admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inAllow File And Printing Sharing In Firewall

Browse Source
This commit is contained in:
root
2021-06-24 09:27:04 +00:00
parent 66452f52c8
commit aecddd31b1
1 changed files with 21 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+21 -16
View File
@@ -6,20 +6,22 @@ author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect a suspicious modification of firewall to allow file and printer sharing.
This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*"
by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
description: This search is to detect a suspicious modification of firewall to allow
file and printer sharing. This technique was seen in ransomware to be able to discover
more machine connected to the compromised host to encrypt more files
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe
Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*"
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `allow_file_and_printing_sharing_in_firewall_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: network admin may modify this firewall feature that may cause this rule to be triggered.
known_false_positives: network admin may modify this firewall feature that may cause
this rule to be triggered.
references:
- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
@@ -37,12 +39,15 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
- Processes.dest
- Processes.user
- Processes.parent_process
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
- Processes.parent_process_name
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log