From abd4eb99ea48e744ea72d693da3d034a00baed66 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 30 Mar 2022 13:58:23 +0200 Subject: [PATCH] pwh_xml_2 --- ...uthentication_flag_disabled_with_powershell.yml | 14 ++++++++------ .../endpoint/powershell_execute_com_object.yml | 14 ++++++++------ .../recon_avproduct_through_pwh_or_wmi.yml | 14 ++++++++------ ...on_flag_disabled_in_useraccountcontrol.test.yml | 8 ++++---- .../powershell_execute_com_object.test.yml | 8 ++++---- .../recon_avproduct_through_pwh_or_wmi.test.yml | 8 ++++---- 6 files changed, 36 insertions(+), 30 deletions(-) diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml index d874ea67e3..b818f6cb86 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml @@ -1,7 +1,7 @@ name: Kerberos Pre-Authentication Flag Disabled with PowerShell id: 59b51620-94c9-11ec-b3d5-acde48001122 -version: 1 -date: '2022-02-23' +version: 2 +date: '2022-03-22' author: Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -15,9 +15,11 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev against the user's password offline leveraging the ASP REP Roasting technique. Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor or a way to escalate privileges. -search: ' `powershell` EventCode=4104 (Message = "*Set-ADAccountControl*" AND Message="*DoesNotRequirePreAuth:$true*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`' +search: '`powershell` EventCode=4104 (ScriptBlockText = "*Set-ADAccountControl*" AND ScriptBlockText="*DoesNotRequirePreAuth:$true*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -37,7 +39,7 @@ tags: - Stage:Privilege Escalation - Stage:Persistence dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell-xml.log impact: 50 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 09503bf1d2..0d3b2abaa9 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -1,7 +1,7 @@ name: Powershell Execute COM Object id: 65711630-f9bf-11eb-8d72-acde48001122 -version: 1 -date: '2021-08-10' +version: 2 +date: '2022-03-22' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -11,10 +11,11 @@ description: This search is to detect a COM CLSID execution through powershell. it has a feature to execute command using COM Object. This technique may use by network operator at some cases but a good indicator if some application want to gain privilege escalation or bypass uac. -search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeFromCLSID*" - OR Message = "*CreateInstance([Type]::GetTypeFromProgID*"| stats count min(_time) - as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `powershell_execute_com_object_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*CreateInstance([type]::GetTypeFromCLSID*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_execute_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -31,6 +32,7 @@ tags: - Source:Endpoint - Stage:Privilege Escalation dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-powershell.log impact: 10 kill_chain_phases: diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index 3400ba0c25..dcb431e5ce 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -1,7 +1,7 @@ name: Recon AVProduct Through Pwh or WMI id: 28077620-c9f6-11eb-8785-acde48001122 -version: 1 -date: '2021-06-10' +version: 2 +date: '2022-03-22' author: Teoderick Contreras, Splunk type: TTP datamodel: [] @@ -11,10 +11,11 @@ description: The following analytic identifies suspicious PowerShell script exec adversary will map all running security applications or services. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. -search: '`powershell` EventCode=4104 (Message = "*SELECT*" OR Message = "*WMIC*") - AND (Message = "*AntiVirusProduct*" OR Message = "*AntiSpywareProduct*") | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 (ScriptBlockText = "*SELECT*" OR ScriptBlockText = "*WMIC*") + AND (ScriptBlockText = "*AntiVirusProduct*" OR ScriptBlockText = "*AntiSpywareProduct*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -35,6 +36,7 @@ tags: - Source:Endpoint - Stage:Discovery dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1592/pwh_av_recon/windows-powershell-xml.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log impact: 70 kill_chain_phases: diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml index df1569133d..afa7a12165 100644 --- a/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml +++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog + - file_name: windows-powershell-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/powershell_execute_com_object.test.yml b/tests/endpoint/powershell_execute_com_object.test.yml index 2dd500d007..83528a51eb 100644 --- a/tests/endpoint/powershell_execute_com_object.test.yml +++ b/tests/endpoint/powershell_execute_com_object.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: windows-powershell-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/recon_avproduct_through_pwh_or_wmi.test.yml b/tests/endpoint/recon_avproduct_through_pwh_or_wmi.test.yml index 1e0e5f1384..270a5c5f93 100644 --- a/tests/endpoint/recon_avproduct_through_pwh_or_wmi.test.yml +++ b/tests/endpoint/recon_avproduct_through_pwh_or_wmi.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: windows-powershell-xml.log + data: hhttps://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1592/pwh_av_recon/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog