deleted, or\
\ otherwise compromised\n b. Privacy Breach | Sensitive personally identifiable\
\ information (PII) of taxpayers, employees, beneficiaries, etc. was accessed or\
\ exfiltrated\n c. Proprietary Breach | Unclassified proprietary information,\
\ such as protected critical infrastructure information (PCII), was accessed or\
\ exfiltrated\n d. Integrity Loss | Sensitive or proprietary information\
\ was changed or deleted\n3. Determine Recoverability from the Incident. The size\
\ of the incident and the type of resources it affects will determine the amount\
\ of time and resources that must be spent on recovering from that incident.\n \
\ a. Regular | Time to recovery is predictable with existing resources\n\
\ b. Supplemented | Time to recovery is predictable with additional resources\n\
\ c. Extended | Time to recovery is unpredictable; additional resources\
\ and outside help are needed\n d. Not Recoverable | Recovery from the incident\
\ is not possible (e.g., sensitive data exfiltrated and posted publicly); launch\
\ investigation\n"
response_tasks/playbooks/document_and_notify_of_incident.yml
-59
View File
@@ -1,59 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- create ticket
- create incident
- create case
- send email
is_note_required: false
playbooks:
- playook: Create case or merge with known case
scm: local
role: null
sla: null
sla_type: minutes
date: '2020-04-21'
description: 'At this point, incident responder should acquire, preserve, secure,
and document all evidence to the incident. This process will be continual through
the IR process. The incident responder should perform notification pursuant to the
organizational incident response policy and outlined procedures.
'
id: 3890e0b3-bb46-4b9b-8134-184dbe644a8a
name: Document and notify of incident
references:
- 3.2.5 Document Incident - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
- 3.2.7 Incident Notification - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: 'The reasond for reordering of the documentation of the incident was to
align documentation and incident notification into the same process flow.
1. The current status of the incident (new, in progress, forwarded for investigation,
resolved, etc.)
2. A summary of the incident
3. Indicators related to the incident
4. Other incidents related to this incident
5. Actions taken by all incident handlers on this incident
6. Chain of custody, if applicable
7. Impact assessments related to the incident
8. Contact information for other involved parties (e.g., system owners, system administrators)
9. list of evidence gathered during the incident investigation
10. Comments from incident handlers
11. Next steps to be taken (e.g., rebuild the host, upgrade an application).
'
response_tasks/playbooks/identify_additional_affected_hosts.yml
-50
View File
@@ -1,50 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- run query
- merge event
is_note_required: false
playbooks:
- playook: Merge event with case
scm: community
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Use indictors developed from the detection and analysis to find additional
hosts or potentially infected hosts. If found perform additional analysis to determine
root cause analysis and any additional indictors. If this is mass infection event,
immediate containment must be delayed until full understanding of the infection
is achieved.
'
id: 3d481dd1-4f30-4262-a846-78af6bdce11c
name: Identify additional affected hosts
references:
- 3.3.1 Choosing a Containment Strategy - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
- 3.3.2 Evidence Gathering and Handling - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
- NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response,
for additional information on preserving evidence
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: '1. For Host infections, use persistence mechanism, dropped filenames, paths,
hashs, accessed or collected files, links, network communications, network ports
and protocols, netwrok flow data points, etc
2. For phishing infections, use email addresses, domains, urls, file hashes, x-origin-ip
address, subject, etc
3. For Command and Control, use host communication, ports and protocols, application,
url patterns, dns queries, ping data, etc
4. Escalate to incident management team, if a massive incident to support incident
response.
5. Ensure all known event information and root cause of the event is known before
proceeding with containment
'
response_tasks/playbooks/identify_vunlerabilities.yml
-38
View File
@@ -1,38 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- scan host
- scan hosts
is_note_required: false
playbooks:
- playook: null
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Scan host(s) for vulnerabilities. Reverse engineer malware thru static
and dynamic means to determine any zero day vulnerabilities.
'
id: f28177ae-78de-43c9-8692-e972e8a0aa62
name: Identify vunlerabilities
references:
- 3.3.3 Identifying the Attacking Hosts - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
- NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response,
for additional information on preserving evidence
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: '1. Scan host(s) with infection and determine any vulnerabilities that can
remediate infection. (e.g. finding a SMB MS17-010 - Windows SMB Remote Code Execution
Vulnerability)
2. Identify any common vulnerabilities among the hosts infected
3. Reverse engineer malware for any zero day vulnerabilities.
'
response_tasks/playbooks/implement_additional_monitoring.yml
-35
View File
@@ -1,35 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- run query
is_note_required: false
playbooks:
- playook: ''
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-04-21'
description: 'Implement additional monitoring that reviews not only host/network containment
success. Monitor network blocks for additional hosts that might not have been identified.
Reassess containment as needed depending on any new information. If this is a mass
infection, it''s advised that a 24 no change process be implemented.
'
id: edb7867c-2e81-4356-a422-92781f4fa34c
name: Implement additional monitoring
references:
- 3.2.4 Incident Analysis - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
requirements: null
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: '1. Create additional monitoring for network and host detection for abnormal
activity to ensure containment is effective.
2. Re-investigate new hosts found but not on the containment list
'
response_tasks/playbooks/implement_recovery_monitoring.yml
-45
View File
@@ -1,45 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- run query
- unblock ip
- unblock domain
- unblock url
- unblock hash
- unblock process
- unquarantine device
- unquarantine host
- remove tag
is_note_required: false
playbooks:
- playook: null
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Newly recovered systems should have additional monitoring for any anomalies
or newly created incidents. Adding single host to a previously infected list for
a specified period will allow the incident responder to quickly assess a re-infection
or subsequent new infection. At this stage in recovery, you should be unquarantining
devices and removing any host blocks.
'
id: ecf89e9b-106a-46d1-b236-a2716f71d7ae
name: Implement recovery monitoring
references:
- 3.3.4 Eradication and Recovery - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: '1. Monitor restored systems for any new anomalies and ensure that operations
have been returned to normal
2. Begin to remove emergency blocks to permanent block and remediation alerts for
infected systems returning the network (e.g. laptops that were unreachable during
the incident)
'
response_tasks/playbooks/make_personnel_report_suspicious_activity.yml
-28
View File
@@ -1,28 +0,0 @@
author: ButterCup
automation:
action: null
is_note_required: false
playbook: null
role: null
sla: null
sla_type: minutes
date: '2020-04-21'
description: 'c
'
id: f83abcae-3734-45ff-99ef-b17eb937c057
name: Make personnel report suspicious activity
references:
- Organizational Acceptable Use Policy
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: 'Develop a simplified, company wide-known way to contact IR team in case
of suspicious activity on the user system.
Make sure that the personnel is aware of it, can and will use it.
'
response_tasks/playbooks/malware_hunt_and_contain.yml
-46
View File
@@ -1,46 +0,0 @@
author: Patrick Bareiss, Splunk
automation:
actions:
- file reputation
- hunt file
- get file
- block hash
- disable user
- logoff user
- shutdown system
- create ticket
is_note_required: false
playbooks:
- playook: malware_hunt_and_contain
scm: community
role: null
sla: null
sla_type: minutes
date: '2020-08-05'
description: Uses any presented filehash artifact sent to phantom and conducts a reputation
check, hunts for additional systems, blocks file hash with <=10 positive detections
and creates a ticket for follow up. Any hashes found with >10 positive hits, automatically
blockes the hashes, disables user accounts, logs off the user, shuts down the system
and finally creates a urgent ticket.
id: 1d7b437a-5114-4b94-a585-04c3362ba08f
name: Malware Hunt and Contain
references:
- https://github.com/phantomcyber/playbooks/blob/4.9/malware_hunt_and_contain.json
- https://github.com/phantomcyber/playbooks/blob/4.9/malware_hunt_and_contain.py
- https://github.com/phantomcyber/playbooks/blob/4.9/malware_hunt_and_contain.png
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 2
workflow: "1. Gets file reputation for every hash presented and filters hashes with\
\ >10 OR <=10 and >5 for positive hits\n2. Get the files that match and hunt the\
\ file hashes and return the system(s)/user(s) that have these files present\n3.\
\ If >10 then block hash, disable users, logoff user, shutdown system and create\
\ a ticket\n4. IF <=10 but >5 block hash, and create a ticket\nTicket template:\n\
\ Virus Detected on # devices\n Hashes submitted with detections: (list hashes)\n\
\ File was found on # of devices (list devices)\n This impacts at least # users:\
\ (list users)\n # of hashes were submitted for blocking: (list hashes)\n # of\
\ users were forced to logoff: (list users)\n # of user accounts were disabled:\
\ (list users)\n # of systems were shutdown: (list systems)\n"
response_tasks/playbooks/mitigate_or_remediate_any_vulnerabilities.yml
-55
View File
@@ -1,55 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- patch host
- deploy patch
- run job
- execute program
- run script
- execute action
is_note_required: false
playbooks:
- playook: null
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Apply mitigations or remediate any known affecting vulnerabilities that
linked to the incidents. (e.g. SMB MS17-010 - Windows SMB Remote Code Execution
Vulnerability). Mitigations are controls that block and lower the risk, but don''t
remove the vulnerability. Remediation is patching and removing the risk known vulnerability
from being exploited.
'
id: 70362de1-bfef-4a0f-893f-3e0d605ed9b7
name: Mitigate or remediate any vulnerabilities
references:
- 3.3.4 Eradication and Recovery - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
requirements: null
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: '1. Apply remediations (e.g. patches) to infected and not infected hosts
that pertain to the vulnerability found being used by the incident (remove the risk).
Identify and fix any systems not accepting or validating the patch (e.g. needing
reboots) as soon as possible.
2. This may require scheduling due to business needs. In a mass incident, emergency
change requests can be used to support patching. In single instance events, the
risk to outage vs the risk to mitigate may be acceptable. If acceptable, then move
remediations to lessons learned processing before closing out the request. Put
in place, mitigations for at least detections and if possible protection rules to
minimize impact while remediation is being scheduled.
3. Apply mitigations such as IPS and host based firewall rules to mitigate (reduce
the risk) of the vulnerability being exploited for at least detection to notify
when occurring and if containment and eradication has failed.
4. Monitor detections to ensure containment is working and determine when eradication
is beginning to be effective.
'
response_tasks/playbooks/practice_real_world_events.yml
-26
View File
@@ -1,26 +0,0 @@
author: ButterCup
automation:
action: null
is_note_required: false
playbook: null
role: null
sla: null
sla_type: minutes
date: '2020-07-17'
description: Practice in the real environment. Sharpen Response skills within your
organization by simulating real world with training exercises within your organization.
id: 97d00b14-dd01-47e4-b7eb-0a82f4998c4e
name: Practice Real World Events
references:
- 3.1 Preparation - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: Make sure that the response actions have been performed during an internal
exercise by your Incident Response Team. You need to make sure that when an Incident
happens, the team understands the how and this is not the first time they have seen
the tasks. This is best done by being able to execute the actual steps in **your
environment**, i.e. blocking an IP address or a domain name.
response_tasks/playbooks/prepare_for_incident_handling.yml
-98
View File
@@ -1,98 +0,0 @@
author: ButterCup, Splunk
automation:
action: null
is_note_required: false
playbook: ''
role: null
sla: null
sla_type: minutes
date: '2020-07-17'
description: 'The lists in the workflow below provide examples of tools and resources
available that may be of value during incident handling. These lists are intended
to be a starting point for discussions about which tools and resources an organizations
incident handlers need.
'
id: 91d4566e-a292-4f0a-b894-dde23bde3f08
name: Prepare for incident handling
references:
- 3.1.1 Preparing to Handle Incidents - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: '## Incident Handler Communications and Facilities:
* Contact information for team members and others within and outside the organization
(primary and backup contacts), such as law enforcement and other incident response
teams; information may include phone numbers, email addresses, public encryption
keys (in accordance with the encryption software described below), and instructions
for verifying the contacts identity
* On-call information for other teams within the organization, including escalation
information
* Incident reporting mechanisms, such as phone numbers, email addresses, online
forms, and secure instant messaging systems that users can use to report suspected
incidents; at least one mechanism should permit people to report incidents anonymously
* Issue tracking system for tracking incident information, status, etc.
* Smartphones to be carried by team members for off-hour support and onsite communications
* Encryption software to be used for communications among team members, within the
organization and with external parties; for Federal agencies, software must use
a FIPS-validated encryption algorithm20
* War room for central communication and coordination; if a permanent war room is
not necessary or practical, the team should create a procedure for procuring a temporary
war room when needed
* Secure storage facility for securing evidence and other sensitive materials
## Incident Analysis Hardware and Software
* Digital forensic workstations21 and/or backup devices to create disk images, preserve
log files, and save other relevant incident data
* Laptops for activities such as analyzing data, sniffing packets, and writing reports
* Spare workstations, servers, and networking equipment, or the virtualized equivalents,
which may be used for many purposes, such as restoring backups and trying out malware
* Blank removable media
* Portable printer to print copies of log files and other evidence from non-networked
systems
* Packet sniffers and protocol analyzers to capture and analyze network traffic
* Digital forensic software to analyze disk images
* Removable media with trusted versions of programs to be used to gather evidence
from systems
* Evidence gathering accessories, including hard-bound notebooks, digital cameras,
audio recorders, chain of custody forms, evidence storage bags and tags, and evidence
tape, to preserve evidence for possible legal actions
## Incident Analysis Resources:
* Port lists, including commonly used ports and Trojan horse ports
* Documentation for OSs, applications, protocols, and intrusion detection and antivirus
products Network diagrams and lists of critical assets, such as database servers
* Current baselines of expected network, system, and application activity
* Cryptographic hashes of critical files22 to speed incident analysis, verification,
and eradication
## Incident Mitigation Software:
* Access to images of clean OS and application installations for restoration and
recovery purposes
'
response_tasks/playbooks/preventing_incidents.yml
-54
View File
@@ -1,54 +0,0 @@
author: ButterCup, Splunk
automation:
action: null
is_note_required: false
playbook: ''
role: null
sla: null
sla_type: minutes
date: '2020-07-17'
description: Keeping the number of incidents reasonably low is very important to protect
the business processes of the organization. It is outside the scope of this document
to provide specific advice on securing networks, systems, and applications. Although
incident response teams are generally not responsible for securing resources, they
are advocates of sound security practices. An incident response team should identify
problems that the organization is otherwise not aware of and play a key role in
risk assessment and training by identifying gaps.
id: 5b7c5d18-6598-412b-a4f1-e66e92890503
name: Preventing Incidents
references:
- 3.1.2 Prevent Incidents - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: "The following:\n* Risk Assessments. Periodic risk assessments of systems\
\ and applications should determine what allowing staff to emphasize monitoring\
\ and response activities for those resources.\n* Host Security. All hosts should\
\ be hardened appropriately using standard configurations. In addition to keeping\
\ each host properly patched, hosts should be configured to follow the principle\
\ of least privilege\u2014granting users only the privileges necessary for performing\
\ their authorized tasks. Hosts should have auditing enabled and should log significant\
\ security-related events. The security of hosts risks are posed by combinations\
\ of threats and vulnerabilities.\n* Applicable threats, including organization-specific\
\ threats. Each risk should be prioritized, and the risks can be mitigated, transferred,\
\ or accepted until a reasonable overall level of risk is reached. Another benefit\
\ of conducting risk assessments regularly is that critical resources are identified,\
\ Content Automation Protocol (SCAP) expressed operating system and application\
\ configuration and their configurations should be continuously monitored. checklists\
\ to assist in securing hosts consistently and effectively.\n* Network Security.\
\ The network perimeter should be configured to deny all activity that is not expressly\
\ permitted. This includes securing all connection points, such as virtual private\
\ networks (VPNs) and dedicated connections to other organizations.\n* Malware Prevention.\
\ Software to detect and stop malware should be deployed throughout the organization.\
\ Malware protection should be deployed at the host level (e.g., server and workstation\
\ operating systems), the application server level (e.g., email server, web proxies),\
\ and the application\n* User Awareness and Training. Users should be made aware\
\ of policies and procedures regarding appropriate use of networks, systems, and\
\ applications. Applicable lessons learned from previous incidents should also be\
\ shared with users so they can see how their actions could affect the organization.\
\ Improving user awareness regarding incidents should reduce the frequency of incidents.\
\ IT staff should be trained so that they can maintain their networks, systems,\
\ and applications in accordance with the organization\u2019s security standards.\n"
response_tasks/playbooks/provide_lessons_learned_tasks_or_changes.yml
-35
View File
@@ -1,35 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- create ticket
is_note_required: false
playbooks:
- playook: Create false-positve reduction service request
scm: local
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Create any tasks or service requests based on the recommendations of
the review of the incident or with the process flow from alert detection to provide
feedback from false positives.
'
id: 43fc5e87-d819-460a-a740-de2066b18a29
name: Provide lessons learned tasks or changes
references:
- 3.4.1 Lessons Learned - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
requirements: null
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: '1. Create service requests or documentation updates from the results of
the review of the followup report and incident review meeting
2. Create service request for updating alert detection from feedback from false
positives
'
response_tasks/playbooks/raise_personnel_awareness.yml
-24
View File
@@ -1,24 +0,0 @@
author: ButterCup, Splunk, @atc_react
automation:
action: null
is_note_required: false
playbook: null
role: null
sla: null
sla_type: minutes
date: '2020-07-17'
description: Raise personnel awareness regarding phishing, ransomware, social engineering,
and other attacks that involve user interaction
id: 145a82b5-cafd-468e-b487-737fdf13d6a4
name: Raise personnel awareness
references:
- https://attack.mitre.org/mitigations/M1017/
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: Train users to be aware of access or manipulation attempts by an adversary
to reduce the risk of successful spearphishing, social engineering, and other techniques
that involve user interaction.
response_tasks/playbooks/remove_malicious_content.yml
-46
View File
@@ -1,46 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- create ticket
- deploy patch
- run script
- add tag
- execute action
- execute program
is_note_required: false
playbooks:
- playook: null
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Remove malicious content. There are multiple ways to accomplish this.
Depending on the maturity and size of the incident, this can be as simple as re-imaging
a single system to full remediation via a deployable package from your antivirus
vendor or removal of offending file via your enterprise detection and response (EDR)
tool. Network attacks external to your environment will need to be managed with
the support of your ISP. Internal attacks should be segmented for containment and
then removing offending systems or malicious content from those offending systems.
'
id: 26cd22c6-4b67-4dc5-b8d1-f5ef9b5d8226
name: Remove malicious content
references:
- 3.3.4 Eradication and Recovery - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
requirements: null
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: '1. Determine the correct approach based on maturity and size of the incident
2. Employ eradication and monitor the process to ensure the system does not get
re-infected. Reinfection is an indication that your containment measures are inadequate
to stop the incident.
3. Apply any new gold image with up to date patches on re-imaged systems.
'
response_tasks/playbooks/restore_systems_to_operational_status.yml
-44
View File
@@ -1,44 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- create ticket
is_note_required: false
playbooks:
- playook: Create a service request for re-image
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Depending on the sized of the incident, reimaging systems maybe a viable
eradication and recovery process combined. Once restored to gold image (standardized
corporate image) with immediate patching and updating of all known vulnerabilities.
Create a service request for the Help Desk to re-image the host. Server or network
equipment should be baselined and restored by the owning team.
'
id: bb515cf6-40b5-4005-af04-6f63439df7b4
name: Restore systems to operational status
references:
- 3.3.4 Eradication and Recovery - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
requirements: null
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: '1. Create a request for re-imaging system for eradication and recovery.
Re-imaging will not be possible in a mass incident.
2. For mass incidents, provide immediate patching and reporting of non-compliant
patching or antivirus removal tools. Thorough forensic and reverse malware engineering
will provide the necessary details to minimize complete recovery processes.
3. Do not restore localized customer files (/home/user, or /User/<username>), but
only on a case by case basis and thorough review of the files being restored.
4. If the eradication process isn''t reducing the number of infected hosts, eradication
is missing a persistence mechanism or containment has failed.
'
response_tasks/playbooks/suspicious_email_attachment_investigate_and_delete.yml
-34
View File
@@ -1,34 +0,0 @@
author: Philip Royer, Splunk
automation:
actions:
- set status
is_note_required: false
playbooks:
- playook: suspicious_email_attachment_investigate_and_delete
scm: community
role: null
sla: null
sla_type: minutes
date: '2019-06-03'
description: 'Investigate an email with a suspicious file attachment detected by Splunk
Enterprise Security. Detonate the file attachment in a sandbox, gather network behavior
from the sandbox results, and pivot on those network indicators with both external
reputation queries and internal Splunk Common Information Model searches. After
confirming the results with an analyst prompt, delete the email from the user''s
inbox, hopefully before they have opened it.
'
id: 3096f721-8842-42ce-2fc7-742d8372b712
name: Suspicious Email Attachment Investigate and Delete
references:
- ''
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: 'Synchronize the community playbook repository in Phantom, then open the
playbook and follow the deployment notes to configure it for your environment.
'
response_tasks/playbooks/validate_hosts_eradicated.yml
-44
View File
@@ -1,44 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- run query
is_note_required: false
playbooks:
- playook: null
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Confirm and acknowledge eradication steps are working as expected and
number of infected host(s) is dropping. Validation here will allow the incident
responder to move to recovery phase. If single instance, validate the reimage process
was completed by validating new image creation date. (win - ''systeminfo | find
Original'''', linux - ''ls -ld /var/log/installer'', macOS - /var/log/install.log.#
(oldest))
'
id: b678705c-12a6-428b-a631-ed579332bc99
name: Validate hosts eradicated
references:
- 3.3.4 Eradication and Recovery - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
requirements: null
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: "1. If single instance, validate the reimage process was completed by validating\
\ new image creation date.\n a. win - 'systeminfo | find Original''\n b. linux\
\ - 'ls -ld /var/log/installer'\n c. macOS - /var/log/install.log.# (oldest))\n\
2. If this host has been reinfected more than once, conduct a formal forensic review\
\ to ensure all malicious content has been removed.\n2. If mass incident follows\
\ steps 2-5, determine if the number of infected host is reducing\n3. Determine\
\ if the number of (re)infected host is increasing\n4. If the eradication process\
\ isn't reducing the number of infected hosts, eradication is missing an persistence\
\ mechanism or containment has failed\n5. If the eradication process shows new hosts\
\ are being infected, your containment process is failing and/or the incident has\
\ mutated. (e.g. polymorphic malware with a active vulnerability or actor changed\
\ tactics and is now using ping for command and control and uploaded new malware).\
\ If this occurs return to Detection and Analysis Phase and continue forensic analysis.\n"
response_tasks/playbooks/validate_restored_hosts.yml
-34
View File
@@ -1,34 +0,0 @@
author: ButterCup, Splunk
automation:
actions:
- run query
is_note_required: false
playbooks:
- playook: null
scm: null
role: null
sla: null
sla_type: minutes
date: '2020-07-30'
description: 'Validate each reimaged system was completed by validating new image
creation date. ** win: systeminfo | find Original ** linux: ls -ld /var/log/installer
** macOS: /var/log/install.log.# (oldest date of entry). If more surgical, antivirus
package or enterprise detection and response removal process has successfully completed
and system is showing no signs of indicators of the incident.
'
id: 8218bcf6-739b-4f76-8952-eb133480ad8d
name: Validate restored hosts
references:
- 3.3.4 Eradication and Recovery - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
tags:
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: "1. If single instance, validate the reimage process was completed by validating\
\ new image creation date\n a. win - 'systeminfo | find Original''\n b. linux\
\ - 'ls -ld /var/log/installer'\n c. macOS - /var/log/install.log.# (oldest))\n\
2. Review existing monitoring to ensure host is working as expected and within normal\
\ parameters\n"
responses/NIST_800-61r2_response_plan.yml
-37
View File
@@ -1,37 +0,0 @@
author: ButterCup
date: '2020-04-21'
description: Response plan built for the NIST framework described in NIST 800-61r2
(https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf)
id: b974f8bb-2999-4480-94ef-8a90029b8759
is_note_required: false
name: NIST 800-61r2 Response Plan
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
response_phase:
- preparation_nist:
- id: d360707d-9214-4449-b15d-9d3cf134209a
name: Preparation
- detection_analysis:
- id: a6eec2aa-3ec8-4f16-9c09-b8537873047d
name: Detection and Analysis
- contain_eradicate_recover:
- id: 838ad8e8-1701-4829-be89-51a997fd9852
name: Contain Eradicate Recover
- post_incident:
- id: 001209bc-2f94-4dc7-b21e-9598c41eaa80
name: Post Incident
tags:
analytics_story: all
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: Organizations should use this response plan as template to define the processes
for their security operations teams. With this as the template and then customizing
the response plan around attack vectors. Organizations can fashion a framework for
thier response procedures. Response plans and response procedures are different
in the setting that procedures should have the actual step-by-step actions vs an
response plan that discuses and deomonstrates actions without specifcs and aligns
to the policy. > Preparation should not be imported into response tools that support
ingestion (hive, phantom, xsoar, etc).
responses/NIST_PICERL_response_plan.yml
-45
View File
@@ -1,45 +0,0 @@
author: ButterCup, Splunk
date: '2020-04-21'
description: NIST incident response process that follows PICERL (https://www.sans.org/media/score/504-incident-response-cycle.pdf)
id: 8a7ea67a-dd53-468e-aeef-b75aed0a877c
is_note_required: false
name: NIST PICERL Response Plan
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
- https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901
response_phase:
- preparation:
- id: d360707d-9214-4449-b15d-9d3cf134209a
name: Preparation
- identification:
- id: 6cdd56ba-5ffd-46a9-9dde-d25ce755c100
name: Identification
- containment:
- id: 5d790fae-8ba6-4fc9-b288-78b67ef8370c
name: Containment
- eradication:
- id: d3b80e0e-4e85-4259-a13c-69ef20987e1c
name: Eradication
- recovery:
- id: cae4dcdb-f81b-45ec-b0d6-a00cec468e9a
name: Recovery
- lessons_learned:
- id: 001209bc-2f94-4dc7-b21e-9598c41eaa80
name: Post-Incident Activities
tags:
analytics_story:
- Credential Dumping
- Ransomeware
nist: RS.RP
product:
- Splunk Phantom
type: response
version: 1
workflow: Organizations should use this response plan as template to define the processes
for their security operations teams. With this as the template and then customizing
the response plan around attack vectors. Organizations can fashion a framework for
thier response procedures. Response plans and response procedures are different
in the setting that procedures should have the actual step-by-step actions vs an
response plan that discuses and deomonstrates actions without specifcs and aligns
to the policy. Preparation should not be imported into response tools that support
ingestion (hive, phantom, xsoar, etc).
responses/credential_dumping_attack.yml
-25
View File
@@ -1,25 +0,0 @@
author: Patrick Bareiss, Splunk
date: '2020-07-16'
description: This response workflow guide you through the investigation of a credential
dumping attack.
id: 570dd98e-6cab-443c-bdd8-3dbb5fe4188d
name: Credential Dumping Attack
response_phase:
- identification:
- id: c5506139-ef86-4cd9-8535-0512aa732e79
name: Process Chain Analysis
- id: 6ee5c067-8228-4926-abb2-54f2c59d726e
name: Analyze Malicious File
- id: 1d7b437a-5114-4b94-a585-04c3362ba08f
name: Malware Hunt and Contain
- containment:
- id: 60c4cfa5-81b7-44e2-9ad4-71524e4a3e78
name: Quarantaine Infected Host
tags:
analytics_story: Credential Dumping
product:
- Splunk Phantom
type: response
version: 2
workflow: This workbook provides you a guide on how to investigate credential dumping
with some automation to make data collection easier.

Some files were not shown because too many files have changed in this diff Show More