admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updating yamls

Browse Source
This commit is contained in:
Bhavin Patel
2024-09-17 13:34:11 +05:30
parent 503a142d5a
commit baeff72142
50 changed files with 1175 additions and 906 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/application/crushftp_server_side_template_injection.yml
+30 -12
View File
@@ -3,30 +3,48 @@ id: ccf6b7a3-bd39-4bc9-a949-143a8d640dbc
version: 1
date: '2024-05-16'
author: Michael Haag, Splunk
data_source:
data_source:
- CrushFTP
type: TTP
status: production
description: This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This severe vulnerability enables unauthenticated remote attackers to access and read files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary commands on the affected server. The issue impacts all versions of CrushFTP up to 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply patches immediately to prevent unauthorized access to the system and avoid potential data compromises. The search specifically looks for patterns in the raw log data that match the exploitation attempts, including READ or WRITE actions, and extracts relevant information such as the protocol, session ID, user, IP address, HTTP method, and the URI queried. It then evaluates these logs to confirm traces of exploitation based on the presence of specific keywords and the originating IP address, counting and sorting these events for further analysis.
search: '`crushftp`
| rex field=_raw "\[(?<protocol>HTTPS|HTTP):(?<session_id>[^\:]+):(?<user>[^\:]+):(?<src_ip>\d+\.\d+\.\d+\.\d+)\] (?<action>READ|WROTE): \*(?<http_method>[A-Z]+) (?<uri_query>[^\s]+) HTTP/[^\*]+\*"
| eval message=if(match(_raw, "INCLUDE") and isnotnull(src_ip), "traces of exploitation by " . src_ip, "false")
| search message!=false
| rename host as dest
| stats count by _time, dest, source, message, src_ip, http_method, uri_query, user, action
| sort -_time| `crushftp_server_side_template_injection_filter`'
how_to_implement: CrushFTP Session logs, from Windows or Linux, must be ingested to Splunk. Currently, there is no TA for CrushFTP, so the data must be extracted from the raw logs.
known_false_positives: False positives should be limited, however tune or filter as needed.
description: This analytic is designed to identify attempts to exploit a server-side
template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This
severe vulnerability enables unauthenticated remote attackers to access and read
files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary
commands on the affected server. The issue impacts all versions of CrushFTP up to
10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply
patches immediately to prevent unauthorized access to the system and avoid potential
data compromises. The search specifically looks for patterns in the raw log data
that match the exploitation attempts, including READ or WRITE actions, and extracts
relevant information such as the protocol, session ID, user, IP address, HTTP method,
and the URI queried. It then evaluates these logs to confirm traces of exploitation
based on the presence of specific keywords and the originating IP address, counting
and sorting these events for further analysis.
search: '`crushftp` | rex field=_raw "\[(?<protocol>HTTPS|HTTP):(?<session_id>[^\:]+):(?<user>[^\:]+):(?<src_ip>\d+\.\d+\.\d+\.\d+)\]
(?<action>READ|WROTE): \*(?<http_method>[A-Z]+) (?<uri_query>[^\s]+) HTTP/[^\*]+\*"
| eval message=if(match(_raw, "INCLUDE") and isnotnull(src_ip), "traces of exploitation
by " . src_ip, "false") | search message!=false | rename host as dest | stats count
by _time, dest, source, message, src_ip, http_method, uri_query, user, action |
sort -_time| `crushftp_server_side_template_injection_filter`'
how_to_implement: CrushFTP Session logs, from Windows or Linux, must be ingested to
Splunk. Currently, there is no TA for CrushFTP, so the data must be extracted from
the raw logs.
known_false_positives: False positives should be limited, however tune or filter as
needed.
references:
- https://github.com/airbus-cert/CVE-2024-4040
- https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/
drilldown_searches:
- name: View the detection results for $dest$
search: '%orginal_detection_search% | search dest = $dest$'
tags:
analytic_story:
- CrushFTP Vulnerabilities
asset_type: Web Application
confidence: 80
impact: 80
message: Potential exploitation of CrushFTP Server Side Template Injection Vulnerability on $dest$ by $src_ip$.
message: Potential exploitation of CrushFTP Server Side Template Injection Vulnerability
on $dest$ by $src_ip$.
mitre_attack_id:
- T1190
observable:
detections/application/detect_new_login_attempts_to_routers.yml
+3
View File
@@ -24,6 +24,9 @@ how_to_implement: To successfully implement this search, you must ensure the net
to routing infrastructure.
known_false_positives: Legitimate router connections may appear as new connections
references: []
drilldown_searches:
- name: View the detection results for $user$ and $dest$
search: '%orginal_detection_search% | search user = $user$ dest = $dest$'
tags:
analytic_story:
- Router and Infrastructure Security
detections/application/detect_password_spray_attempts.yml
+30 -26
View File
@@ -7,34 +7,37 @@ status: production
type: TTP
data_source:
- Windows Event Log Security 4625
description: This analytic employs the 3-sigma approach to detect an unusual volume of failed authentication attempts
from a single source. A password spray attack is a type of brute force attack where an attacker tries a few
common passwords across many different accounts to avoid detection and account lockouts. By utilizing the
Authentication Data Model, this detection is effective for all CIM-mapped authentication events, providing
comprehensive coverage and enhancing security against these attacks.
search: '| tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts values(Authentication.app) as app count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action="failure" by Authentication.src, Authentication.action, Authentication.signature_id, sourcetype, _time span=2m
| `drop_dm_object_name("Authentication")`
```fill out time buckets for 0-count events during entire search length```
| appendpipe [| timechart limit=0 span=5m count | table _time]
| fillnull value=0 unique_accounts, unique_src
``` remove duplicate & empty time buckets```
| sort - total_failures
| dedup _time
``` Create aggregation field & apply to all null events```
| eval counter=src+"__"+sourcetype+"__"+signature_id
description: This analytic employs the 3-sigma approach to detect an unusual volume
of failed authentication attempts from a single source. A password spray attack
is a type of brute force attack where an attacker tries a few common passwords across
many different accounts to avoid detection and account lockouts. By utilizing the
Authentication Data Model, this detection is effective for all CIM-mapped authentication
events, providing comprehensive coverage and enhancing security against these attacks.
search: '| tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts
values(Authentication.app) as app count(Authentication.user) as total_failures from
datamodel=Authentication.Authentication where Authentication.action="failure" by
Authentication.src, Authentication.action, Authentication.signature_id, sourcetype,
_time span=2m | `drop_dm_object_name("Authentication")` ```fill out time buckets
for 0-count events during entire search length``` | appendpipe [| timechart limit=0
span=5m count | table _time] | fillnull value=0 unique_accounts, unique_src ```
remove duplicate & empty time buckets``` | sort - total_failures | dedup _time ```
Create aggregation field & apply to all null events``` | eval counter=src+"__"+sourcetype+"__"+signature_id
| eventstats values(counter) as fnscounter | eval counter=coalesce(counter,fnscounter)
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by counter
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 30 and unique_accounts >= upperBound, 1, 0)
| replace "::ffff:*" with * in src
| where isOutlier=1
| foreach * [ eval <<FIELD>> = if(<<FIELD>>="null",null(),<<FIELD>>)]
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std
by counter | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts
> 30 and unique_accounts >= upperBound, 1, 0) | replace "::ffff:*" with * in src
| where isOutlier=1 | foreach * [ eval <<FIELD>> = if(<<FIELD>>="null",null(),<<FIELD>>)]
| table _time, src, action, app, unique_accounts, total_failures, sourcetype, signature_id
| `detect_password_spray_attempts_filter`'
how_to_implement: Ensure in-scope authentication data is CIM mapped and the src field is populated with the source device. Also ensure fill_nullvalue is set within the macro security_content_summariesonly.
how_to_implement: Ensure in-scope authentication data is CIM mapped and the src field
is populated with the source device. Also ensure fill_nullvalue is set within the
macro security_content_summariesonly.
known_false_positives: Unknown
references:
- https://attack.mitre.org/techniques/T1110/003/
drilldown_searches:
- name: View the detection results for
search: '%orginal_detection_search% | search unique_accounts = $unique_accounts$'
tags:
analytic_story:
- Compromised User Account
@@ -44,7 +47,8 @@ tags:
- 90bc2e54-6c84-47a5-9439-0a2a92b4b175
confidence: 70
impact: 70
message: Potential Password Spraying attack from $src$ targeting $unique_accounts$ unique accounts.
message: Potential Password Spraying attack from $src$ targeting $unique_accounts$
unique accounts.
mitre_attack_id:
- T1110.003
- T1110
@@ -53,8 +57,8 @@ tags:
type: Endpoint
role:
- Attacker
- name: sourcetype
type: Other
- name: unique_accounts
type: User
role:
- Victim
product:
@@ -72,4 +76,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
sourcetype: XmlWinEventLog
detections/application/email_attachments_with_lots_of_spaces.yml
+3
View File
@@ -38,6 +38,9 @@ how_to_implement: 'You need to ingest data from emails. Specifically, the sender
email will be deleted from the user''s inbox.'
known_false_positives: None at this time
references: []
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Data Destruction
detections/application/email_files_written_outside_of_the_outlook_directory.yml
+3
View File
@@ -32,6 +32,9 @@ known_false_positives: Administrators and users sometimes prefer backing up thei
email data by moving the email files into a different folder. These attempts will
be detected by the search.
references: []
drilldown_searches:
- name: View the detection results for $dest$
search: '%orginal_detection_search% | search dest = $dest$'
tags:
analytic_story:
- Collection and Staging
detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml
+3
View File
@@ -38,6 +38,9 @@ known_false_positives: The false-positive rate will vary based on how you set th
deviation_threshold and data_samples values. Our recommendation is to adjust these
values based on your network traffic to and from your email servers.
references: []
drilldown_searches:
- name: View the detection results for $dest$
search: '%orginal_detection_search% | search dest = $dest$'
tags:
analytic_story:
- Collection and Staging
detections/application/ivanti_vtm_new_account_creation.yml
+23 -9
View File
@@ -3,28 +3,42 @@ id: b04be6e5-2002-4349-8742-52285635b8f5
version: 1
date: '2024-08-19'
author: Michael Haag, Splunk
data_source:
data_source:
- Ivanti VTM Audit
type: TTP
status: production
description: This analytic detects potential exploitation of the Ivanti Virtual Traffic Manager (vTM) authentication bypass vulnerability (CVE-2024-7593) to create new administrator accounts. The vulnerability allows unauthenticated remote attackers to bypass authentication on the admin panel and create new admin users. This detection looks for suspicious new account creation events in the Ivanti vTM audit logs that lack expected authentication details, which may indicate exploitation attempts.
search: '`ivanti_vtm_audit` OPERATION="adduser" MODGROUP="admin" IP="!!ABSENT!!"
| stats count min(_time) as firstTime max(_time) as lastTime by IP, MODUSER, OPERATION, MODGROUP, AUTH
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
description: This analytic detects potential exploitation of the Ivanti Virtual Traffic
Manager (vTM) authentication bypass vulnerability (CVE-2024-7593) to create new
administrator accounts. The vulnerability allows unauthenticated remote attackers
to bypass authentication on the admin panel and create new admin users. This detection
looks for suspicious new account creation events in the Ivanti vTM audit logs that
lack expected authentication details, which may indicate exploitation attempts.
search: '`ivanti_vtm_audit` OPERATION="adduser" MODGROUP="admin" IP="!!ABSENT!!" |
stats count min(_time) as firstTime max(_time) as lastTime by IP, MODUSER, OPERATION,
MODGROUP, AUTH | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `ivanti_vtm_new_account_creation_filter`'
how_to_implement: To implement this detection, ensure that Ivanti vTM audit logs are being ingested into Splunk. Configure the Ivanti vTM to send its audit logs to Splunk via syslog or by monitoring the log files directly. The sourcetype should be set to "ivanti_vtm_audit" or a similar custom sourcetype for these logs.
known_false_positives: Legitimate new account creation by authorized administrators will generate similar log entries. However, those should include proper authentication details. Verify any detected events against expected administrative activities and authorized user lists.
how_to_implement: To implement this detection, ensure that Ivanti vTM audit logs are
being ingested into Splunk. Configure the Ivanti vTM to send its audit logs to Splunk
via syslog or by monitoring the log files directly. The sourcetype should be set
to "ivanti_vtm_audit" or a similar custom sourcetype for these logs.
known_false_positives: Legitimate new account creation by authorized administrators
will generate similar log entries. However, those should include proper authentication
details. Verify any detected events against expected administrative activities and
authorized user lists.
references:
- https://www.ivanti.com/security/security-advisories/ivanti-virtual-traffic-manager-vtm-cve-2024-7593
- https://nvd.nist.gov/vuln/detail/CVE-2024-7593
drilldown_searches:
- name: View the detection results for $MODUSER$
search: '%orginal_detection_search% | search MODUSER = $MODUSER$'
tags:
analytic_story:
- Ivanti Virtual Traffic Manager CVE-2024-7593
asset_type: Web Application
confidence: 80
impact: 90
message: A new administrator account, $MODUSER$, was created on Ivanti vTM device without proper authentication, which may indicate exploitation of CVE-2024-7593.
message: A new administrator account, $MODUSER$, was created on Ivanti vTM device
without proper authentication, which may indicate exploitation of CVE-2024-7593.
mitre_attack_id:
- T1190
observable:
detections/application/monitor_email_for_brand_abuse.yml
+3
View File
@@ -26,6 +26,9 @@ how_to_implement: You need to ingest email header data. Specifically the sender'
be checked for.
known_false_positives: None at this time
references: []
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Brand Monitoring
detections/application/okta_authentication_failed_during_mfa_challenge.yml
+5 -3
View File
@@ -3,7 +3,7 @@ id: e2b99e7d-d956-411a-a120-2b14adfdde93
version: 2
date: '2024-05-29'
author: Bhavin Patel, Splunk
data_source:
data_source:
- Okta
type: TTP
status: production
@@ -31,6 +31,9 @@ known_false_positives: A user may have accidentally entered the wrong credential
references:
- https://sec.okta.com/everythingisyes
- https://splunkbase.splunk.com/app/6553
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Okta Account Takeover
@@ -72,7 +75,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed.log
source: okta_log
sourcetype: OktaIM2:log
detections/application/okta_idp_lifecycle_modifications.yml
+5 -3
View File
@@ -3,7 +3,7 @@ id: e0be2c83-5526-4219-a14f-c3db2e763d15
version: 2
date: '2024-05-28'
author: Bhavin Patel, Splunk
data_source:
data_source:
- Okta
type: Anomaly
status: production
@@ -30,6 +30,9 @@ known_false_positives: It's possible for legitimate administrative actions or au
references:
- https://www.obsidiansecurity.com/blog/behind-the-breach-cross-tenant-impersonation-in-okta/
- https://splunkbase.splunk.com/app/6553
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Suspicious Okta Activity
@@ -69,7 +72,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/okta_idp/okta.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/okta_idp/okta.log
source: Okta
sourcetype: OktaIM2:log
detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml
+6 -3
View File
@@ -5,9 +5,9 @@ date: '2024-05-19'
author: John Murphy and Jordan Ruocco, Okta, Michael Haag, Splunk
type: TTP
status: experimental
data_source:
data_source:
- Okta
description: 'The following analytic identifies discrepancies between the source and
description: The following analytic identifies discrepancies between the source and
response events for Okta Verify Push requests, indicating potential suspicious behavior.
It leverages Okta System Log events, specifically `system.push.send_factor_verify_push`
and `user.authentication.auth_via_mfa` with the factor "OKTA_VERIFY_PUSH." The detection
@@ -15,7 +15,7 @@ description: 'The following analytic identifies discrepancies between the source
requests, and checks for session roaming and new device/IP usage. This activity
is significant as it may indicate push spam or unauthorized access attempts. If
confirmed malicious, attackers could bypass MFA, leading to unauthorized access
to sensitive systems.'
to sensitive systems.
search: '`okta` eventType IN (system.push.send_factor_verify_push) OR (eventType IN
(user.authentication.auth_via_mfa) debugContext.debugData.factor="OKTA_VERIFY_PUSH")
| eval groupby="authenticationContext.externalSessionId" | eval group_push_time=_time
@@ -42,6 +42,9 @@ known_false_positives: False positives may be present based on organization size
references:
- https://attack.mitre.org/techniques/T1621
- https://splunkbase.splunk.com/app/6553
drilldown_searches:
- name: View the detection results for $actor.alternateId$
search: '%orginal_detection_search% | search actor.alternateId = $actor.alternateId$'
tags:
analytic_story:
- Okta Account Takeover
detections/application/okta_multi_factor_authentication_disabled.yml
+5 -3
View File
@@ -3,7 +3,7 @@ id: 7c0348ce-bdf9-45f6-8a57-c18b5976f00a
version: 2
date: '2024-05-13'
author: Mauricio Velazco, Splunk
data_source:
data_source:
- Okta
type: TTP
status: production
@@ -28,6 +28,9 @@ known_false_positives: Legitimate use case may require for users to disable MFA.
references:
- https://attack.mitre.org/techniques/T1556/
- https://splunkbase.splunk.com/app/6553
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Okta Account Takeover
@@ -66,7 +69,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/okta_mfa_method_disabled.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/okta_mfa_method_disabled.log
source: Okta
sourcetype: OktaIM2:log
detections/application/okta_multiple_accounts_locked_out.yml
+5 -3
View File
@@ -3,7 +3,7 @@ id: a511426e-184f-4de6-8711-cfd2af29d1e1
version: 2
date: '2024-05-11'
author: Michael Haag, Mauricio Velazco, Splunk
data_source:
data_source:
- Okta
type: Anomaly
status: production
@@ -27,6 +27,9 @@ known_false_positives: Multiple account lockouts may be also triggered by an app
references:
- https://attack.mitre.org/techniques/T1110/
- https://splunkbase.splunk.com/app/6553
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Okta Account Takeover
@@ -64,7 +67,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/okta_multiple_accounts_lockout.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/okta_multiple_accounts_lockout.log
source: Okta
sourcetype: OktaIM2:log
detections/application/okta_multiple_failed_mfa_requests_for_user.yml
+5 -3
View File
@@ -3,7 +3,7 @@ id: 826dbaae-a1e6-4c8c-b384-d16898956e73
version: 2
date: '2024-05-20'
author: Mauricio Velazco, Splunk
data_source:
data_source:
- Okta
type: Anomaly
status: production
@@ -26,6 +26,9 @@ known_false_positives: Multiple Failed MFA requests may also be a sign of authen
or application issues. Filter as needed and monitor for any unusual activity.
references:
- https://attack.mitre.org/techniques/T1621/
drilldown_searches:
- name: View the detection results for $src_user$
search: '%orginal_detection_search% | search src_user = $src_user$'
tags:
analytic_story:
- Okta Account Takeover
@@ -61,7 +64,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/okta_multiple_failed_mfa_requests.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/okta_multiple_failed_mfa_requests.log
source: Okta
sourcetype: OktaIM2:log
detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml
+5 -3
View File
@@ -3,7 +3,7 @@ id: de365ffa-42f5-46b5-b43f-fa72290b8218
version: 2
date: '2024-05-28'
author: Michael Haag, Mauricio Velazco, Splunk
data_source:
data_source:
- Okta
type: Anomaly
status: production
@@ -29,6 +29,9 @@ known_false_positives: A source Ip failing to authenticate with multiple users i
references:
- https://attack.mitre.org/techniques/T1110/003/
- https://splunkbase.splunk.com/app/6553
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Okta Account Takeover
@@ -66,7 +69,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/okta_multiple_users_from_ip.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/okta_multiple_users_from_ip.log
source: Okta
sourcetype: OktaIM2:log
detections/application/okta_new_api_token_created.yml
+5 -3
View File
@@ -13,7 +13,7 @@ description: The following analytic detects the creation of a new API token with
persistence. If confirmed malicious, this could enable attackers to execute API
calls, access sensitive data, and perform administrative actions within the Okta
environment.
data_source:
data_source:
- Okta
search: ' | tstats `security_content_summariesonly` count max(_time) as lastTime,
min(_time) as firstTime from datamodel=Change where All_Changes.action=created AND
@@ -28,6 +28,9 @@ known_false_positives: False positives may be present. Tune Okta and tune the an
references:
- https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected
- https://splunkbase.splunk.com/app/6553
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Okta Account Takeover
@@ -66,7 +69,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/okta_new_api_token_created/okta_new_api_token_created.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/okta_new_api_token_created/okta_new_api_token_created.log
source: Okta
sourcetype: OktaIM2:log
detections/application/okta_new_device_enrolled_on_account.yml
+5 -3
View File
@@ -13,7 +13,7 @@ description: The following analytic identifies when a new device is enrolled on
to potential account takeover, unauthorized access, and persistent control over
the compromised Okta account. Monitoring this behavior is crucial for detecting
and mitigating unauthorized access attempts.
data_source:
data_source:
- Okta
search: ' | tstats `security_content_summariesonly` count max(_time) as lastTime,
min(_time) as firstTime from datamodel=Change where All_Changes.action=created All_Changes.command=device.enrollment.create
@@ -27,6 +27,9 @@ known_false_positives: It is possible that the user has legitimately added a new
references:
- https://attack.mitre.org/techniques/T1098/005/
- https://developer.okta.com/docs/reference/api/event-types/?q=device.enrollment.create
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Okta Account Takeover
@@ -61,7 +64,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.005/okta_new_device_enrolled/okta_new_device_enrolled.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.005/okta_new_device_enrolled/okta_new_device_enrolled.log
source: Okta
sourcetype: OktaIM2:log
detections/application/okta_phishing_detection_with_fastpass_origin_check.yml
+4 -1
View File
@@ -5,7 +5,7 @@ date: '2024-05-15'
author: Okta, Inc, Michael Haag, Splunk
type: TTP
status: experimental
data_source:
data_source:
- Okta
description: The following analytic identifies failed user authentication attempts
in Okta due to FastPass declining a phishing attempt. It leverages Okta logs, specifically
@@ -26,6 +26,9 @@ known_false_positives: Fidelity of this is high as Okta is specifying malicious
Filter and modify as needed.
references:
- https://sec.okta.com/fastpassphishingdetection
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Okta Account Takeover
detections/application/okta_risk_threshold_exceeded.yml
+6 -4
View File
@@ -1,7 +1,7 @@
name: Okta Risk Threshold Exceeded
id: d8b967dd-657f-4d88-93b5-c588bcd7218c
version: 3
date: "2024-05-28"
date: '2024-05-28'
author: Michael Haag, Bhavin Patel, Splunk
status: production
type: Correlation
@@ -13,7 +13,7 @@ description: The following correlation identifies when a user exceeds a risk thr
tactics, techniques, and procedures (TTPs) within a 24-hour period. If confirmed
malicious, this activity could indicate a serious security breach, allowing attackers
to gain unauthorized access, escalate privileges, or persist within the environment.
data_source:
data_source:
- Okta
search: '| tstats `security_content_summariesonly` values(All_Risk.analyticstories)
as analyticstories sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score)
@@ -37,6 +37,9 @@ known_false_positives: False positives will be limited to the number of events g
references:
- https://developer.okta.com/docs/reference/api/event-types
- https://sec.okta.com/everythingisyes
drilldown_searches:
- name: View the detection results for $risk_object$
search: '%orginal_detection_search% | search risk_object = $risk_object$'
tags:
analytic_story:
- Okta Account Takeover
@@ -73,7 +76,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/okta_account_takeover_risk_events/okta_risk.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/okta_account_takeover_risk_events/okta_risk.log
source: risk_data
sourcetype: stash
detections/application/okta_successful_single_factor_authentication.yml
+5 -3
View File
@@ -3,7 +3,7 @@ id: 98f6ad4f-4325-4096-9d69-45dc8e638e82
version: 2
date: '2024-05-26'
author: Bhavin Patel, Splunk
data_source:
data_source:
- Okta
type: Anomaly
status: production
@@ -28,6 +28,9 @@ known_false_positives: Although not recommended, certain users may be exempt fro
references:
- https://sec.okta.com/everythingisyes
- https://attack.mitre.org/techniques/T1078/004/
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Okta Account Takeover
@@ -67,7 +70,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/okta_single_factor_auth/okta_single_factor_auth.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/okta_single_factor_auth/okta_single_factor_auth.log
source: okta_log
sourcetype: OktaIM2:log
detections/application/okta_suspicious_activity_reported.yml
+5 -3
View File
@@ -13,7 +13,7 @@ description: The following analytic identifies when an associate reports a login
malicious, the attacker could gain unauthorized access to sensitive systems and
data, leading to data theft, privilege escalation, or further compromise of the
environment.
data_source:
data_source:
- Okta
search: '`okta` eventType=user.account.report_suspicious_activity_by_enduser | stats
count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user
@@ -28,6 +28,9 @@ known_false_positives: False positives should be minimal, given the high fidelit
of this detection. marker.
references:
- https://help.okta.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Okta Account Takeover
@@ -62,7 +65,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/okta_suspicious_activity_reported_by_user.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/okta_suspicious_activity_reported_by_user.log
source: Okta
sourcetype: OktaIM2:log
detections/application/okta_suspicious_use_of_a_session_cookie.yml
+7 -5
View File
@@ -5,16 +5,16 @@ date: '2024-05-29'
author: Scott Dermott, Felicity Robson, Okta, Michael Haag, Bhavin Patel, Splunk
type: Anomaly
status: production
data_source:
data_source:
- Okta
description: 'The following analytic identifies suspicious use of a session cookie
description: The following analytic identifies suspicious use of a session cookie
by detecting multiple client values (IP, User Agent, etc.) changing for the same
Device Token associated with a specific user. It leverages policy evaluation events
from successful authentication logs in Okta. This activity is significant as it
may indicate an adversary attempting to reuse a stolen web session cookie, potentially
bypassing authentication mechanisms. If confirmed malicious, this could allow unauthorized
access to user accounts, leading to data breaches or further exploitation within
the environment.'
the environment.
search: '`okta` eventType IN (policy.evaluate_sign_on) outcome.result IN (ALLOW, SUCCESS)
| stats earliest(_time) as _time, values(client.ipAddress) as src_ip, values(client.userAgent.rawUserAgent)
as user_agent, values(client.userAgent.os) as userAgentOS_list, values(client.geographicalContext.city)
@@ -30,6 +30,9 @@ known_false_positives: False positives may occur, depending on the organization'
size and the configuration of Okta.
references:
- https://attack.mitre.org/techniques/T1539/
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Suspicious Okta Activity
@@ -65,7 +68,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1539/okta_web_session_multiple_ip/okta_web_session_multiple_ip.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1539/okta_web_session_multiple_ip/okta_web_session_multiple_ip.log
source: Okta
sourcetype: OktaIM2:log
detections/application/okta_threatinsight_threat_detected.yml
+5 -3
View File
@@ -12,7 +12,7 @@ description: The following analytic identifies threats detected by Okta ThreatIn
access attempts and credential-based attacks. If confirmed malicious, these activities
could lead to unauthorized access, data breaches, and further exploitation of compromised
accounts, posing a significant risk to the organization's security posture.
data_source:
data_source:
- Okta
search: '`okta` eventType = security.threat.detected | rename client.geographicalContext.country
as country, client.geographicalContext.state as state, client.geographicalContext.city
@@ -27,6 +27,9 @@ known_false_positives: False positives may occur. It is recommended to fine-tune
settings and the analytic to ensure high fidelity. Adjust the risk score as necessary.
references:
- https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected
drilldown_searches:
- name: View the detection results for $app$
search: '%orginal_detection_search% | search app = $app$'
tags:
analytic_story:
- Okta Account Takeover
@@ -69,7 +72,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/okta_threatinsight_threat_detected.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/okta_threatinsight_threat_detected.log
source: Okta
sourcetype: OktaIM2:log
detections/application/okta_unauthorized_access_to_application.yml
+6 -4
View File
@@ -2,8 +2,8 @@ name: Okta Unauthorized Access to Application
id: 5f661629-9750-4cb9-897c-1f05d6db8727
version: 2
date: '2024-05-12'
author: 'Bhavin Patel, Splunk'
data_source:
author: Bhavin Patel, Splunk
data_source:
- Okta
type: Anomaly
status: production
@@ -28,6 +28,9 @@ known_false_positives: There is a possibility that a user may accidentally click
the location from which this activity originates.
references:
- https://attack.mitre.org/techniques/T1110/003/
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Okta Account Takeover
@@ -66,7 +69,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/okta_unauth_access/okta_unauth_access.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/okta_unauth_access/okta_unauth_access.log
source: Okta
sourcetype: OktaIM2:log
detections/application/okta_user_logins_from_multiple_cities.yml
+6 -4
View File
@@ -2,8 +2,8 @@ name: Okta User Logins from Multiple Cities
id: a3d1df37-c2a9-41d0-aa8f-59f82d6192a8
version: 2
date: '2024-05-09'
author: 'Bhavin Patel, Splunk'
data_source:
author: Bhavin Patel, Splunk
data_source:
- Okta
type: Anomaly
status: production
@@ -32,6 +32,9 @@ known_false_positives: It is uncommon for a user to log in from multiple cities
which may indicate a false positive.
references:
- https://attack.mitre.org/techniques/T1110/003/
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Okta Account Takeover
@@ -70,7 +73,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/okta_multiple_city/okta_multiple_city_im2.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/okta_multiple_city/okta_multiple_city_im2.log
source: Okta
sourcetype: OktaIM2:log
detections/application/pingid_mismatch_auth_source_and_verification_response.yml
+11 -10
View File
@@ -15,24 +15,23 @@ description: The following analytic identifies discrepancies between the IP addr
to sensitive systems and data.
data_source:
- PingID
search: >-
`pingid` ("result.status" IN ("SUCCESS*","FAIL*","UNSUCCESSFUL*") NOT "result.message"
IN ("*pair*","*create*","*delete*")) | eval user = upper('actors{}.name'), session_id
= 'resources{}.websession', dest = 'resources{}.ipaddress', reason = 'result.message',
object = 'resources{}.devicemodel', status = 'result.status' | join user session_id
search: '`pingid` ("result.status" IN ("SUCCESS*","FAIL*","UNSUCCESSFUL*") NOT "result.message"
IN ("*pair*","*create*","*delete*")) | eval user = upper(''actors{}.name''), session_id
= ''resources{}.websession'', dest = ''resources{}.ipaddress'', reason = ''result.message'',
object = ''resources{}.devicemodel'', status = ''result.status'' | join user session_id
[ search `pingid` ("result.status" IN ("POLICY") AND "resources{}.ipaddress"=*)
AND "result.message" IN("*Action: Authenticate*","*Action: Approve*","*Action: Allowed*")
| rex field=result.message "IP Address: (?:N\/A)?(?<policy_ipaddress>.+)?\n" | rex
field=result.message "Action: (?:N\/A)?(?<signature>.+)?\n" | rex field=result.message
"Requested Application Name: (?:N\/A)?(?<Requested_Application_Name>.+)?\n" | rex
field=result.message "Requested Application ID: (?:N\/A)?(?<Requested_Application_ID>.+)?\n"
| eval user = upper('actors{}.name'), session_id = 'resources{}.websession', src
= coalesce('resources{}.ipaddress',policy_ipaddress), app = coalesce(Requested_Application_ID,Requested_Application_Name)
| eval user = upper(''actors{}.name''), session_id = ''resources{}.websession'',
src = coalesce(''resources{}.ipaddress'',policy_ipaddress), app = coalesce(Requested_Application_ID,Requested_Application_Name)
| fields app, user, session_id, src, signature ] | iplocation prefix=auth_ dest
| iplocation prefix=verify_ src | stats count min(_time) as firstTime max(_time)
as lastTime values(app) as app values(session_id) as session_id by user, dest, auth_Country,
src, verify_Country, object, signature, status, reason | where auth_Country != verify_Country
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `pingid_mismatch_auth_source_and_verification_response_filter`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `pingid_mismatch_auth_source_and_verification_response_filter`'
how_to_implement: Target environment must ingest JSON logging from a PingID(PingOne)
enterprise environment, either via Webhook or Push Subscription.
known_false_positives: False positives may be generated by users working out the geographic
@@ -42,6 +41,9 @@ references:
- https://attack.mitre.org/techniques/T1098/005/
- https://attack.mitre.org/techniques/T1556/006/
- https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
drilldown_searches:
- name: View the detection results for $user$ and $src$
search: '%orginal_detection_search% | search user = $user$ src = $src$'
tags:
analytic_story:
- Compromised User Account
@@ -84,8 +86,7 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log
source: PINGID
sourcetype: _json
update_timestamp: true
detections/application/pingid_multiple_failed_mfa_requests_for_user.yml
+11 -9
View File
@@ -14,13 +14,13 @@ description: The following analytic identifies multiple failed multi-factor auth
request, compromising the security of the account and potentially the entire network.
data_source:
- PingID
search: >-
`pingid` "result.status" IN ("FAILURE,authFail","UNSUCCESSFUL_ATTEMPT") | eval time
= _time, src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user
= upper('actors{}.name'), object = 'resources{}.devicemodel', reason = 'result.message'|
bucket span=10m _time | stats dc(_raw) AS mfa_prompts min(time) as firstTime, max(time)
as lastTime values(src) as src by user, reason, _time | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | where mfa_prompts >= 10 | `pingid_multiple_failed_mfa_requests_for_user_filter`
search: '`pingid` "result.status" IN ("FAILURE,authFail","UNSUCCESSFUL_ATTEMPT") |
eval time = _time, src = coalesce(''resources{}.ipaddress'',''resources{}.devicemodel''),
user = upper(''actors{}.name''), object = ''resources{}.devicemodel'', reason =
''result.message''| bucket span=10m _time | stats dc(_raw) AS mfa_prompts min(time)
as firstTime, max(time) as lastTime values(src) as src by user, reason, _time |
`security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | where
mfa_prompts >= 10 | `pingid_multiple_failed_mfa_requests_for_user_filter`'
how_to_implement: Target environment must ingest JSON logging from a PingID(PingOne)
enterprise environment, either via Webhook or Push Subscription.
known_false_positives: False positives may be generated by normal provisioning workflows
@@ -31,6 +31,9 @@ references:
- https://attack.mitre.org/techniques/T1110/
- https://attack.mitre.org/techniques/T1078/004/
- https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Compromised User Account
@@ -64,7 +67,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log
source: PINGID
sourcetype: _json
detections/application/pingid_new_mfa_method_after_credential_reset.yml
+10 -10
View File
@@ -15,11 +15,10 @@ description: The following analytic identifies the provisioning of a new MFA dev
measures.
data_source:
- PingID
search: >-
`pingid` "result.message" = "*Device Paired*" | rex field=result.message "Device
(Unp)?(P)?aired (?<device_extract>.+)" | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel'),
user = upper('actors{}.name'), reason = 'result.message' | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract)
| eval action=CASE(match('result.message',"Device Paired*"),"created",match('result.message',
search: '`pingid` "result.message" = "*Device Paired*" | rex field=result.message
"Device (Unp)?(P)?aired (?<device_extract>.+)" | eval src = coalesce(''resources{}.ipaddress'',''resources{}.devicemodel''),
user = upper(''actors{}.name''), reason = ''result.message'' | eval object=CASE(ISNOTNULL(''resources{}.devicemodel''),''resources{}.devicemodel'',true(),device_extract)
| eval action=CASE(match(''result.message'',"Device Paired*"),"created",match(''result.message'',
"Device Unpaired*"),"deleted") | stats count min(_time) as firstTime, max(_time)
as lastTime, values(reason) as reason by src,user,action,object | join type=outer
user [| search `wineventlog_security` EventID IN(4723,4724) | eval PW_Change_Time
@@ -27,7 +26,7 @@ search: >-
timeDiffRaw = round(lastTime - PW_Change_Time) | eval timeDiff = replace(tostring(abs(timeDiffRaw)
,"duration"),"(\d*)\+*(\d+):(\d+):(\d+)","\2 hours \3 minutes") | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `security_content_ctime(PW_Change_Time)`
| where timeDiffRaw > 0 AND timeDiffRaw < 3600 | `pingid_new_mfa_method_after_credential_reset_filter`
| where timeDiffRaw > 0 AND timeDiffRaw < 3600 | `pingid_new_mfa_method_after_credential_reset_filter`'
how_to_implement: Target environment must ingest Windows Event Log and PingID(PingOne)
data sources. Specifically from logs from Active Directory Domain Controllers and
JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or
@@ -40,6 +39,9 @@ references:
- https://attack.mitre.org/techniques/T1098/005/
- https://attack.mitre.org/techniques/T1556/006/
- https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Compromised User Account
@@ -80,11 +82,9 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/windows_pw_reset.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/windows_pw_reset.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log
source: PINGID
sourcetype: _json
detections/application/pingid_new_mfa_method_registered_for_user.yml
+12 -14
View File
@@ -14,18 +14,14 @@ description: The following analytic detects the registration of a new Multi-Fact
and potentially escalate their privileges within the compromised environment.
data_source:
- PingID
search: >-
`pingid` "result.message"="Device Paired*" result.status="SUCCESS" | rex field=result.message
"Device (Unp)?(P)?aired (?<device_extract>.+)"
| eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user =
upper('actors{}.name'), reason = 'result.message'
| eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract)
| eval action=CASE(match('result.message',"Device Paired*"),"created",match('result.message',
"Device Unpaired*"),"deleted")
| stats count min(_time) as firstTime, max(_time) as lastTime by src,user,object,action,reason
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `pingid_new_mfa_method_registered_for_user_filter`
search: '`pingid` "result.message"="Device Paired*" result.status="SUCCESS" | rex
field=result.message "Device (Unp)?(P)?aired (?<device_extract>.+)" | eval src =
coalesce(''resources{}.ipaddress'',''resources{}.devicemodel''), user = upper(''actors{}.name''),
reason = ''result.message'' | eval object=CASE(ISNOTNULL(''resources{}.devicemodel''),''resources{}.devicemodel'',true(),device_extract)
| eval action=CASE(match(''result.message'',"Device Paired*"),"created",match(''result.message'',
"Device Unpaired*"),"deleted") | stats count min(_time) as firstTime, max(_time)
as lastTime by src,user,object,action,reason | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `pingid_new_mfa_method_registered_for_user_filter`'
how_to_implement: Target environment must ingest JSON logging from a PingID(PingOne)
enterprise environment, either via Webhook or Push Subscription.
known_false_positives: False positives may be generated by normal provisioning workflows
@@ -35,6 +31,9 @@ references:
- https://attack.mitre.org/techniques/T1098/005/
- https://attack.mitre.org/techniques/T1556/006/
- https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
drilldown_searches:
- name: View the detection results for $user$ and $src$
search: '%orginal_detection_search% | search user = $user$ src = $src$'
tags:
analytic_story:
- Compromised User Account
@@ -76,8 +75,7 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log
source: PINGID
sourcetype: _json
update_timestamp: true
detections/application/suspicious_email_attachment_extensions.yml
+23 -16
View File
@@ -5,32 +5,39 @@ date: '2024-05-29'
author: David Dorsey, Splunk
status: experimental
type: Anomaly
description: |-
The following analytic detects emails containing attachments with suspicious file extensions. It leverages the Email data model in Splunk, using the tstats command to identify emails where the attachment filename is not empty. This detection is significant for SOC analysts as it highlights potential phishing or malware delivery attempts, which are common vectors for data breaches and malware infections. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, system compromise, or data exfiltration. Immediate review and analysis of the identified emails and attachments are crucial to mitigate these risks.
description: The following analytic detects emails containing attachments with suspicious
file extensions. It leverages the Email data model in Splunk, using the tstats command
to identify emails where the attachment filename is not empty. This detection is
significant for SOC analysts as it highlights potential phishing or malware delivery
attempts, which are common vectors for data breaches and malware infections. If
confirmed malicious, this activity could lead to unauthorized access to sensitive
information, system compromise, or data exfiltration. Immediate review and analysis
of the identified emails and attachments are crucial to mitigate these risks.
data_source: []
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Email where All_Email.file_name="*" by All_Email.src_user,
All_Email.file_name All_Email.message_id | `security_content_ctime(firstTime)` |
`security_content_ctime(lastTime)` | `drop_dm_object_name("All_Email")` | `suspicious_email_attachments`
| `suspicious_email_attachment_extensions_filter`'
how_to_implement: You need to ingest data from emails. Specifically, the sender's
address and the file names of any attachments must be mapped to the Email data
model.
how_to_implement: 'You need to ingest data from emails. Specifically, the sender''s
address and the file names of any attachments must be mapped to the Email data model.
**Splunk Phantom Playbook Integration**
If Splunk Phantom is also
configured in your environment, a Playbook called "Suspicious Email Attachment
Investigate and Delete" can be configured to run when any results are found by
this detection search. To use this integration, install the Phantom App for Splunk
`https://splunkbase.splunk.com/app/3411/`, and add the correct hostname to the
"Phantom Instance" field in the Adaptive Response Actions when configuring this
detection search. The notable event will be sent to Phantom and the playbook will
gather further information about the file attachment and its network behaviors.
If Splunk Phantom is also configured in your environment, a Playbook called "Suspicious
Email Attachment Investigate and Delete" can be configured to run when any results
are found by this detection search. To use this integration, install the Phantom
App for Splunk `https://splunkbase.splunk.com/app/3411/`, and add the correct hostname
to the "Phantom Instance" field in the Adaptive Response Actions when configuring
this detection search. The notable event will be sent to Phantom and the playbook
will gather further information about the file attachment and its network behaviors.
If Phantom finds malicious behavior and an analyst approves of the results, the
email will be deleted from the user's inbox.'
email will be deleted from the user''s inbox.'''
known_false_positives: None identified
references: []
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Data Destruction
detections/application/suspicious_java_classes.yml
+3
View File
@@ -25,6 +25,9 @@ how_to_implement: In order to properly run this search, Splunk needs to ingest d
network traffic-analysis tools, such as Splunk Stream or Bro.
known_false_positives: There are no known false positives.
references: []
drilldown_searches:
- name: View the detection results for $user$ and $dest$
search: '%orginal_detection_search% | search user = $user$ dest = $dest$'
tags:
analytic_story:
- Apache Struts Vulnerability
detections/application/web_servers_executing_suspicious_processes.yml
+11 -2
View File
@@ -5,8 +5,14 @@ date: '2024-05-11'
author: David Dorsey, Splunk
status: experimental
type: TTP
description: |-
The following analytic detects the execution of suspicious processes on systems identified as web servers. It leverages the Splunk data model "Endpoint.Processes" to search for specific process names such as "whoami", "ping", "iptables", "wget", "service", and "curl". This activity is significant because these processes are often used by attackers for reconnaissance, persistence, or data exfiltration. If confirmed malicious, this could lead to data theft, deployment of additional malware, or even ransomware attacks. Immediate investigation is required to determine the legitimacy of the activity and mitigate potential threats.
description: The following analytic detects the execution of suspicious processes
on systems identified as web servers. It leverages the Splunk data model "Endpoint.Processes"
to search for specific process names such as "whoami", "ping", "iptables", "wget",
"service", and "curl". This activity is significant because these processes are
often used by attackers for reconnaissance, persistence, or data exfiltration. If
confirmed malicious, this could lead to data theft, deployment of additional malware,
or even ransomware attacks. Immediate investigation is required to determine the
legitimacy of the activity and mitigate potential threats.
data_source:
- Sysmon EventID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -27,6 +33,9 @@ how_to_implement: The detection is based on data that originates from Endpoint D
known_false_positives: Some of these processes may be used legitimately on web servers
during maintenance or other administrative tasks.
references: []
drilldown_searches:
- name: View the detection results for $user$ and $dest$
search: '%orginal_detection_search% | search user = $user$ dest = $dest$'
tags:
analytic_story:
- Apache Struts Vulnerability
detections/application/windows_ad_add_self_to_group.yml
+14 -9
View File
@@ -7,17 +7,22 @@ status: production
type: TTP
data_source:
- Windows Event Log Security 4728
description: This analytic detects instances where a user adds themselves to an Active Directory (AD) group. This activity
is a common indicator of privilege escalation, where a user attempts to gain unauthorized access to higher
privileges or sensitive resources. By monitoring AD logs, this detection identifies such suspicious behavior,
which could be part of a larger attack strategy aimed at compromising critical systems and data.
search: '`wineventlog_security` EventCode IN (4728)
| where user=src_user
| stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name, src_user
| `windows_ad_add_self_to_group_filter`'
description: This analytic detects instances where a user adds themselves to an Active
Directory (AD) group. This activity is a common indicator of privilege escalation,
where a user attempts to gain unauthorized access to higher privileges or sensitive
resources. By monitoring AD logs, this detection identifies such suspicious behavior,
which could be part of a larger attack strategy aimed at compromising critical systems
and data.
search: '`wineventlog_security` EventCode IN (4728) | where user=src_user | stats
min(_time) as _time dc(user) as usercount, values(user) as user values(user_category)
as user_category values(src_user_category) as src_user_category values(dvc) as dvc
by signature, Group_Name, src_user | `windows_ad_add_self_to_group_filter`'
how_to_implement: This analytic requires eventCode 4728 to be ingested.
known_false_positives: Unknown
references: []
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Active Directory Privilege Escalation
@@ -51,4 +56,4 @@ tests:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
update_timestamp: true
update_timestamp: true
detections/application/windows_ad_dangerous_deny_acl_modification.yml
+66 -56
View File
@@ -7,78 +7,88 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object.
search: >-
`wineventlog_security` EventCode=5136
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
| rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
| rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
| mvexpand new_ace
| where NOT new_ace IN (old_values)
| rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
| rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
| lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
| lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value
| lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType
| lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
``` Optional SID resolution lookups
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
| lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
| lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
| eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
| stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
| eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
| search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC)
| `windows_ad_dangerous_deny_acl_modification_filter`
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136.
See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: None.
description: This detection identifies an Active Directory access-control list (ACL)
modification event, which applies permissions that deny the ability to enumerate
permissions of the object.
search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null)))
as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value
values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user
SubjectLogonId | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" |
rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" | mvexpand new_ace |
where NOT new_ace IN (old_values) | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" |
rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" | rex max_match=100
field=aceFlags "(?P<aceFlags>[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid
OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string
as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string
as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string
as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName
as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` |
lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name
as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This
object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full
control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid),
user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType
values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights
values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid)
as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user
OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1
AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search
aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC)
| `windows_ad_dangerous_deny_acl_modification_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136. See lantern article in references for further on how to onboard AD audit
data. Ensure the wineventlog_security macro is configured with the correct indexes
and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: None.
references:
- https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54
- https://www.youtube.com/watch?v=_nGpZ1ydzS8
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $user$ and $src_user$
search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 100
impact: 100
message: $src_user$ has added ACL rights to deny $user$ $aceControlAccessRights$ $aceAccessRights$ to $ObjectDN$
message: $src_user$ has added ACL rights to deny $user$ $aceControlAccessRights$
$aceAccessRights$ to $ObjectDN$
mitre_attack_id:
- T1484
- T1222
- T1222.001
observable:
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
detections/application/windows_ad_dangerous_group_acl_modification.yml
+73 -58
View File
@@ -7,82 +7,97 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: >-
This detection monitors the addition of the following ACLs to an Active Directory group object: "Full control", "All extended rights", "All validated writes",
"Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", and "Write all properties".
Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.
search: >-
`wineventlog_security` EventCode=5136 ObjectClass=group
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
| rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
| rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
| mvexpand new_ace
| where NOT new_ace IN (old_values)
| rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
| rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
| lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType
| lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
| lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value
| lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
``` Optional SID resolution lookups
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
| lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
| lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
| eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid)
| stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
| eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
| search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP)
| `windows_ad_dangerous_group_acl_modification_filter`
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136.
See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
description: 'This detection monitors the addition of the following ACLs to an Active
Directory group object: "Full control", "All extended rights", "All validated writes", "Create
all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify
permissions", "Modify owner", and "Write all properties". Such modifications can
indicate potential privilege escalation or malicious activity. Immediate investigation
is recommended upon alert.'
search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time)
as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value
values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType)
as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId |
rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" | rex field=new_value
max_match=10000 "\((?P<new_ace>.*?)\)" | mvexpand new_ace | where NOT new_ace
IN (old_values) | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" |
rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" | rex max_match=100
field=aceFlags "(?P<aceFlags>[A-Z]{2})" | lookup ace_type_lookup ace_type_string
as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string
as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup
access_rights_string as AccessRights OUTPUT access_rights_value | lookup msad_guid_lookup
guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID
resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT
downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT
cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT
builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType),
aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full
control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write
member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All
validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)),
user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType
values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights
values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid)
as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user
OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1
AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search
NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All
extended rights","All validated writes","Create all child objects","Delete all child
objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all
properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136. See lantern article in references for further on how to onboard AD audit
data. Ensure the wineventlog_security macro is configured with the correct indexes
and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: Unknown
references:
- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $user$ and $src_user$
search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 100
impact: 100
message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to group $ObjectDN$
message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$
$aceAccessRights$ to group $ObjectDN$
mitre_attack_id:
- T1484
- T1222
- T1222.001
observable:
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
detections/application/windows_ad_dangerous_user_acl_modification.yml
+71 -58
View File
@@ -7,82 +7,95 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: >-
This detection monitors the addition of the following ACLs to an Active Directory user object: "Full control","All extended rights","All validated writes",
"Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties".
Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.
search: >-
`wineventlog_security` EventCode=5136 ObjectClass=user
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
| rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
| rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
| mvexpand new_ace
| where NOT new_ace IN (old_values)
| rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
| rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
| lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
| lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value
| lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType
| lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
``` Optional SID resolution lookups
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
| lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
| lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
| eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
| stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
| eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
| search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP)
| `windows_ad_dangerous_user_acl_modification_filter`
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136.
See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
description: 'This detection monitors the addition of the following ACLs to an Active
Directory user object: "Full control","All extended rights","All validated writes",
"Create all child objects","Delete all child objects","Delete subtree","Delete","Modify
permissions","Modify owner","Write all properties". Such modifications can indicate
potential privilege escalation or malicious activity. Immediate investigation is
recommended upon alert.'
search: '`wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time)
as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value
values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType)
as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId |
rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" | rex field=new_value
max_match=10000 "\((?P<new_ace>.*?)\)" | mvexpand new_ace | where NOT new_ace
IN (old_values) | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" |
rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" | rex max_match=100
field=aceFlags "(?P<aceFlags>[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid
OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string
as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string
as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string
as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName
as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` |
lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name
as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This
object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full
control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid),
user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType
values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights
values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid)
as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user
OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1
AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search
NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended
rights","All validated writes","Create all child objects","Delete all child objects","Delete
subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP)
| `windows_ad_dangerous_user_acl_modification_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136. See lantern article in references for further on how to onboard AD audit
data. Ensure the wineventlog_security macro is configured with the correct indexes
and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: Unknown
references:
- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $user$ and $src_user$
search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 100
impact: 100
message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to user $ObjectDN$
message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$
$aceAccessRights$ to user $ObjectDN$
mitre_attack_id:
- T1484
- T1222
- T1222.001
observable:
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
detections/application/windows_ad_dcshadow_privileges_acl_addition.yml
+61 -49
View File
@@ -7,77 +7,89 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies the minimum required extended rights to perform the DCShadow attack.
search: >-
`wineventlog_security` EventCode=5136 ObjectClass=domainDNS
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
| rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
| rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
| mvexpand new_ace
| where NOT new_ace IN (old_values)
| rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"
description: This detection identifies an Active Directory access-control list (ACL)
modification event, which applies the minimum required extended rights to perform
the DCShadow attack.
search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time)
as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value
values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType)
as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId |
rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" | rex field=new_value
max_match=10000 "\((?P<new_ace>.*?)\)" | mvexpand new_ace | where NOT new_ace IN
(old_values) | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"
| search aceObjectGuid IN ("9923a32a-3607-11d2-b9be-0000f87a36b2","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2")
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
| rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
| lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
| lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value
| lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value
| lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
``` Optional SID resolution lookups
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
| lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
| lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
| eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
| stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user
| search (aceControlAccessRights="Add/Remove Replica In Domain" AND aceControlAccessRights="Manage Replication Topology" AND aceControlAccessRights="Replication Synchronization") OR (aceControlAccessRights="9923a32a-3607-11d2-b9be-0000f87a36b2" AND aceControlAccessRights="1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ac-9c07-11d1-f79f-00c04fc2dcd2")
| `windows_ad_dcshadow_privileges_acl_addition_filter`
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136.
See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" | rex max_match=100
field=aceFlags "(?P<aceFlags>[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid
OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string
as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string
as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags
OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup
identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user |
lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup
builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval
aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This
object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full
control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid),
user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType)
as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights)
as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace)
as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user
user | search (aceControlAccessRights="Add/Remove Replica In Domain" AND aceControlAccessRights="Manage
Replication Topology" AND aceControlAccessRights="Replication Synchronization")
OR (aceControlAccessRights="9923a32a-3607-11d2-b9be-0000f87a36b2" AND aceControlAccessRights="1131f6ab-9c07-11d1-f79f-00c04fc2dcd2"
AND aceControlAccessRights="1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") | `windows_ad_dcshadow_privileges_acl_addition_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136. See lantern article in references for further on how to onboard AD audit
data. Ensure the wineventlog_security macro is configured with the correct indexes
and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: Unknown
references:
- https://www.labofapenetrationtester.com/2018/04/dcshadow.html
- https://github.com/samratashok/nishang/blob/master/ActiveDirectory/Set-DCShadowPermissions.ps1
- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $user$ and $src_user$
search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 100
impact: 100
message: ACL modification Event Initiated by $src_user$ applying $user$ the minimum required extended rights to perform a DCShadow attack.
message: ACL modification Event Initiated by $src_user$ applying $user$ the minimum
required extended rights to perform a DCShadow attack.
mitre_attack_id:
- T1484
- T1207
- T1222.001
observable:
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
detections/application/windows_ad_domain_root_acl_deletion.yml
+64 -54
View File
@@ -7,78 +7,88 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: ACL deletion performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage.
search: >-
`wineventlog_security` EventCode=5136 ObjectClass=domainDNS
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
| rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
| rex field=new_value max_match=10000 "\((?P<new_values>.*?)\)"
| mvexpand old_values
| where NOT old_values IN (new_values)
| rex field=old_values "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
| rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
| lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
| lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value
| lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value
| lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
``` Optional SID resolution lookups
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
| lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
| lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
| eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
| stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
| eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
| `windows_ad_domain_root_acl_deletion_filter`
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136.
See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
description: ACL deletion performed on the domain root object, significant AD change
with high impact. Following MS guidance all changes at this level should be reviewed.
Drill into the logonID within EventCode 4624 for information on the source device
during triage.
search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time)
as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value
values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType)
as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId |
rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" | rex field=new_value
max_match=10000 "\((?P<new_values>.*?)\)" | mvexpand old_values | where NOT old_values
IN (new_values) | rex field=old_values "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$" |
rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" | rex max_match=100
field=aceFlags "(?P<aceFlags>[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid
OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string
as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string
as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags
OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup
identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user |
lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup
builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval
aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This
object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full
control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid),
user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType
values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights
values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time
ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1
AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_deletion_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136. See lantern article in references for further on how to onboard AD audit
data. Ensure the wineventlog_security macro is configured with the correct indexes
and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: Unknown
references:
- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $user$ and $src_user$
search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 100
impact: 100
message: $src_user$ has removed $user$ $aceAccessRights$ ACL rights to domain root $ObjectDN$
message: $src_user$ has removed $user$ $aceAccessRights$ ACL rights to domain root
$ObjectDN$
mitre_attack_id:
- T1484
- T1222
- T1222.001
observable:
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
detections/application/windows_ad_domain_root_acl_modification.yml
+63 -54
View File
@@ -7,78 +7,87 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: ACL modification performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage.
search: >-
`wineventlog_security` EventCode=5136 ObjectClass=domainDNS
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
| rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
| rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
| mvexpand new_ace
| where NOT new_ace IN (old_values)
| rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
| rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
| lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
| lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value
| lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value
| lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
``` Optional SID resolution lookups
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
| lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
| lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
| eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",'access_rights_value'), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid)
| stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
| eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
| `windows_ad_domain_root_acl_modification_filter`
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136.
See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
description: ACL modification performed on the domain root object, significant AD
change with high impact. Following MS guidance all changes at this level should
be reviewed. Drill into the logonID within EventCode 4624 for information on the
source device during triage.
search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time)
as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value
values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType)
as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId |
rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" | rex field=new_value
max_match=10000 "\((?P<new_ace>.*?)\)" | mvexpand new_ace | where NOT new_ace IN
(old_values) | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" | rex max_match=100
field=aceFlags "(?P<aceFlags>[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid
OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string
as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string
as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags
OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup
identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user |
lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup
builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval
aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",''access_rights_value''),
aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights,
user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType
values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights
values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass
ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1
AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_modification_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136. See lantern article in references for further on how to onboard AD audit
data. Ensure the wineventlog_security macro is configured with the correct indexes
and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: Unknown
references:
- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $user$ and $src_user$
search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 100
impact: 100
message: $src_user$ has granted $user$ $aceAccessRights$ ACL rights to domain root $ObjectDN$
message: $src_user$ has granted $user$ $aceAccessRights$ ACL rights to domain root
$ObjectDN$
mitre_attack_id:
- T1484
- T1222
- T1222.001
observable:
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
detections/application/windows_ad_gpo_deleted.yml
+45 -38
View File
@@ -7,26 +7,33 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: This detection identifies when an Active Directory Group Policy is deleted using the Group Policy Management Console.
description: This detection identifies when an Active Directory Group Policy is deleted
using the Group Policy Management Console.
search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=gpLink | eval ObjectDN=upper(ObjectDN)
| stats min(_time) as eventTime values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(src_user) as src_user by OpCorrelationID ObjectDN SubjectLogonId
| rex field=old_value max_match=10000 "(?i)LDAP://(?P<old_dn>cn.*?);(?P<old_flag>\d)\]"
| stats min(_time) as eventTime values(eval(if(OperationType=="%%14675",AttributeValue,null)))
as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value
values(OperationType) as OperationType values(src_user) as src_user by OpCorrelationID
ObjectDN SubjectLogonId | rex field=old_value max_match=10000 "(?i)LDAP://(?P<old_dn>cn.*?);(?P<old_flag>\d)\]"
| rex field=new_value max_match=10000 "(?i)LDAP://(?P<new_dn>cn.*?);(?P<new_flag>\d)\]"
| mvexpand old_dn
| where NOT old_dn IN (new_dn)
| eval ObjectDN=upper(old_dn)
| join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by ObjectDN ]
| stats min(eventTime) as _time values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId
| `windows_ad_gpo_deleted_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display
the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security and admon macros are configured with the correct indexes.
| mvexpand old_dn | where NOT old_dn IN (new_dn) | eval ObjectDN=upper(old_dn) |
join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*"
admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName)
as displayName by ObjectDN ] | stats min(eventTime) as _time values(OpCorrelationID)
as OpCorrelationID values(displayName) as policyName values(src_user) as src_user
by ObjectDN SubjectLogonId | `windows_ad_gpo_deleted_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136, admon data is also used to display the display name of the GPO. See
lantern article in references for further on how to onboard AD audit data. Ensure
the wineventlog_security and admon macros are configured with the correct indexes.
known_false_positives: Unknown
references:
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $src_user$
search: '%orginal_detection_search% | search src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 80
impact: 80
@@ -35,33 +42,33 @@ tags:
- T1562.001
- T1484.001
observable:
- name: src_user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 64
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-admon.log
source: ActiveDirectory
sourcetype: ActiveDirectory
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-admon.log
source: ActiveDirectory
sourcetype: ActiveDirectory
detections/application/windows_ad_gpo_disabled.yml
+44 -34
View File
@@ -7,21 +7,31 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: This detection identifies when an Active Directory Group Policy is disabled using the Group Policy Management Console.
search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=flags OperationType="%%14674" AttributeValue!=0
| eval AttributeValueExp=case(AttributeValue==0,"Enabled",AttributeValue==1,"User configuration settings disabled",AttributeValue==2,"Computer configuration settings disabled",AttributeValue==3,"Disabled"), ObjectDN=upper(ObjectDN)
| join ObjectDN type=inner [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by ObjectDN ]
| stats min(_time) as _time values(AttributeValue) as AttributeValue values(AttributeValueExp) as AttributeValueExp values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId
description: This detection identifies when an Active Directory Group Policy is disabled
using the Group Policy Management Console.
search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=flags OperationType="%%14674"
AttributeValue!=0 | eval AttributeValueExp=case(AttributeValue==0,"Enabled",AttributeValue==1,"User
configuration settings disabled",AttributeValue==2,"Computer configuration settings
disabled",AttributeValue==3,"Disabled"), ObjectDN=upper(ObjectDN) | join ObjectDN
type=inner [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update
| eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName
by ObjectDN ] | stats min(_time) as _time values(AttributeValue) as AttributeValue
values(AttributeValueExp) as AttributeValueExp values(OpCorrelationID) as OpCorrelationID
values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId
| `windows_ad_gpo_disabled_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display
the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security and admon macros are configured with the correct indexes.
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136, admon data is also used to display the display name of the GPO. See
lantern article in references for further on how to onboard AD audit data. Ensure
the wineventlog_security and admon macros are configured with the correct indexes.
known_false_positives: Unknown
references:
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $src_user$
search: '%orginal_detection_search% | search src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 80
impact: 80
@@ -30,33 +40,33 @@ tags:
- T1562.001
- T1484.001
observable:
- name: src_user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 64
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-security.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-admon.log
source: ActiveDirectory
sourcetype: ActiveDirectory
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-security.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-admon.log
source: ActiveDirectory
sourcetype: ActiveDirectory
detections/application/windows_ad_gpo_new_cse_addition.yml
+55 -43
View File
@@ -7,68 +7,80 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: This detection identifies when a a new client side extension is added to an Active Directory Group Policy using the Group Policy Management Console.
description: This detection identifies when a a new client side extension is added
to an Active Directory Group Policy using the Group Policy Management Console.
search: '`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
| rex field=old_value max_match=10000 "(?P<old_values>\{.*?\})"
| rex field=new_value max_match=10000 "(?P<new_values>\{.*?\})"
| rex field=ObjectDN max_match=10000 "CN=(?P<policy_guid>\{.*?\})"
| mvexpand new_values
| where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}")
| lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType
| eval newPolicy=if(policyType like "%",policyType,new_values)
| join ObjectDN [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | stats latest(displayName) as displayName by distinguishedName | eval ObjectDN=upper(distinguishedName)]
| stats values(OpCorrelationID) as OpCorrelationID values(src_user) as src_user values(SubjectLogonId) as SubjectLogonId values(newPolicy) as newPolicy values(displayName) as policyName by ObjectDN
| `windows_ad_gpo_new_cse_addition_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display
the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security and admon macros are configured with the correct indexes.
known_false_positives: General usage of group policy will trigger this detection, also please not GPOs modified using tools such as SharpGPOAbuse will not generate the AD audit events which enable this detection.
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null)))
as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value
values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user
SubjectLogonId | rex field=old_value max_match=10000 "(?P<old_values>\{.*?\})" |
rex field=new_value max_match=10000 "(?P<new_values>\{.*?\})" | rex field=ObjectDN
max_match=10000 "CN=(?P<policy_guid>\{.*?\})" | mvexpand new_values | where NOT
new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid)
AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}")
| lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType
| eval newPolicy=if(policyType like "%",policyType,new_values) | join ObjectDN [|
search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update
| stats latest(displayName) as displayName by distinguishedName | eval ObjectDN=upper(distinguishedName)]
| stats values(OpCorrelationID) as OpCorrelationID values(src_user) as src_user
values(SubjectLogonId) as SubjectLogonId values(newPolicy) as newPolicy values(displayName)
as policyName by ObjectDN | `windows_ad_gpo_new_cse_addition_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136, admon data is also used to display the display name of the GPO. See
lantern article in references for further on how to onboard AD audit data. Ensure
the wineventlog_security and admon macros are configured with the correct indexes.
known_false_positives: General usage of group policy will trigger this detection,
also please not GPOs modified using tools such as SharpGPOAbuse will not generate
the AD audit events which enable this detection.
references:
- https://wald0.com/?p=179
- https://learn.microsoft.com/en-gb/archive/blogs/mempson/group-policy-client-side-extension-list
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
- https://github.com/FSecureLABS/SharpGPOAbuse
drilldown_searches:
- name: View the detection results for $src_user$
search: '%orginal_detection_search% | search src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 100
impact: 100
message: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the policy $policyName$
message: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the
policy $policyName$
mitre_attack_id:
- T1484
- T1484.001
- T1222
- T1222.001
observable:
- name: src_user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-admon.log
source: ActiveDirectory
sourcetype: ActiveDirectory
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-admon.log
source: ActiveDirectory
sourcetype: ActiveDirectory
detections/application/windows_ad_hidden_ou_creation.yml
+65 -55
View File
@@ -7,40 +7,50 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators.
search: >-
`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
| rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
| rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
| mvexpand new_ace
| where NOT new_ace IN (old_values)
| rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
| rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
| lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
| lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value
| lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType
| lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
``` Optional SID resolution lookups
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
| lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
| lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
| eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
| stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
| eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
| search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO)
| `windows_ad_hidden_ou_creation_filter`
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136.
See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: None.
description: This analytic is looking for when an ACL is applied to an OU which denies
listing the objects residing in the OU. This activity combined with modifying the
owner of the OU will hide AD objects even from domain administrators.
search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats
min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null)))
as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value
values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user
SubjectLogonId | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" |
rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" | mvexpand new_ace |
where NOT new_ace IN (old_values) | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" |
rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" | rex max_match=100
field=aceFlags "(?P<aceFlags>[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid
OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string
as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string
as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string
as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName
as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` |
lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name
as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This
object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full
control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid),
user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType
values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights
values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid)
as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user
OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1
AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search
aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO)
| `windows_ad_hidden_ou_creation_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136. See lantern article in references for further on how to onboard AD audit
data. Ensure the wineventlog_security macro is configured with the correct indexes
and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: None.
references:
- https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $user$ and $src_user$
search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 100
impact: 100
@@ -50,34 +60,34 @@ tags:
- T1222
- T1222.001
observable:
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
detections/application/windows_ad_object_owner_updated.yml
+54 -47
View File
@@ -7,35 +7,42 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: AD Object Owner Updated. The owner provides Full control level privileges over the target AD Object. This event has significant impact alone and is also a precursor activity for hiding an AD object.
search: ' `wineventlog_security` EventCode=5136
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName
| rex field=old_value "O:(?P<old_owner>.*?)G:"
| rex field=new_value "O:(?P<new_owner>.*?)G:"
| where old_owner!=new_owner
``` optional SID resolution lookups
| lookup identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user
| lookup admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group
| lookup identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user
| lookup admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group
```
| lookup builtin_groups_lookup builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group
| lookup builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group
| eval user=coalesce(new_owner_user, new_owner_group, new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, old_owner_group, old_owner_group_builtin_group, old_owner)
| stats values(previousOwner) as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId by _time ObjectClass ObjectDN src_user OpCorrelationID DSName
| `windows_ad_object_owner_updated_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136.
See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
description: AD Object Owner Updated. The owner provides Full control level privileges
over the target AD Object. This event has significant impact alone and is also a
precursor activity for hiding an AD object.
search: ' `wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null)))
as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value
values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user
SubjectLogonId DSName | rex field=old_value "O:(?P<old_owner>.*?)G:" | rex field=new_value
"O:(?P<new_owner>.*?)G:" | where old_owner!=new_owner ``` optional SID resolution
lookups | lookup identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName
as new_owner_user | lookup admon_groups_def objectSid as new_owner OUTPUT cn as
new_owner_group | lookup identity_lookup_expanded objectSid as old_owner OUTPUT
downLevelDomainName as old_owner_user | lookup admon_groups_def objectSid as old_owner
OUTPUT cn as old_owner_group ``` | lookup builtin_groups_lookup builtin_group_string as
new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group | lookup
builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name
as old_owner_group_builtin_group | eval user=coalesce(new_owner_user, new_owner_group,
new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user,
old_owner_group, old_owner_group_builtin_group, old_owner) | stats values(previousOwner)
as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId by
_time ObjectClass ObjectDN src_user OpCorrelationID DSName | `windows_ad_object_owner_updated_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136. See lantern article in references for further on how to onboard AD audit
data. Ensure the wineventlog_security macro is configured with the correct indexes
and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: Unknown
references:
- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $user$ and $src_user$
search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 100
impact: 100
@@ -45,34 +52,34 @@ tags:
- T1222
- T1222.001
observable:
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
detections/application/windows_ad_privileged_group_modification.yml
+16 -9
View File
@@ -7,16 +7,22 @@ status: experimental
type: TTP
data_source:
- XmlWinEventLog:Security
description: Detect users added to privileged AD Groups.
search: '`wineventlog_security` EventCode IN (4728)
| stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name,src_user
| lookup admon_groups_def cn as Group_Name OUTPUT category
| where category="privileged" | `windows_ad_privileged_group_modification_filter`'
how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups.
See splunkbase app listed in the references for further details.
description: Detect users added to privileged AD Groups.
search: '`wineventlog_security` EventCode IN (4728) | stats min(_time) as _time dc(user)
as usercount, values(user) as user values(user_category) as user_category values(src_user_category)
as src_user_category values(dvc) as dvc by signature, Group_Name,src_user | lookup
admon_groups_def cn as Group_Name OUTPUT category | where category="privileged"
| `windows_ad_privileged_group_modification_filter`'
how_to_implement: This analytic requires eventCode 4728 to be ingested along with
the admon_groups_def lookup being configured to include a list of AD groups along
with a category to identify privileged groups. See splunkbase app listed in the
references for further details.
known_false_positives: None
references:
- https://splunkbase.splunk.com/app/6853
drilldown_searches:
- name: View the detection results for $user$
search: '%orginal_detection_search% | search user = $user$'
tags:
analytic_story:
- Active Directory Privilege Escalation
@@ -45,10 +51,11 @@ tags:
- Group_Name
- dest
security_domain: identity
manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested.
manual_test: This search uses a lookup provided by Enterprise Security and needs
to be manually tested.
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
sourcetype: XmlWinEventLog
detections/application/windows_ad_self_dacl_assignment.yml
+60 -53
View File
@@ -7,73 +7,80 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: Detect when a user creates a new DACL in AD for their own AD object.
search: >-
`wineventlog_security` EventCode=5136
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
| rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
| rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
| mvexpand new_ace
| where NOT new_ace IN (old_values)
| rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
| rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
| lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType
| lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
| lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value
| lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
``` Optional SID resolution lookups
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
| lookup admon_groups_def objectSid as aceSid OUTPUT cn as group
```
| lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
| eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid)
| stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
| eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
| rex field=user "\\\(?P<nt_user>.*?)$"
| where lower(src_user)=lower(nt_user)
| `windows_ad_self_dacl_assignment_filter`
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136.
See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
description: Detect when a user creates a new DACL in AD for their own AD object.
search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null)))
as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value
values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user
SubjectLogonId | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" |
rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" | mvexpand new_ace |
where NOT new_ace IN (old_values) | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" |
rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" | rex max_match=100
field=aceFlags "(?P<aceFlags>[A-Z]{2})" | lookup ace_type_lookup ace_type_string
as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string
as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup
access_rights_string as AccessRights OUTPUT access_rights_value | lookup msad_guid_lookup
guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID
resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT
downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT
cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT
builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType),
aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full
control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write
member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All
validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)),
user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType
values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights
values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid)
as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user
OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1
AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | rex field=user
"\\\(?P<nt_user>.*?)$" | where lower(src_user)=lower(nt_user) | `windows_ad_self_dacl_assignment_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136. See lantern article in references for further on how to onboard AD audit
data. Ensure the wineventlog_security macro is configured with the correct indexes
and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: Unknown
references:
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $src_user$
search: '%orginal_detection_search% | search src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 100
impact: 80
message: $src_user$ has created a DACL on $ObjectDN$ to grant themselves $aceControlAccessRights$ across $aceAccessRights$
message: $src_user$ has created a DACL on $ObjectDN$ to grant themselves $aceControlAccessRights$
across $aceAccessRights$
mitre_attack_id:
- T1484
- T1098
observable:
- name: src_user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 80
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
detections/application/windows_ad_suspicious_attribute_modification.yml
+54 -46
View File
@@ -7,67 +7,75 @@ status: production
type: TTP
data_source:
- Windows Security 5136
description: >-
This detection monitors changes to the following Active Directory attributes: "msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-KeyCredentialLink", "scriptPath", and "msTSInitialProgram".
Modifications to these attributes can indicate potential malicious activity or privilege escalation attempts. Immediate investigation is recommended upon alert.
search: >-
`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName IN ("msDS-AllowedToDelegateTo","msDS-AllowedToActOnBehalfOfOtherIdentity","scriptPath","msTSInitialProgram") OperationType=%%14674
```Changes to the attribute "msDS-KeyCredentialLink" are also worth moniroting, however tuning will need to be applied```
| table _time ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName AttributeValue AttributeLDAPDisplayName
| rename SubjectLogonId as TargetLogonId, src_user as initiator, _time as eventTime
| appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"]
| stats min(eventTime) as _time values(initiator) as src_user, values(DSName) as targetDomain, values(ObjectDN) as ObjectDN, values(ObjectClass) as ObjectClass, values(src_category) as src_category, values(src_ip) as src_ip values(LogonType) as LogonType values(AttributeValue) as AttributeValue values(AttributeLDAPDisplayName) as AttributeLDAPDisplayName by TargetLogonId
| rex field=ObjectDN "^CN=(?P<cn>.*?),[A-Z]{2}\="
| eval dest=if(ObjectClass="computer",cn,null), user=if(ObjectClass="user",cn,null)
| fields - cn
| `windows_ad_suspicious_attribute_modification_filter`
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136.
See lantern article in references for further on how to onboard AD audit data. Ensure the
wineventlog_security macro is configured with the correct indexes.
known_false_positives: If key credentials are regularly assigned to users, these events will need to be tuned out.
description: 'This detection monitors changes to the following Active Directory attributes:
"msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-KeyCredentialLink",
"scriptPath", and "msTSInitialProgram". Modifications to these attributes can indicate
potential malicious activity or privilege escalation attempts. Immediate investigation
is recommended upon alert.'
search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName IN ("msDS-AllowedToDelegateTo","msDS-AllowedToActOnBehalfOfOtherIdentity","scriptPath","msTSInitialProgram")
OperationType=%%14674 ```Changes to the attribute "msDS-KeyCredentialLink" are
also worth moniroting, however tuning will need to be applied``` | table _time ObjectClass
ObjectDN OpCorrelationID src_user SubjectLogonId DSName AttributeValue AttributeLDAPDisplayName |
rename SubjectLogonId as TargetLogonId, src_user as initiator, _time as eventTime |
appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] |
stats min(eventTime) as _time values(initiator) as src_user, values(DSName) as targetDomain,
values(ObjectDN) as ObjectDN, values(ObjectClass) as ObjectClass, values(src_category)
as src_category, values(src_ip) as src_ip values(LogonType) as LogonType values(AttributeValue)
as AttributeValue values(AttributeLDAPDisplayName) as AttributeLDAPDisplayName by
TargetLogonId | rex field=ObjectDN "^CN=(?P<cn>.*?),[A-Z]{2}\=" | eval dest=if(ObjectClass="computer",cn,null),
user=if(ObjectClass="user",cn,null) | fields - cn | `windows_ad_suspicious_attribute_modification_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically
event 5136. See lantern article in references for further on how to onboard AD audit
data. Ensure the wineventlog_security macro is configured with the correct indexes.
known_false_positives: If key credentials are regularly assigned to users, these events
will need to be tuned out.
references:
- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $src_user$ and $dest$
search: '%orginal_detection_search% | search src_user = $src_user$ dest = $dest$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 100
impact: 100
message: $src_user$ has added $AttributeLDAPDisplayName$ ACL rights to $ObjectClass$ $ObjectDN$
message: $src_user$ has added $AttributeLDAPDisplayName$ ACL rights to $ObjectClass$
$ObjectDN$
mitre_attack_id:
- T1550
- T1222
- T1222.001
observable:
- name: src_user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: src_user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 100
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/suspicious_acl_modification-windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/suspicious_acl_modification-windows-security-xml.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
detections/application/windows_ad_suspicious_gpo_modification.yml
+71 -56
View File
@@ -8,34 +8,45 @@ type: TTP
data_source:
- Windows Security 5136
- Windows Security 5145
description: This analytic looks for a the creation of potentially harmful GPO which could lead to persistence or code execution on remote hosts.
Note, this analyic is looking for the absence of the corresponding 5136 events which is evidence of the GPOs being manually edited (using a tool like PowerView) or potentially missing logs.
search: >-
`wineventlog_security` EventCode=5145 ShareName="\\\\*\\SYSVOL" RelativeTargetName IN (*\\ScheduledTasks.xml, *\\Groups.xml, *\\Registry.xml, *\\Services.xml, *\\Scripts\\*) NOT RelativeTargetName=*\\Scripts\\scripts.ini AccessMask=0x2
| rex field=AccessList max_match=0 "(?P<AccessList>%%\d+)"
| table _time AccessMask src_ip src_user RelativeTargetName Logon_ID dvc
| rex field=RelativeTargetName "Policies\\\(?P<gpo_guid>{.*?})\\\(?P<scope>\w+?)\\\(\w+)\\\(?P<folder>\w+)\\\(?P<file>\w+\.\w+)$"
| eval src=if(match(src_ip, "(?i)^fe80:"),dvc,src_ip), folder=case(RelativeTargetName like "%\\Scripts\\%","Scripts",folder="Groups","Local users and groups",1=1,folder)
| appendpipe
[| map search="search `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames $gpo_guid$"
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
| rex field=old_value max_match=10000 "(?P<old_values>\{.*?\})"
| rex field=new_value max_match=10000 "(?P<new_values>\{.*?\})"
| rex field=ObjectDN max_match=10000 "CN=(?P<policy_guid>\{.*?\})"
| mvexpand new_values
| where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}")
| lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType
| eval newPolicy=if(policyType like "%",policyType,new_values)
| stats values(OpCorrelationID) as OpCorrelationID values(newPolicy) as newPolicy by ObjectDN
| rex field=ObjectDN max_match=10000 "CN=(?P<gpo_guid>\{.*?\})"
| fields - ObjectDN]
| stats values(AccessMask) as AccessMask values(src) as src values(src_user) as src_user values(RelativeTargetName) as RelativeTargetName values(Logon_ID) as Logon_ID values(newPolicy) as newPolicy values(OpCorrelationID) as OpCorrelationID values(folder) as folder values(file) as file by gpo_guid
| mvexpand folder
| where NOT folder IN (newPolicy)
| `windows_ad_suspicious_gpo_modification_filter`
how_to_implement: Ingest EventCodes 5145 and 5136 from domain controllers. Additional SACLs required to capture EventCode 5136, see references for further information on how to configure this.
The Group Policy - Audit Detailed File Share will need to be enabled on the DCs to generate event code 5145, this event is very noisy on DCs, consider tuning out sysvol events which do not match access mask 0x2.
known_false_positives: When a GPO is manually edited and 5136 events are not logging to Splunk.
description: This analytic looks for a the creation of potentially harmful GPO which
could lead to persistence or code execution on remote hosts. Note, this analyic
is looking for the absence of the corresponding 5136 events which is evidence of
the GPOs being manually edited (using a tool like PowerView) or potentially missing
logs.
search: "`wineventlog_security` EventCode=5145 ShareName=\"\\\\\\\\*\\\\SYSVOL\" RelativeTargetName\
\ IN (*\\\\ScheduledTasks.xml, *\\\\Groups.xml, *\\\\Registry.xml, *\\\\Services.xml,\
\ *\\\\Scripts\\\\*) NOT RelativeTargetName=*\\\\Scripts\\\\scripts.ini AccessMask=0x2\
\ | rex field=AccessList max_match=0 \"(?P<AccessList>%%\\d+)\" | table _time\
\ AccessMask src_ip src_user RelativeTargetName Logon_ID dvc | rex field=RelativeTargetName\
\ \"Policies\\\\\\(?P<gpo_guid>{.*?})\\\\\\(?P<scope>\\w+?)\\\\\\(\\w+)\\\\\\(?P<folder>\\\
w+)\\\\\\(?P<file>\\w+\\.\\w+)$\" | eval src=if(match(src_ip, \"(?i)^fe80:\"),dvc,src_ip),\
\ folder=case(RelativeTargetName like \"%\\\\Scripts\\\\%\",\"Scripts\",folder=\"\
Groups\",\"Local users and groups\",1=1,folder) | appendpipe \n [| map search=\"\
search `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames\
\ $gpo_guid$\" \n | stats min(_time) as _time values(eval(if(OperationType==\"\
%%14675\",AttributeValue,null))) as old_value values(eval(if(OperationType==\"%%14674\"\
,AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass\
\ ObjectDN OpCorrelationID src_user SubjectLogonId \n | rex field=old_value max_match=10000\
\ \"(?P<old_values>\\{.*?\\})\" \n | rex field=new_value max_match=10000 \"(?P<new_values>\\\
{.*?\\})\" \n | rex field=ObjectDN max_match=10000 \"CN=(?P<policy_guid>\\{.*?\\\
})\" \n | mvexpand new_values \n | where NOT new_values IN (old_values,\"{00000000-0000-0000-0000-000000000000}\"\
,policy_guid) AND match(new_values, \"^\\{[A-Z|\\d]+\\-[A-Z|\\d]+\\-[A-Z|\\d]+\\\
-[A-Z|\\d]+\\-[A-Z|\\d]+\\}\") \n | lookup msad_guid_lookup guid as new_values\
\ OUTPUTNEW displayName as policyType \n | eval newPolicy=if(policyType like \"\
%\",policyType,new_values) \n | stats values(OpCorrelationID) as OpCorrelationID\
\ values(newPolicy) as newPolicy by ObjectDN \n | rex field=ObjectDN max_match=10000\
\ \"CN=(?P<gpo_guid>\\{.*?\\})\" \n | fields - ObjectDN] \n| stats values(AccessMask)\
\ as AccessMask values(src) as src values(src_user) as src_user values(RelativeTargetName)\
\ as RelativeTargetName values(Logon_ID) as Logon_ID values(newPolicy) as newPolicy\
\ values(OpCorrelationID) as OpCorrelationID values(folder) as folder values(file)\
\ as file by gpo_guid | mvexpand folder | where NOT folder IN (newPolicy) | `windows_ad_suspicious_gpo_modification_filter`"
how_to_implement: Ingest EventCodes 5145 and 5136 from domain controllers. Additional
SACLs required to capture EventCode 5136, see references for further information
on how to configure this. The Group Policy - Audit Detailed File Share will need
to be enabled on the DCs to generate event code 5145, this event is very noisy on
DCs, consider tuning out sysvol events which do not match access mask 0x2.
known_false_positives: When a GPO is manually edited and 5136 events are not logging
to Splunk.
references:
- https://github.com/PowerShellMafia/PowerSploit/blob/26a0757612e5654b4f792b012ab8f10f95d391c9/Recon/PowerView.ps1#L5907-L6122
- https://github.com/X-C3LL/GPOwned
@@ -43,47 +54,51 @@ references:
- https://wald0.com/?p=179
- https://github.com/FSecureLABS/SharpGPOAbuse
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
drilldown_searches:
- name: View the detection results for $user$ and $src_user$
search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 80
impact: 100
message: $src_user$ has added new GPO Client Side Extensions $folder$ to the policy $gpo_guid$
message: $src_user$ has added new GPO Client Side Extensions $folder$ to the policy
$gpo_guid$
mitre_attack_id:
- T1484
- T1484.001
- T1222
- T1222.001
observable:
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
- name: user
type: User
role:
- Victim
- name: src_user
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 80
required_fields:
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
- _time
- OperationType
- ObjectDN
- OpCorrelationID
- src_user
- AttributeLDAPDisplayName
- AttributeValue
- ObjectClass
- SubjectLogonId
- DSName
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/gpo_new_cse/windows-security.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/gpo_new_cse/windows-security.log
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
detections/application/windows_increase_in_group_or_object_modification_activity.yml
+13 -12
View File
@@ -12,21 +12,22 @@ description: This analytic detects an increase in modifications to AD groups or
such as unauthorized access attempts, impairing defences or establishing persistence.
By monitoring AD logs for unusual modification patterns, this detection helps identify
suspicious behavior that could compromise the integrity and security of the AD environment.
search: >-
`wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764)
| bucket span=5m _time
| stats values(object) as object, dc(object) as objectCount, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status
| eventstats avg(objectCount) as comp_avg, stdev(objectCount) as comp_std by src_user, signature
| eval upperBound=(comp_avg+comp_std)
| eval isOutlier=if(objectCount > 10 and (objectCount >= upperBound), 1, 0)
| search isOutlier=1
| `windows_increase_in_group_or_object_modification_activity_filter`
how_to_implement: Run this detection looking over a 7 day timeframe for best results.
search: '`wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764) | bucket
span=5m _time | stats values(object) as object, dc(object) as objectCount, values(src_user_category)
as src_user_category, values(dest) as dest, values(dest_category) as dest_category
by _time, src_user, signature, status | eventstats avg(objectCount) as comp_avg,
stdev(objectCount) as comp_std by src_user, signature | eval upperBound=(comp_avg+comp_std)
| eval isOutlier=if(objectCount > 10 and (objectCount >= upperBound), 1, 0) | search
isOutlier=1 | `windows_increase_in_group_or_object_modification_activity_filter`'
how_to_implement: Run this detection looking over a 7 day timeframe for best results.
known_false_positives: Unknown
references: []
drilldown_searches:
- name: View the detection results for $src_user$
search: '%orginal_detection_search% | search src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 40
impact: 20
@@ -54,4 +55,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
sourcetype: XmlWinEventLog
detections/application/windows_increase_in_user_modification_activity.yml
+17 -13
View File
@@ -12,22 +12,26 @@ description: This analytic detects an increase in modifications to AD user objec
such as unauthorized access attempts, impairing defences or establishing persistence.
By monitoring AD logs for unusual modification patterns, this detection helps identify
suspicious behavior that could compromise the integrity and security of the AD environment.
search: >-
`wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780)
| bucket span=5m _time
| stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status
| eventstats avg(userCount) as comp_avg , stdev(userCount) as comp_std by src_user, signature
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0)
| search isOutlier=1
| stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category values(signature) as signature by _time, src_user, status
| `windows_increase_in_user_modification_activity_filter`
how_to_implement: Run this detection looking over a 7 day timeframe for best results.
search: '`wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780)
| bucket span=5m _time | stats values(TargetDomainName) as TargetDomainName, values(user)
as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category)
as src_user_category, values(dest) as dest, values(dest_category) as dest_category
by _time, src_user, signature, status | eventstats avg(userCount) as comp_avg ,
stdev(userCount) as comp_std by src_user, signature | eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0) | search
isOutlier=1 | stats values(TargetDomainName) as TargetDomainName, values(user) as
user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category)
as src_user_category, values(dest) as dest, values(dest_category) as dest_category
values(signature) as signature by _time, src_user, status | `windows_increase_in_user_modification_activity_filter`'
how_to_implement: Run this detection looking over a 7 day timeframe for best results.
known_false_positives: Genuine activity
references: []
drilldown_searches:
- name: View the detection results for $src_user$
search: '%orginal_detection_search% | search src_user = $src_user$'
tags:
analytic_story:
- Sneaky Active Directory Persistence Tricks
- Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
confidence: 40
impact: 20
@@ -55,4 +59,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
sourcetype: XmlWinEventLog