diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml index aa06b00b6b..c5a2018122 100644 --- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -19,7 +19,6 @@ description: 'The following analytic identifies one source endpoint failing to a search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address - | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml index 7fbeac2028..f9174af1e8 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -16,7 +16,7 @@ description: 'The following analytic identifies one source endpoint failing to a This detection will trigger on the domain controller against which the offending host performs the password spraying attack.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` ventCode=4768 Result_Code=0x6 Account_Name!="*$" +search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml index 97ca62f526..fc2f77eec8 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -19,7 +19,6 @@ description: 'The following analytic identifies one source endpoint failing to a search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation - | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml index 5a3e5edcf3..b38b5c51b5 100644 --- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml @@ -21,7 +21,6 @@ search: ' `wineventlog_security` EventCode=4648 | eval Destination_Account = mvindex(Account_Name, 1) | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account - | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index 66c41bb90e..eb32507ef5 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -19,7 +19,6 @@ description: 'The following analytic identifies one source endpoint failing to a search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address - | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml index 8e2835b68e..afa6e2a696 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -19,7 +19,6 @@ description: 'The following analytic identifies one source endpoint failing to a search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation - | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml index f5f62f07cc..467c16f5e3 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml @@ -21,7 +21,6 @@ search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name) as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName - | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml index 17d8f4ed7a..70ffd512a2 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml @@ -21,7 +21,6 @@ search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Addr | eval Destination_Account = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts) as global_avg , stdev(unique_accounts) as global_std - | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1