admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2101 from splunk/ssa_minorfix_v2

Browse Source 
ssa_minor_fix
This commit is contained in:
Bhavin Patel
2022-03-24 11:55:01 -07:00
committed by GitHub
parent 4e24dc73ff e31c0b6481
commit ab91a08142
2 changed files with 28 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___delete_a_net_user.yml
+12 -11
View File
@@ -1,7 +1,7 @@
name: Delete A Net User
id: 8776d79c-d26e-11eb-9a56-acde48001122
version: 3
date: '2021-11-30'
version: 4
date: '2022-03-17'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
@@ -12,16 +12,17 @@ description: This analytic will detect a suspicious net.exe/net1.exe command-lin
user or deleting adversaries tracks created during its lateral movement additional
systems. During triage, review parallel processes for additional behavior. Identify
any other user accounts created before or after.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
process=lower(ucast(map_get(input_event, "process"), "string", null)),
process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
process_path=ucast(map_get(input_event, "process_path"), "string",null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",null),
event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where process IS NOT NULL AND like(process, "%/delete%") AND like(process, "%user%") AND (process_name="net1.exe" OR process_name="net.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
"string", null)), body=create_map(["event_id", event_id, "process", process, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+16 -14
View File
@@ -1,7 +1,7 @@
name: Modify ACLs Permission Of Files Or Folders
id: 9ae9a48a-cdbe-11eb-875a-acde48001122
version: 2
date: '2021-11-30'
version: 3
date: '2022-03-17'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
@@ -12,19 +12,21 @@ description: This analytic identifies suspicious modification of ACL permission
is commonly configured by the file or directory owner with appropriate permission.
This behavior raises suspicion if this command is seen on an endpoint utilized by
an account with no permission to do so.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line,
/(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe"
OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
process=ucast(map_get(input_event, "process"), "string", null),
process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where process IS NOT NULL AND NOT like(process, "%:\\Windows\\QG\\ServiceNow%") AND like(process, "%/g%")
| where (match_regex(process, /(?i)everyone:/)=true OR match_regex(process, /(?i)SYSTEM:/)=true OR match_regex(process, /(?i)S-1-1-0:/)=true)
| where (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
body=create_map(["event_id", event_id, "process", process, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the