Merge branch 'develop' into lolbas-fixes

automated_detection_testing/requirements.txt

@@ -1,4 +1,4 @@
-ansible==2.9.2
+ansible==2.10.1
 ansible-runner==1.4.6
 apipkg==1.5
 aspy.yaml==1.3.0
@@ -6,15 +6,15 @@ atomicwrites==1.4.0
 attackcti==0.3.3
 attrs==19.3.0
 bcrypt==3.2.0
-boto3==1.15.18
-botocore==1.18.18
+boto3==1.16.0
+botocore==1.19.0
 certifi==2019.11.28
-cffi==1.13.2
+cffi==1.14.3
 cfgv==2.0.1
 chardet==3.0.4
 configparser==4.0.2
 contextlib2==0.6.0.post1
-cryptography==2.8
+cryptography==3.1.1
 Deprecated==1.2.10
 dnspython==2.0.0
 docutils==0.16
@@ -25,20 +25,20 @@ identify==1.4.10
 idna==2.8
 importlib-metadata==1.3.0
 Jinja2==2.10.3
-jmespath==0.9.4
+jmespath==0.10.0
 lockfile==0.12.2
 MarkupSafe==1.1.1
 mock==4.0.2
 more-itertools==8.0.2
-mysql-connector-python==8.0.21
+mysql-connector-python==8.0.22
 nodeenv==1.3.4
 ntlm-auth==1.5.0
-packaging==19.2
+packaging==20.4
 packer.py==0.3.0
 paramiko==2.7.2
 path==15.0.0
 path.py==12.5.0
-pexpect==4.7.0
+pexpect==4.8.0
 pluggy==0.13.1
 pre-commit==1.21.0
 protobuf==3.13.0
@@ -61,12 +61,12 @@ requests-ntlm==1.1.0
 s3transfer==0.3.3
 six==1.13.0
 smmap==3.0.4
-splunk-sdk==1.6.12
-tabulate==0.8.6
+splunk-sdk==1.6.14
+tabulate==0.8.7
 termcolor==1.1.0
 toml==0.10.0
-urllib3==1.25.7
-virtualenv==16.7.9
+urllib3==1.25.11
+virtualenv==20.0.35
 wcwidth==0.2.5
 wget==3.2
 wrapt==1.12.1

detections/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml

@@ -0,0 +1,23 @@
+author: "Rod Soto, Splunk"
+date: "2020-10-09"
+description: "This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges at different projects depending on organization schema."
+how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
+id: 27af8c15-38b0-4408-b339-920170724adb
+known_false_positives: "Accounts with high risk roles should be reduced to the minimum number needed, however specific tasks and setups may be simply expected behavior within organization"
+name: GCP Detect accounts with high risk roles by project
+references:
+  - https://github.com/dxa4481/gcploit
+  - https://www.youtube.com/watch?v=Ml09R38jpok
+  - https://cloud.google.com/iam/docs/understanding-roles
+search: "`google_gcp_pubsub_message` data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project_filter`"
+tags:
+  analytics_story:
+  - GCP Cross Account Activity
+  asset_type: "GCP Account"
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1078
+  security_domain: threat
+type: ESCU
+version: 1

detections/cloud/gcp_detect_gcploit_framework.yml

@@ -0,0 +1,22 @@
+author: "Rod Soto, Splunk"
+date: "2020-10-08"
+description: "This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts."
+how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
+id: a1c5a85e-a162-410c-a5d9-99ff639e5a52
+known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects"
+name: GCP Detect gcploit framework
+references:
+  - https://github.com/dxa4481/gcploit
+  - https://www.youtube.com/watch?v=Ml09R38jpok
+search: "`google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework_filter`"
+tags:
+  analytics_story:
+  - GCP Cross Account Activity
+  asset_type: "GCP Account"
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1078
+  security_domain: threat
+type: ESCU
+version: 1

detections/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml

@@ -0,0 +1,23 @@
+author: "Rod Soto, Splunk"
+date: "2020-10-09"
+description: "This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts to move laterally and escalate privileges."
+how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
+id: 2e70ef35-2187-431f-aedc-4503dc9b06ba
+known_false_positives: "High risk permissions are part of any GCP environment, however it is important to track resource and accounts usage, this search may produce false positives."
+name: GCP Detect high risk permissions by resource and account
+references:
+  - https://github.com/dxa4481/gcploit
+  - https://www.youtube.com/watch?v=Ml09R38jpok
+  - https://cloud.google.com/iam/docs/permissions-reference
+search: "`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account_filter`"
+tags:
+  analytics_story:
+  - GCP Cross Account Activity
+  asset_type: "GCP Account"
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1078
+  security_domain: threat
+type: ESCU
+version: 1

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml

@@ -17,12 +17,15 @@ search: '
        dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
        dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
 | where process_name="cmd.exe" OR process_name="reg.exe"
-| where cmd_line LIKE "%save%" AND
-        (match_regex(cmd_line, /(?i)HKLM\\System/)=true OR
-        match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true
-        OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
-        OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true
-        OR match_regex(cmd_line, /(?i)HKLM\\Security/)=true)
+| where cmd_line != null  AND 
+        match_regex(cmd_line, /(?i)save\s+/)=true AND
+        ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR
+          match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR
+          match_regex(cmd_line, /(?i)HKLM\\System/)=true OR
+          match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR
+          match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR
+          match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true 
+        )
 | eval start_time = timestamp,
 end_time = timestamp,
 entities = mvappend(dest_device_id, dest_user_id),

detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml

@@ -16,7 +16,7 @@ process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
 timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
 process=lower(ucast(map_get(input_event, "process"), "string", null))
 | where process_name LIKE "%rundll32.exe%"
-AND match_regex(process, /(?i)comsvcs.dll MiniDump/)=true
+AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
 | eval start_time = timestamp,
        end_time = timestamp,
        entities = mvappend(machine),

requirements.txt

@@ -37,6 +37,6 @@ stix2-patterns==1.3.1
 taxii2-client==2.2.2
 toml==0.10.1
 typing==3.7.4.3
-urllib3==1.25.10
-virtualenv==20.0.33
+urllib3==1.25.11
+virtualenv==20.0.35
 zipp==3.3.1