diff --git a/detections/application/crushftp_server_side_template_injection.yml b/detections/application/crushftp_server_side_template_injection.yml index 6794bec15a..9c8c20f034 100644 --- a/detections/application/crushftp_server_side_template_injection.yml +++ b/detections/application/crushftp_server_side_template_injection.yml @@ -3,30 +3,48 @@ id: ccf6b7a3-bd39-4bc9-a949-143a8d640dbc version: 1 date: '2024-05-16' author: Michael Haag, Splunk -data_source: +data_source: - CrushFTP type: TTP status: production -description: This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This severe vulnerability enables unauthenticated remote attackers to access and read files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary commands on the affected server. The issue impacts all versions of CrushFTP up to 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply patches immediately to prevent unauthorized access to the system and avoid potential data compromises. The search specifically looks for patterns in the raw log data that match the exploitation attempts, including READ or WRITE actions, and extracts relevant information such as the protocol, session ID, user, IP address, HTTP method, and the URI queried. It then evaluates these logs to confirm traces of exploitation based on the presence of specific keywords and the originating IP address, counting and sorting these events for further analysis. -search: '`crushftp` - | rex field=_raw "\[(?HTTPS|HTTP):(?[^\:]+):(?[^\:]+):(?\d+\.\d+\.\d+\.\d+)\] (?READ|WROTE): \*(?[A-Z]+) (?[^\s]+) HTTP/[^\*]+\*" - | eval message=if(match(_raw, "INCLUDE") and isnotnull(src_ip), "traces of exploitation by " . src_ip, "false") - | search message!=false - | rename host as dest - | stats count by _time, dest, source, message, src_ip, http_method, uri_query, user, action - | sort -_time| `crushftp_server_side_template_injection_filter`' -how_to_implement: CrushFTP Session logs, from Windows or Linux, must be ingested to Splunk. Currently, there is no TA for CrushFTP, so the data must be extracted from the raw logs. -known_false_positives: False positives should be limited, however tune or filter as needed. +description: This analytic is designed to identify attempts to exploit a server-side + template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This + severe vulnerability enables unauthenticated remote attackers to access and read + files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary + commands on the affected server. The issue impacts all versions of CrushFTP up to + 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply + patches immediately to prevent unauthorized access to the system and avoid potential + data compromises. The search specifically looks for patterns in the raw log data + that match the exploitation attempts, including READ or WRITE actions, and extracts + relevant information such as the protocol, session ID, user, IP address, HTTP method, + and the URI queried. It then evaluates these logs to confirm traces of exploitation + based on the presence of specific keywords and the originating IP address, counting + and sorting these events for further analysis. +search: '`crushftp` | rex field=_raw "\[(?HTTPS|HTTP):(?[^\:]+):(?[^\:]+):(?\d+\.\d+\.\d+\.\d+)\] + (?READ|WROTE): \*(?[A-Z]+) (?[^\s]+) HTTP/[^\*]+\*" + | eval message=if(match(_raw, "INCLUDE") and isnotnull(src_ip), "traces of exploitation + by " . src_ip, "false") | search message!=false | rename host as dest | stats count + by _time, dest, source, message, src_ip, http_method, uri_query, user, action | + sort -_time| `crushftp_server_side_template_injection_filter`' +how_to_implement: CrushFTP Session logs, from Windows or Linux, must be ingested to + Splunk. Currently, there is no TA for CrushFTP, so the data must be extracted from + the raw logs. +known_false_positives: False positives should be limited, however tune or filter as + needed. references: - https://github.com/airbus-cert/CVE-2024-4040 - https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/ +drilldown_searches: +- name: View the detection results for $dest$ + search: '%orginal_detection_search% | search dest = $dest$' tags: analytic_story: - CrushFTP Vulnerabilities asset_type: Web Application confidence: 80 impact: 80 - message: Potential exploitation of CrushFTP Server Side Template Injection Vulnerability on $dest$ by $src_ip$. + message: Potential exploitation of CrushFTP Server Side Template Injection Vulnerability + on $dest$ by $src_ip$. mitre_attack_id: - T1190 observable: diff --git a/detections/application/detect_new_login_attempts_to_routers.yml b/detections/application/detect_new_login_attempts_to_routers.yml index da1110bdb6..7d9a4eb300 100644 --- a/detections/application/detect_new_login_attempts_to_routers.yml +++ b/detections/application/detect_new_login_attempts_to_routers.yml @@ -24,6 +24,9 @@ how_to_implement: To successfully implement this search, you must ensure the net to routing infrastructure. known_false_positives: Legitimate router connections may appear as new connections references: [] +drilldown_searches: +- name: View the detection results for $user$ and $dest$ + search: '%orginal_detection_search% | search user = $user$ dest = $dest$' tags: analytic_story: - Router and Infrastructure Security diff --git a/detections/application/detect_password_spray_attempts.yml b/detections/application/detect_password_spray_attempts.yml index 6a90bbebdc..f070f15aaf 100644 --- a/detections/application/detect_password_spray_attempts.yml +++ b/detections/application/detect_password_spray_attempts.yml @@ -7,34 +7,37 @@ status: production type: TTP data_source: - Windows Event Log Security 4625 -description: This analytic employs the 3-sigma approach to detect an unusual volume of failed authentication attempts - from a single source. A password spray attack is a type of brute force attack where an attacker tries a few - common passwords across many different accounts to avoid detection and account lockouts. By utilizing the - Authentication Data Model, this detection is effective for all CIM-mapped authentication events, providing - comprehensive coverage and enhancing security against these attacks. -search: '| tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts values(Authentication.app) as app count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action="failure" by Authentication.src, Authentication.action, Authentication.signature_id, sourcetype, _time span=2m - | `drop_dm_object_name("Authentication")` - ```fill out time buckets for 0-count events during entire search length``` - | appendpipe [| timechart limit=0 span=5m count | table _time] - | fillnull value=0 unique_accounts, unique_src - ``` remove duplicate & empty time buckets``` - | sort - total_failures - | dedup _time - ``` Create aggregation field & apply to all null events``` - | eval counter=src+"__"+sourcetype+"__"+signature_id +description: This analytic employs the 3-sigma approach to detect an unusual volume + of failed authentication attempts from a single source. A password spray attack + is a type of brute force attack where an attacker tries a few common passwords across + many different accounts to avoid detection and account lockouts. By utilizing the + Authentication Data Model, this detection is effective for all CIM-mapped authentication + events, providing comprehensive coverage and enhancing security against these attacks. +search: '| tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts + values(Authentication.app) as app count(Authentication.user) as total_failures from + datamodel=Authentication.Authentication where Authentication.action="failure" by + Authentication.src, Authentication.action, Authentication.signature_id, sourcetype, + _time span=2m | `drop_dm_object_name("Authentication")` ```fill out time buckets + for 0-count events during entire search length``` | appendpipe [| timechart limit=0 + span=5m count | table _time] | fillnull value=0 unique_accounts, unique_src ``` + remove duplicate & empty time buckets``` | sort - total_failures | dedup _time ``` + Create aggregation field & apply to all null events``` | eval counter=src+"__"+sourcetype+"__"+signature_id | eventstats values(counter) as fnscounter | eval counter=coalesce(counter,fnscounter) - | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by counter - | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 30 and unique_accounts >= upperBound, 1, 0) - | replace "::ffff:*" with * in src - | where isOutlier=1 - | foreach * [ eval <> = if(<>="null",null(),<>)] + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std + by counter | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts + > 30 and unique_accounts >= upperBound, 1, 0) | replace "::ffff:*" with * in src + | where isOutlier=1 | foreach * [ eval <> = if(<>="null",null(),<>)] | table _time, src, action, app, unique_accounts, total_failures, sourcetype, signature_id | `detect_password_spray_attempts_filter`' -how_to_implement: Ensure in-scope authentication data is CIM mapped and the src field is populated with the source device. Also ensure fill_nullvalue is set within the macro security_content_summariesonly. +how_to_implement: Ensure in-scope authentication data is CIM mapped and the src field + is populated with the source device. Also ensure fill_nullvalue is set within the + macro security_content_summariesonly. known_false_positives: Unknown references: - https://attack.mitre.org/techniques/T1110/003/ +drilldown_searches: +- name: View the detection results for + search: '%orginal_detection_search% | search unique_accounts = $unique_accounts$' tags: analytic_story: - Compromised User Account @@ -44,7 +47,8 @@ tags: - 90bc2e54-6c84-47a5-9439-0a2a92b4b175 confidence: 70 impact: 70 - message: Potential Password Spraying attack from $src$ targeting $unique_accounts$ unique accounts. + message: Potential Password Spraying attack from $src$ targeting $unique_accounts$ + unique accounts. mitre_attack_id: - T1110.003 - T1110 @@ -53,8 +57,8 @@ tags: type: Endpoint role: - Attacker - - name: sourcetype - type: Other + - name: unique_accounts + type: User role: - Victim product: @@ -72,4 +76,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog diff --git a/detections/application/email_attachments_with_lots_of_spaces.yml b/detections/application/email_attachments_with_lots_of_spaces.yml index 976223f493..062110d92a 100644 --- a/detections/application/email_attachments_with_lots_of_spaces.yml +++ b/detections/application/email_attachments_with_lots_of_spaces.yml @@ -38,6 +38,9 @@ how_to_implement: 'You need to ingest data from emails. Specifically, the sender email will be deleted from the user''s inbox.' known_false_positives: None at this time references: [] +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Data Destruction diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml index f37061e330..4766dc0aea 100644 --- a/detections/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/application/email_files_written_outside_of_the_outlook_directory.yml @@ -32,6 +32,9 @@ known_false_positives: Administrators and users sometimes prefer backing up thei email data by moving the email files into a different folder. These attempts will be detected by the search. references: [] +drilldown_searches: +- name: View the detection results for $dest$ + search: '%orginal_detection_search% | search dest = $dest$' tags: analytic_story: - Collection and Staging diff --git a/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml index 1ab995f9d1..6a5cbf2f54 100644 --- a/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml +++ b/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml @@ -38,6 +38,9 @@ known_false_positives: The false-positive rate will vary based on how you set th deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers. references: [] +drilldown_searches: +- name: View the detection results for $dest$ + search: '%orginal_detection_search% | search dest = $dest$' tags: analytic_story: - Collection and Staging diff --git a/detections/application/ivanti_vtm_new_account_creation.yml b/detections/application/ivanti_vtm_new_account_creation.yml index fe54c0e7f3..e954cce656 100644 --- a/detections/application/ivanti_vtm_new_account_creation.yml +++ b/detections/application/ivanti_vtm_new_account_creation.yml @@ -3,28 +3,42 @@ id: b04be6e5-2002-4349-8742-52285635b8f5 version: 1 date: '2024-08-19' author: Michael Haag, Splunk -data_source: +data_source: - Ivanti VTM Audit type: TTP status: production -description: This analytic detects potential exploitation of the Ivanti Virtual Traffic Manager (vTM) authentication bypass vulnerability (CVE-2024-7593) to create new administrator accounts. The vulnerability allows unauthenticated remote attackers to bypass authentication on the admin panel and create new admin users. This detection looks for suspicious new account creation events in the Ivanti vTM audit logs that lack expected authentication details, which may indicate exploitation attempts. -search: '`ivanti_vtm_audit` OPERATION="adduser" MODGROUP="admin" IP="!!ABSENT!!" - | stats count min(_time) as firstTime max(_time) as lastTime by IP, MODUSER, OPERATION, MODGROUP, AUTH - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic detects potential exploitation of the Ivanti Virtual Traffic + Manager (vTM) authentication bypass vulnerability (CVE-2024-7593) to create new + administrator accounts. The vulnerability allows unauthenticated remote attackers + to bypass authentication on the admin panel and create new admin users. This detection + looks for suspicious new account creation events in the Ivanti vTM audit logs that + lack expected authentication details, which may indicate exploitation attempts. +search: '`ivanti_vtm_audit` OPERATION="adduser" MODGROUP="admin" IP="!!ABSENT!!" | + stats count min(_time) as firstTime max(_time) as lastTime by IP, MODUSER, OPERATION, + MODGROUP, AUTH | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ivanti_vtm_new_account_creation_filter`' -how_to_implement: To implement this detection, ensure that Ivanti vTM audit logs are being ingested into Splunk. Configure the Ivanti vTM to send its audit logs to Splunk via syslog or by monitoring the log files directly. The sourcetype should be set to "ivanti_vtm_audit" or a similar custom sourcetype for these logs. -known_false_positives: Legitimate new account creation by authorized administrators will generate similar log entries. However, those should include proper authentication details. Verify any detected events against expected administrative activities and authorized user lists. +how_to_implement: To implement this detection, ensure that Ivanti vTM audit logs are + being ingested into Splunk. Configure the Ivanti vTM to send its audit logs to Splunk + via syslog or by monitoring the log files directly. The sourcetype should be set + to "ivanti_vtm_audit" or a similar custom sourcetype for these logs. +known_false_positives: Legitimate new account creation by authorized administrators + will generate similar log entries. However, those should include proper authentication + details. Verify any detected events against expected administrative activities and + authorized user lists. references: - https://www.ivanti.com/security/security-advisories/ivanti-virtual-traffic-manager-vtm-cve-2024-7593 - https://nvd.nist.gov/vuln/detail/CVE-2024-7593 +drilldown_searches: +- name: View the detection results for $MODUSER$ + search: '%orginal_detection_search% | search MODUSER = $MODUSER$' tags: analytic_story: - Ivanti Virtual Traffic Manager CVE-2024-7593 asset_type: Web Application confidence: 80 impact: 90 - message: A new administrator account, $MODUSER$, was created on Ivanti vTM device without proper authentication, which may indicate exploitation of CVE-2024-7593. + message: A new administrator account, $MODUSER$, was created on Ivanti vTM device + without proper authentication, which may indicate exploitation of CVE-2024-7593. mitre_attack_id: - T1190 observable: diff --git a/detections/application/monitor_email_for_brand_abuse.yml b/detections/application/monitor_email_for_brand_abuse.yml index cc2471bbca..b3ac26facd 100644 --- a/detections/application/monitor_email_for_brand_abuse.yml +++ b/detections/application/monitor_email_for_brand_abuse.yml @@ -26,6 +26,9 @@ how_to_implement: You need to ingest email header data. Specifically the sender' be checked for. known_false_positives: None at this time references: [] +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Brand Monitoring diff --git a/detections/application/okta_authentication_failed_during_mfa_challenge.yml b/detections/application/okta_authentication_failed_during_mfa_challenge.yml index 489b0178cb..a1cc27f6a4 100644 --- a/detections/application/okta_authentication_failed_during_mfa_challenge.yml +++ b/detections/application/okta_authentication_failed_during_mfa_challenge.yml @@ -3,7 +3,7 @@ id: e2b99e7d-d956-411a-a120-2b14adfdde93 version: 2 date: '2024-05-29' author: Bhavin Patel, Splunk -data_source: +data_source: - Okta type: TTP status: production @@ -31,6 +31,9 @@ known_false_positives: A user may have accidentally entered the wrong credential references: - https://sec.okta.com/everythingisyes - https://splunkbase.splunk.com/app/6553 +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed.log source: okta_log sourcetype: OktaIM2:log diff --git a/detections/application/okta_idp_lifecycle_modifications.yml b/detections/application/okta_idp_lifecycle_modifications.yml index a9052093c0..52408a9bc4 100644 --- a/detections/application/okta_idp_lifecycle_modifications.yml +++ b/detections/application/okta_idp_lifecycle_modifications.yml @@ -3,7 +3,7 @@ id: e0be2c83-5526-4219-a14f-c3db2e763d15 version: 2 date: '2024-05-28' author: Bhavin Patel, Splunk -data_source: +data_source: - Okta type: Anomaly status: production @@ -30,6 +30,9 @@ known_false_positives: It's possible for legitimate administrative actions or au references: - https://www.obsidiansecurity.com/blog/behind-the-breach-cross-tenant-impersonation-in-okta/ - https://splunkbase.splunk.com/app/6553 +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Suspicious Okta Activity @@ -69,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/okta_idp/okta.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/okta_idp/okta.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml b/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml index 03a6a1aa0e..bb86575e86 100644 --- a/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml +++ b/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml @@ -5,9 +5,9 @@ date: '2024-05-19' author: John Murphy and Jordan Ruocco, Okta, Michael Haag, Splunk type: TTP status: experimental -data_source: +data_source: - Okta -description: 'The following analytic identifies discrepancies between the source and +description: The following analytic identifies discrepancies between the source and response events for Okta Verify Push requests, indicating potential suspicious behavior. It leverages Okta System Log events, specifically `system.push.send_factor_verify_push` and `user.authentication.auth_via_mfa` with the factor "OKTA_VERIFY_PUSH." The detection @@ -15,7 +15,7 @@ description: 'The following analytic identifies discrepancies between the source requests, and checks for session roaming and new device/IP usage. This activity is significant as it may indicate push spam or unauthorized access attempts. If confirmed malicious, attackers could bypass MFA, leading to unauthorized access - to sensitive systems.' + to sensitive systems. search: '`okta` eventType IN (system.push.send_factor_verify_push) OR (eventType IN (user.authentication.auth_via_mfa) debugContext.debugData.factor="OKTA_VERIFY_PUSH") | eval groupby="authenticationContext.externalSessionId" | eval group_push_time=_time @@ -42,6 +42,9 @@ known_false_positives: False positives may be present based on organization size references: - https://attack.mitre.org/techniques/T1621 - https://splunkbase.splunk.com/app/6553 +drilldown_searches: +- name: View the detection results for $actor.alternateId$ + search: '%orginal_detection_search% | search actor.alternateId = $actor.alternateId$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_multi_factor_authentication_disabled.yml b/detections/application/okta_multi_factor_authentication_disabled.yml index 478f4dbbac..edc990a219 100644 --- a/detections/application/okta_multi_factor_authentication_disabled.yml +++ b/detections/application/okta_multi_factor_authentication_disabled.yml @@ -3,7 +3,7 @@ id: 7c0348ce-bdf9-45f6-8a57-c18b5976f00a version: 2 date: '2024-05-13' author: Mauricio Velazco, Splunk -data_source: +data_source: - Okta type: TTP status: production @@ -28,6 +28,9 @@ known_false_positives: Legitimate use case may require for users to disable MFA. references: - https://attack.mitre.org/techniques/T1556/ - https://splunkbase.splunk.com/app/6553 +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover @@ -66,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/okta_mfa_method_disabled.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/okta_mfa_method_disabled.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_multiple_accounts_locked_out.yml b/detections/application/okta_multiple_accounts_locked_out.yml index daf67758d4..122ff16ae3 100644 --- a/detections/application/okta_multiple_accounts_locked_out.yml +++ b/detections/application/okta_multiple_accounts_locked_out.yml @@ -3,7 +3,7 @@ id: a511426e-184f-4de6-8711-cfd2af29d1e1 version: 2 date: '2024-05-11' author: Michael Haag, Mauricio Velazco, Splunk -data_source: +data_source: - Okta type: Anomaly status: production @@ -27,6 +27,9 @@ known_false_positives: Multiple account lockouts may be also triggered by an app references: - https://attack.mitre.org/techniques/T1110/ - https://splunkbase.splunk.com/app/6553 +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover @@ -64,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/okta_multiple_accounts_lockout.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/okta_multiple_accounts_lockout.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_multiple_failed_mfa_requests_for_user.yml b/detections/application/okta_multiple_failed_mfa_requests_for_user.yml index bf761654d3..a670e35970 100644 --- a/detections/application/okta_multiple_failed_mfa_requests_for_user.yml +++ b/detections/application/okta_multiple_failed_mfa_requests_for_user.yml @@ -3,7 +3,7 @@ id: 826dbaae-a1e6-4c8c-b384-d16898956e73 version: 2 date: '2024-05-20' author: Mauricio Velazco, Splunk -data_source: +data_source: - Okta type: Anomaly status: production @@ -26,6 +26,9 @@ known_false_positives: Multiple Failed MFA requests may also be a sign of authen or application issues. Filter as needed and monitor for any unusual activity. references: - https://attack.mitre.org/techniques/T1621/ +drilldown_searches: +- name: View the detection results for $src_user$ + search: '%orginal_detection_search% | search src_user = $src_user$' tags: analytic_story: - Okta Account Takeover @@ -61,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/okta_multiple_failed_mfa_requests.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/okta_multiple_failed_mfa_requests.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml b/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml index 4f1af7ca0b..01ab48db71 100644 --- a/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml @@ -3,7 +3,7 @@ id: de365ffa-42f5-46b5-b43f-fa72290b8218 version: 2 date: '2024-05-28' author: Michael Haag, Mauricio Velazco, Splunk -data_source: +data_source: - Okta type: Anomaly status: production @@ -29,6 +29,9 @@ known_false_positives: A source Ip failing to authenticate with multiple users i references: - https://attack.mitre.org/techniques/T1110/003/ - https://splunkbase.splunk.com/app/6553 +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover @@ -66,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/okta_multiple_users_from_ip.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/okta_multiple_users_from_ip.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_new_api_token_created.yml b/detections/application/okta_new_api_token_created.yml index 4c4200cccb..4e8e30ee38 100644 --- a/detections/application/okta_new_api_token_created.yml +++ b/detections/application/okta_new_api_token_created.yml @@ -13,7 +13,7 @@ description: The following analytic detects the creation of a new API token with persistence. If confirmed malicious, this could enable attackers to execute API calls, access sensitive data, and perform administrative actions within the Okta environment. -data_source: +data_source: - Okta search: ' | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Change where All_Changes.action=created AND @@ -28,6 +28,9 @@ known_false_positives: False positives may be present. Tune Okta and tune the an references: - https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected - https://splunkbase.splunk.com/app/6553 +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover @@ -66,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/okta_new_api_token_created/okta_new_api_token_created.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/okta_new_api_token_created/okta_new_api_token_created.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_new_device_enrolled_on_account.yml b/detections/application/okta_new_device_enrolled_on_account.yml index 76288f15e1..59da8c6014 100644 --- a/detections/application/okta_new_device_enrolled_on_account.yml +++ b/detections/application/okta_new_device_enrolled_on_account.yml @@ -13,7 +13,7 @@ description: The following analytic identifies when a new device is enrolled on to potential account takeover, unauthorized access, and persistent control over the compromised Okta account. Monitoring this behavior is crucial for detecting and mitigating unauthorized access attempts. -data_source: +data_source: - Okta search: ' | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Change where All_Changes.action=created All_Changes.command=device.enrollment.create @@ -27,6 +27,9 @@ known_false_positives: It is possible that the user has legitimately added a new references: - https://attack.mitre.org/techniques/T1098/005/ - https://developer.okta.com/docs/reference/api/event-types/?q=device.enrollment.create +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover @@ -61,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.005/okta_new_device_enrolled/okta_new_device_enrolled.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.005/okta_new_device_enrolled/okta_new_device_enrolled.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml b/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml index 8fad808cf6..3798c39b7c 100644 --- a/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml +++ b/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml @@ -5,7 +5,7 @@ date: '2024-05-15' author: Okta, Inc, Michael Haag, Splunk type: TTP status: experimental -data_source: +data_source: - Okta description: The following analytic identifies failed user authentication attempts in Okta due to FastPass declining a phishing attempt. It leverages Okta logs, specifically @@ -26,6 +26,9 @@ known_false_positives: Fidelity of this is high as Okta is specifying malicious Filter and modify as needed. references: - https://sec.okta.com/fastpassphishingdetection +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_risk_threshold_exceeded.yml b/detections/application/okta_risk_threshold_exceeded.yml index 8a6cb4a408..4457076dd3 100644 --- a/detections/application/okta_risk_threshold_exceeded.yml +++ b/detections/application/okta_risk_threshold_exceeded.yml @@ -1,7 +1,7 @@ name: Okta Risk Threshold Exceeded id: d8b967dd-657f-4d88-93b5-c588bcd7218c version: 3 -date: "2024-05-28" +date: '2024-05-28' author: Michael Haag, Bhavin Patel, Splunk status: production type: Correlation @@ -13,7 +13,7 @@ description: The following correlation identifies when a user exceeds a risk thr tactics, techniques, and procedures (TTPs) within a 24-hour period. If confirmed malicious, this activity could indicate a serious security breach, allowing attackers to gain unauthorized access, escalate privileges, or persist within the environment. -data_source: +data_source: - Okta search: '| tstats `security_content_summariesonly` values(All_Risk.analyticstories) as analyticstories sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) @@ -37,6 +37,9 @@ known_false_positives: False positives will be limited to the number of events g references: - https://developer.okta.com/docs/reference/api/event-types - https://sec.okta.com/everythingisyes +drilldown_searches: +- name: View the detection results for $risk_object$ + search: '%orginal_detection_search% | search risk_object = $risk_object$' tags: analytic_story: - Okta Account Takeover @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/okta_account_takeover_risk_events/okta_risk.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/okta_account_takeover_risk_events/okta_risk.log source: risk_data sourcetype: stash diff --git a/detections/application/okta_successful_single_factor_authentication.yml b/detections/application/okta_successful_single_factor_authentication.yml index 85bf673cbe..8f60c5af5b 100644 --- a/detections/application/okta_successful_single_factor_authentication.yml +++ b/detections/application/okta_successful_single_factor_authentication.yml @@ -3,7 +3,7 @@ id: 98f6ad4f-4325-4096-9d69-45dc8e638e82 version: 2 date: '2024-05-26' author: Bhavin Patel, Splunk -data_source: +data_source: - Okta type: Anomaly status: production @@ -28,6 +28,9 @@ known_false_positives: Although not recommended, certain users may be exempt fro references: - https://sec.okta.com/everythingisyes - https://attack.mitre.org/techniques/T1078/004/ +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover @@ -67,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/okta_single_factor_auth/okta_single_factor_auth.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/okta_single_factor_auth/okta_single_factor_auth.log source: okta_log sourcetype: OktaIM2:log diff --git a/detections/application/okta_suspicious_activity_reported.yml b/detections/application/okta_suspicious_activity_reported.yml index 447b104ac5..5089c683be 100644 --- a/detections/application/okta_suspicious_activity_reported.yml +++ b/detections/application/okta_suspicious_activity_reported.yml @@ -13,7 +13,7 @@ description: The following analytic identifies when an associate reports a login malicious, the attacker could gain unauthorized access to sensitive systems and data, leading to data theft, privilege escalation, or further compromise of the environment. -data_source: +data_source: - Okta search: '`okta` eventType=user.account.report_suspicious_activity_by_enduser | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user @@ -28,6 +28,9 @@ known_false_positives: False positives should be minimal, given the high fidelit of this detection. marker. references: - https://help.okta.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover @@ -62,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/okta_suspicious_activity_reported_by_user.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/okta_suspicious_activity_reported_by_user.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_suspicious_use_of_a_session_cookie.yml b/detections/application/okta_suspicious_use_of_a_session_cookie.yml index 769fd797ab..4406b00153 100644 --- a/detections/application/okta_suspicious_use_of_a_session_cookie.yml +++ b/detections/application/okta_suspicious_use_of_a_session_cookie.yml @@ -5,16 +5,16 @@ date: '2024-05-29' author: Scott Dermott, Felicity Robson, Okta, Michael Haag, Bhavin Patel, Splunk type: Anomaly status: production -data_source: +data_source: - Okta -description: 'The following analytic identifies suspicious use of a session cookie +description: The following analytic identifies suspicious use of a session cookie by detecting multiple client values (IP, User Agent, etc.) changing for the same Device Token associated with a specific user. It leverages policy evaluation events from successful authentication logs in Okta. This activity is significant as it may indicate an adversary attempting to reuse a stolen web session cookie, potentially bypassing authentication mechanisms. If confirmed malicious, this could allow unauthorized access to user accounts, leading to data breaches or further exploitation within - the environment.' + the environment. search: '`okta` eventType IN (policy.evaluate_sign_on) outcome.result IN (ALLOW, SUCCESS) | stats earliest(_time) as _time, values(client.ipAddress) as src_ip, values(client.userAgent.rawUserAgent) as user_agent, values(client.userAgent.os) as userAgentOS_list, values(client.geographicalContext.city) @@ -30,6 +30,9 @@ known_false_positives: False positives may occur, depending on the organization' size and the configuration of Okta. references: - https://attack.mitre.org/techniques/T1539/ +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Suspicious Okta Activity @@ -65,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1539/okta_web_session_multiple_ip/okta_web_session_multiple_ip.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1539/okta_web_session_multiple_ip/okta_web_session_multiple_ip.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_threatinsight_threat_detected.yml b/detections/application/okta_threatinsight_threat_detected.yml index 510f83e8df..3b949e369f 100644 --- a/detections/application/okta_threatinsight_threat_detected.yml +++ b/detections/application/okta_threatinsight_threat_detected.yml @@ -12,7 +12,7 @@ description: The following analytic identifies threats detected by Okta ThreatIn access attempts and credential-based attacks. If confirmed malicious, these activities could lead to unauthorized access, data breaches, and further exploitation of compromised accounts, posing a significant risk to the organization's security posture. -data_source: +data_source: - Okta search: '`okta` eventType = security.threat.detected | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city @@ -27,6 +27,9 @@ known_false_positives: False positives may occur. It is recommended to fine-tune settings and the analytic to ensure high fidelity. Adjust the risk score as necessary. references: - https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected +drilldown_searches: +- name: View the detection results for $app$ + search: '%orginal_detection_search% | search app = $app$' tags: analytic_story: - Okta Account Takeover @@ -69,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/okta_threatinsight_threat_detected.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/okta_threatinsight_threat_detected.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_unauthorized_access_to_application.yml b/detections/application/okta_unauthorized_access_to_application.yml index e7a0ad8897..a7cde016f9 100644 --- a/detections/application/okta_unauthorized_access_to_application.yml +++ b/detections/application/okta_unauthorized_access_to_application.yml @@ -2,8 +2,8 @@ name: Okta Unauthorized Access to Application id: 5f661629-9750-4cb9-897c-1f05d6db8727 version: 2 date: '2024-05-12' -author: 'Bhavin Patel, Splunk' -data_source: +author: Bhavin Patel, Splunk +data_source: - Okta type: Anomaly status: production @@ -28,6 +28,9 @@ known_false_positives: There is a possibility that a user may accidentally click the location from which this activity originates. references: - https://attack.mitre.org/techniques/T1110/003/ +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover @@ -66,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/okta_unauth_access/okta_unauth_access.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/okta_unauth_access/okta_unauth_access.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_user_logins_from_multiple_cities.yml b/detections/application/okta_user_logins_from_multiple_cities.yml index 9834d29bd2..b88029589b 100644 --- a/detections/application/okta_user_logins_from_multiple_cities.yml +++ b/detections/application/okta_user_logins_from_multiple_cities.yml @@ -2,8 +2,8 @@ name: Okta User Logins from Multiple Cities id: a3d1df37-c2a9-41d0-aa8f-59f82d6192a8 version: 2 date: '2024-05-09' -author: 'Bhavin Patel, Splunk' -data_source: +author: Bhavin Patel, Splunk +data_source: - Okta type: Anomaly status: production @@ -32,6 +32,9 @@ known_false_positives: It is uncommon for a user to log in from multiple cities which may indicate a false positive. references: - https://attack.mitre.org/techniques/T1110/003/ +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover @@ -70,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/okta_multiple_city/okta_multiple_city_im2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/okta_multiple_city/okta_multiple_city_im2.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/pingid_mismatch_auth_source_and_verification_response.yml b/detections/application/pingid_mismatch_auth_source_and_verification_response.yml index 19b718cce0..7303e87dc6 100644 --- a/detections/application/pingid_mismatch_auth_source_and_verification_response.yml +++ b/detections/application/pingid_mismatch_auth_source_and_verification_response.yml @@ -15,24 +15,23 @@ description: The following analytic identifies discrepancies between the IP addr to sensitive systems and data. data_source: - PingID -search: >- - `pingid` ("result.status" IN ("SUCCESS*","FAIL*","UNSUCCESSFUL*") NOT "result.message" - IN ("*pair*","*create*","*delete*")) | eval user = upper('actors{}.name'), session_id - = 'resources{}.websession', dest = 'resources{}.ipaddress', reason = 'result.message', - object = 'resources{}.devicemodel', status = 'result.status' | join user session_id +search: '`pingid` ("result.status" IN ("SUCCESS*","FAIL*","UNSUCCESSFUL*") NOT "result.message" + IN ("*pair*","*create*","*delete*")) | eval user = upper(''actors{}.name''), session_id + = ''resources{}.websession'', dest = ''resources{}.ipaddress'', reason = ''result.message'', + object = ''resources{}.devicemodel'', status = ''result.status'' | join user session_id [ search `pingid` ("result.status" IN ("POLICY") AND "resources{}.ipaddress"=*) AND "result.message" IN("*Action: Authenticate*","*Action: Approve*","*Action: Allowed*") | rex field=result.message "IP Address: (?:N\/A)?(?.+)?\n" | rex field=result.message "Action: (?:N\/A)?(?.+)?\n" | rex field=result.message "Requested Application Name: (?:N\/A)?(?.+)?\n" | rex field=result.message "Requested Application ID: (?:N\/A)?(?.+)?\n" - | eval user = upper('actors{}.name'), session_id = 'resources{}.websession', src - = coalesce('resources{}.ipaddress',policy_ipaddress), app = coalesce(Requested_Application_ID,Requested_Application_Name) + | eval user = upper(''actors{}.name''), session_id = ''resources{}.websession'', + src = coalesce(''resources{}.ipaddress'',policy_ipaddress), app = coalesce(Requested_Application_ID,Requested_Application_Name) | fields app, user, session_id, src, signature ] | iplocation prefix=auth_ dest | iplocation prefix=verify_ src | stats count min(_time) as firstTime max(_time) as lastTime values(app) as app values(session_id) as session_id by user, dest, auth_Country, src, verify_Country, object, signature, status, reason | where auth_Country != verify_Country - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `pingid_mismatch_auth_source_and_verification_response_filter` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `pingid_mismatch_auth_source_and_verification_response_filter`' how_to_implement: Target environment must ingest JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription. known_false_positives: False positives may be generated by users working out the geographic @@ -42,6 +41,9 @@ references: - https://attack.mitre.org/techniques/T1098/005/ - https://attack.mitre.org/techniques/T1556/006/ - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA +drilldown_searches: +- name: View the detection results for $user$ and $src$ + search: '%orginal_detection_search% | search user = $user$ src = $src$' tags: analytic_story: - Compromised User Account @@ -84,8 +86,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log source: PINGID sourcetype: _json update_timestamp: true diff --git a/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml b/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml index 495f695cde..d397f3112f 100644 --- a/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml +++ b/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml @@ -14,13 +14,13 @@ description: The following analytic identifies multiple failed multi-factor auth request, compromising the security of the account and potentially the entire network. data_source: - PingID -search: >- - `pingid` "result.status" IN ("FAILURE,authFail","UNSUCCESSFUL_ATTEMPT") | eval time - = _time, src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user - = upper('actors{}.name'), object = 'resources{}.devicemodel', reason = 'result.message'| - bucket span=10m _time | stats dc(_raw) AS mfa_prompts min(time) as firstTime, max(time) - as lastTime values(src) as src by user, reason, _time | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | where mfa_prompts >= 10 | `pingid_multiple_failed_mfa_requests_for_user_filter` +search: '`pingid` "result.status" IN ("FAILURE,authFail","UNSUCCESSFUL_ATTEMPT") | + eval time = _time, src = coalesce(''resources{}.ipaddress'',''resources{}.devicemodel''), + user = upper(''actors{}.name''), object = ''resources{}.devicemodel'', reason = + ''result.message''| bucket span=10m _time | stats dc(_raw) AS mfa_prompts min(time) + as firstTime, max(time) as lastTime values(src) as src by user, reason, _time | + `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | where + mfa_prompts >= 10 | `pingid_multiple_failed_mfa_requests_for_user_filter`' how_to_implement: Target environment must ingest JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription. known_false_positives: False positives may be generated by normal provisioning workflows @@ -31,6 +31,9 @@ references: - https://attack.mitre.org/techniques/T1110/ - https://attack.mitre.org/techniques/T1078/004/ - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Compromised User Account @@ -64,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log source: PINGID sourcetype: _json diff --git a/detections/application/pingid_new_mfa_method_after_credential_reset.yml b/detections/application/pingid_new_mfa_method_after_credential_reset.yml index 58957a5efe..19c57db54e 100644 --- a/detections/application/pingid_new_mfa_method_after_credential_reset.yml +++ b/detections/application/pingid_new_mfa_method_after_credential_reset.yml @@ -15,11 +15,10 @@ description: The following analytic identifies the provisioning of a new MFA dev measures. data_source: - PingID -search: >- - `pingid` "result.message" = "*Device Paired*" | rex field=result.message "Device - (Unp)?(P)?aired (?.+)" | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), - user = upper('actors{}.name'), reason = 'result.message' | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) - | eval action=CASE(match('result.message',"Device Paired*"),"created",match('result.message', +search: '`pingid` "result.message" = "*Device Paired*" | rex field=result.message + "Device (Unp)?(P)?aired (?.+)" | eval src = coalesce(''resources{}.ipaddress'',''resources{}.devicemodel''), + user = upper(''actors{}.name''), reason = ''result.message'' | eval object=CASE(ISNOTNULL(''resources{}.devicemodel''),''resources{}.devicemodel'',true(),device_extract) + | eval action=CASE(match(''result.message'',"Device Paired*"),"created",match(''result.message'', "Device Unpaired*"),"deleted") | stats count min(_time) as firstTime, max(_time) as lastTime, values(reason) as reason by src,user,action,object | join type=outer user [| search `wineventlog_security` EventID IN(4723,4724) | eval PW_Change_Time @@ -27,7 +26,7 @@ search: >- timeDiffRaw = round(lastTime - PW_Change_Time) | eval timeDiff = replace(tostring(abs(timeDiffRaw) ,"duration"),"(\d*)\+*(\d+):(\d+):(\d+)","\2 hours \3 minutes") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `security_content_ctime(PW_Change_Time)` - | where timeDiffRaw > 0 AND timeDiffRaw < 3600 | `pingid_new_mfa_method_after_credential_reset_filter` + | where timeDiffRaw > 0 AND timeDiffRaw < 3600 | `pingid_new_mfa_method_after_credential_reset_filter`' how_to_implement: Target environment must ingest Windows Event Log and PingID(PingOne) data sources. Specifically from logs from Active Directory Domain Controllers and JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or @@ -40,6 +39,9 @@ references: - https://attack.mitre.org/techniques/T1098/005/ - https://attack.mitre.org/techniques/T1556/006/ - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Compromised User Account @@ -80,11 +82,9 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/windows_pw_reset.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/windows_pw_reset.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log source: PINGID sourcetype: _json diff --git a/detections/application/pingid_new_mfa_method_registered_for_user.yml b/detections/application/pingid_new_mfa_method_registered_for_user.yml index a298ba2b1a..383c1a8694 100644 --- a/detections/application/pingid_new_mfa_method_registered_for_user.yml +++ b/detections/application/pingid_new_mfa_method_registered_for_user.yml @@ -14,18 +14,14 @@ description: The following analytic detects the registration of a new Multi-Fact and potentially escalate their privileges within the compromised environment. data_source: - PingID -search: >- - `pingid` "result.message"="Device Paired*" result.status="SUCCESS" | rex field=result.message - "Device (Unp)?(P)?aired (?.+)" - | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user = - upper('actors{}.name'), reason = 'result.message' - | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) - | eval action=CASE(match('result.message',"Device Paired*"),"created",match('result.message', - "Device Unpaired*"),"deleted") - | stats count min(_time) as firstTime, max(_time) as lastTime by src,user,object,action,reason - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `pingid_new_mfa_method_registered_for_user_filter` +search: '`pingid` "result.message"="Device Paired*" result.status="SUCCESS" | rex + field=result.message "Device (Unp)?(P)?aired (?.+)" | eval src = + coalesce(''resources{}.ipaddress'',''resources{}.devicemodel''), user = upper(''actors{}.name''), + reason = ''result.message'' | eval object=CASE(ISNOTNULL(''resources{}.devicemodel''),''resources{}.devicemodel'',true(),device_extract) + | eval action=CASE(match(''result.message'',"Device Paired*"),"created",match(''result.message'', + "Device Unpaired*"),"deleted") | stats count min(_time) as firstTime, max(_time) + as lastTime by src,user,object,action,reason | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `pingid_new_mfa_method_registered_for_user_filter`' how_to_implement: Target environment must ingest JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription. known_false_positives: False positives may be generated by normal provisioning workflows @@ -35,6 +31,9 @@ references: - https://attack.mitre.org/techniques/T1098/005/ - https://attack.mitre.org/techniques/T1556/006/ - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA +drilldown_searches: +- name: View the detection results for $user$ and $src$ + search: '%orginal_detection_search% | search user = $user$ src = $src$' tags: analytic_story: - Compromised User Account @@ -76,8 +75,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log source: PINGID sourcetype: _json update_timestamp: true diff --git a/detections/application/suspicious_email_attachment_extensions.yml b/detections/application/suspicious_email_attachment_extensions.yml index 964deb407c..432a8bf091 100644 --- a/detections/application/suspicious_email_attachment_extensions.yml +++ b/detections/application/suspicious_email_attachment_extensions.yml @@ -5,32 +5,39 @@ date: '2024-05-29' author: David Dorsey, Splunk status: experimental type: Anomaly -description: |- - The following analytic detects emails containing attachments with suspicious file extensions. It leverages the Email data model in Splunk, using the tstats command to identify emails where the attachment filename is not empty. This detection is significant for SOC analysts as it highlights potential phishing or malware delivery attempts, which are common vectors for data breaches and malware infections. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, system compromise, or data exfiltration. Immediate review and analysis of the identified emails and attachments are crucial to mitigate these risks. +description: The following analytic detects emails containing attachments with suspicious + file extensions. It leverages the Email data model in Splunk, using the tstats command + to identify emails where the attachment filename is not empty. This detection is + significant for SOC analysts as it highlights potential phishing or malware delivery + attempts, which are common vectors for data breaches and malware infections. If + confirmed malicious, this activity could lead to unauthorized access to sensitive + information, system compromise, or data exfiltration. Immediate review and analysis + of the identified emails and attachments are crucial to mitigate these risks. data_source: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Email where All_Email.file_name="*" by All_Email.src_user, All_Email.file_name All_Email.message_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Email")` | `suspicious_email_attachments` | `suspicious_email_attachment_extensions_filter`' -how_to_implement: You need to ingest data from emails. Specifically, the sender's - address and the file names of any attachments must be mapped to the Email data - model. - +how_to_implement: 'You need to ingest data from emails. Specifically, the sender''s + address and the file names of any attachments must be mapped to the Email data model. + **Splunk Phantom Playbook Integration** - - If Splunk Phantom is also - configured in your environment, a Playbook called "Suspicious Email Attachment - Investigate and Delete" can be configured to run when any results are found by - this detection search. To use this integration, install the Phantom App for Splunk - `https://splunkbase.splunk.com/app/3411/`, and add the correct hostname to the - "Phantom Instance" field in the Adaptive Response Actions when configuring this - detection search. The notable event will be sent to Phantom and the playbook will - gather further information about the file attachment and its network behaviors. + + If Splunk Phantom is also configured in your environment, a Playbook called "Suspicious + Email Attachment Investigate and Delete" can be configured to run when any results + are found by this detection search. To use this integration, install the Phantom + App for Splunk `https://splunkbase.splunk.com/app/3411/`, and add the correct hostname + to the "Phantom Instance" field in the Adaptive Response Actions when configuring + this detection search. The notable event will be sent to Phantom and the playbook + will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the - email will be deleted from the user's inbox.' + email will be deleted from the user''s inbox.''' known_false_positives: None identified references: [] +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Data Destruction diff --git a/detections/application/suspicious_java_classes.yml b/detections/application/suspicious_java_classes.yml index 8244305477..c2b91cb978 100644 --- a/detections/application/suspicious_java_classes.yml +++ b/detections/application/suspicious_java_classes.yml @@ -25,6 +25,9 @@ how_to_implement: In order to properly run this search, Splunk needs to ingest d network traffic-analysis tools, such as Splunk Stream or Bro. known_false_positives: There are no known false positives. references: [] +drilldown_searches: +- name: View the detection results for $user$ and $dest$ + search: '%orginal_detection_search% | search user = $user$ dest = $dest$' tags: analytic_story: - Apache Struts Vulnerability diff --git a/detections/application/web_servers_executing_suspicious_processes.yml b/detections/application/web_servers_executing_suspicious_processes.yml index 86b21aef43..9a7cb81e49 100644 --- a/detections/application/web_servers_executing_suspicious_processes.yml +++ b/detections/application/web_servers_executing_suspicious_processes.yml @@ -5,8 +5,14 @@ date: '2024-05-11' author: David Dorsey, Splunk status: experimental type: TTP -description: |- - The following analytic detects the execution of suspicious processes on systems identified as web servers. It leverages the Splunk data model "Endpoint.Processes" to search for specific process names such as "whoami", "ping", "iptables", "wget", "service", and "curl". This activity is significant because these processes are often used by attackers for reconnaissance, persistence, or data exfiltration. If confirmed malicious, this could lead to data theft, deployment of additional malware, or even ransomware attacks. Immediate investigation is required to determine the legitimacy of the activity and mitigate potential threats. +description: The following analytic detects the execution of suspicious processes + on systems identified as web servers. It leverages the Splunk data model "Endpoint.Processes" + to search for specific process names such as "whoami", "ping", "iptables", "wget", + "service", and "curl". This activity is significant because these processes are + often used by attackers for reconnaissance, persistence, or data exfiltration. If + confirmed malicious, this could lead to data theft, deployment of additional malware, + or even ransomware attacks. Immediate investigation is required to determine the + legitimacy of the activity and mitigate potential threats. data_source: - Sysmon EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -27,6 +33,9 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some of these processes may be used legitimately on web servers during maintenance or other administrative tasks. references: [] +drilldown_searches: +- name: View the detection results for $user$ and $dest$ + search: '%orginal_detection_search% | search user = $user$ dest = $dest$' tags: analytic_story: - Apache Struts Vulnerability diff --git a/detections/application/windows_ad_add_self_to_group.yml b/detections/application/windows_ad_add_self_to_group.yml index d01cf4389e..0266e509ae 100644 --- a/detections/application/windows_ad_add_self_to_group.yml +++ b/detections/application/windows_ad_add_self_to_group.yml @@ -7,17 +7,22 @@ status: production type: TTP data_source: - Windows Event Log Security 4728 -description: This analytic detects instances where a user adds themselves to an Active Directory (AD) group. This activity - is a common indicator of privilege escalation, where a user attempts to gain unauthorized access to higher - privileges or sensitive resources. By monitoring AD logs, this detection identifies such suspicious behavior, - which could be part of a larger attack strategy aimed at compromising critical systems and data. -search: '`wineventlog_security` EventCode IN (4728) - | where user=src_user - | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name, src_user - | `windows_ad_add_self_to_group_filter`' +description: This analytic detects instances where a user adds themselves to an Active + Directory (AD) group. This activity is a common indicator of privilege escalation, + where a user attempts to gain unauthorized access to higher privileges or sensitive + resources. By monitoring AD logs, this detection identifies such suspicious behavior, + which could be part of a larger attack strategy aimed at compromising critical systems + and data. +search: '`wineventlog_security` EventCode IN (4728) | where user=src_user | stats + min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) + as user_category values(src_user_category) as src_user_category values(dvc) as dvc + by signature, Group_Name, src_user | `windows_ad_add_self_to_group_filter`' how_to_implement: This analytic requires eventCode 4728 to be ingested. known_false_positives: Unknown references: [] +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Active Directory Privilege Escalation @@ -51,4 +56,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog - update_timestamp: true \ No newline at end of file + update_timestamp: true diff --git a/detections/application/windows_ad_dangerous_deny_acl_modification.yml b/detections/application/windows_ad_dangerous_deny_acl_modification.yml index b7f6bee2cc..828ff554b8 100644 --- a/detections/application/windows_ad_dangerous_deny_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_deny_acl_modification.yml @@ -7,78 +7,88 @@ status: production type: TTP data_source: - Windows Security 5136 -description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object. -search: >- - `wineventlog_security` EventCode=5136 - | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId - | rex field=old_value max_match=10000 "\((?P.*?)\)" - | rex field=new_value max_match=10000 "\((?P.*?)\)" - | mvexpand new_ace - | where NOT new_ace IN (old_values) - | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" - | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" - | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group - | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) - | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID - | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') - | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) - | `windows_ad_dangerous_deny_acl_modification_filter` -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. - See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. -known_false_positives: None. +description: This detection identifies an Active Directory access-control list (ACL) + modification event, which applies permissions that deny the ability to enumerate + permissions of the object. +search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) + as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value + values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user + SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | + rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | + where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | + rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid + OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string + as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string + as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName + as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | + lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name + as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This + object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), + user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType + values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights + values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) + as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user + OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search + aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) + | `windows_ad_dangerous_deny_acl_modification_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136. See lantern article in references for further on how to onboard AD audit + data. Ensure the wineventlog_security macro is configured with the correct indexes + and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: None. references: - https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54 - https://www.youtube.com/watch?v=_nGpZ1ydzS8 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $user$ and $src_user$ + search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 100 impact: 100 - message: $src_user$ has added ACL rights to deny $user$ $aceControlAccessRights$ $aceAccessRights$ to $ObjectDN$ + message: $src_user$ has added ACL rights to deny $user$ $aceControlAccessRights$ + $aceAccessRights$ to $ObjectDN$ mitre_attack_id: - T1484 - T1222 - T1222.001 observable: - - name: user - type: User - role: - - Victim - - name: src_user - type: User - role: - - Victim + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 100 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/application/windows_ad_dangerous_group_acl_modification.yml b/detections/application/windows_ad_dangerous_group_acl_modification.yml index ae125e8c7d..328f9495ed 100644 --- a/detections/application/windows_ad_dangerous_group_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_group_acl_modification.yml @@ -7,82 +7,97 @@ status: production type: TTP data_source: - Windows Security 5136 -description: >- - This detection monitors the addition of the following ACLs to an Active Directory group object: "Full control", "All extended rights", "All validated writes", - "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", and "Write all properties". - Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert. -search: >- - `wineventlog_security` EventCode=5136 ObjectClass=group - | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId - | rex field=old_value max_match=10000 "\((?P.*?)\)" - | rex field=new_value max_match=10000 "\((?P.*?)\)" - | mvexpand new_ace - | where NOT new_ace IN (old_values) - | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" - | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" - | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group - | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) - | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID - | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') - | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) - | `windows_ad_dangerous_group_acl_modification_filter` -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. - See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +description: 'This detection monitors the addition of the following ACLs to an Active + Directory group object: "Full control", "All extended rights", "All validated writes", "Create + all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify + permissions", "Modify owner", and "Write all properties". Such modifications can + indicate potential privilege escalation or malicious activity. Immediate investigation + is recommended upon alert.' +search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) + as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value + values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) + as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | + rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value + max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace + IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | + rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string + as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup + access_rights_string as AccessRights OUTPUT access_rights_value | lookup msad_guid_lookup + guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID + resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT + downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT + cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT + builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), + aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write + member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All + validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), + user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType + values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights + values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) + as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user + OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search + NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All + extended rights","All validated writes","Create all child objects","Delete all child + objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all + properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136. See lantern article in references for further on how to onboard AD audit + data. Ensure the wineventlog_security macro is configured with the correct indexes + and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb - https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $user$ and $src_user$ + search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 100 impact: 100 - message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to group $ObjectDN$ + message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ + $aceAccessRights$ to group $ObjectDN$ mitre_attack_id: - T1484 - T1222 - T1222.001 observable: - - name: user - type: User - role: - - Victim - - name: src_user - type: User - role: - - Victim + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 100 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/application/windows_ad_dangerous_user_acl_modification.yml b/detections/application/windows_ad_dangerous_user_acl_modification.yml index 8cfdbceb4c..239014362b 100644 --- a/detections/application/windows_ad_dangerous_user_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_user_acl_modification.yml @@ -7,82 +7,95 @@ status: production type: TTP data_source: - Windows Security 5136 -description: >- - This detection monitors the addition of the following ACLs to an Active Directory user object: "Full control","All extended rights","All validated writes", - "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties". - Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert. -search: >- - `wineventlog_security` EventCode=5136 ObjectClass=user - | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId - | rex field=old_value max_match=10000 "\((?P.*?)\)" - | rex field=new_value max_match=10000 "\((?P.*?)\)" - | mvexpand new_ace - | where NOT new_ace IN (old_values) - | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" - | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" - | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group - | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) - | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID - | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') - | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) - | `windows_ad_dangerous_user_acl_modification_filter` -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. - See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +description: 'This detection monitors the addition of the following ACLs to an Active + Directory user object: "Full control","All extended rights","All validated writes", + "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify + permissions","Modify owner","Write all properties". Such modifications can indicate + potential privilege escalation or malicious activity. Immediate investigation is + recommended upon alert.' +search: '`wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time) + as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value + values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) + as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | + rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value + max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace + IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | + rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid + OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string + as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string + as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName + as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | + lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name + as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This + object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), + user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType + values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights + values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) + as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user + OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search + NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended + rights","All validated writes","Create all child objects","Delete all child objects","Delete + subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) + | `windows_ad_dangerous_user_acl_modification_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136. See lantern article in references for further on how to onboard AD audit + data. Ensure the wineventlog_security macro is configured with the correct indexes + and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb - https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $user$ and $src_user$ + search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 100 impact: 100 - message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to user $ObjectDN$ + message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ + $aceAccessRights$ to user $ObjectDN$ mitre_attack_id: - T1484 - T1222 - T1222.001 observable: - - name: user - type: User - role: - - Victim - - name: src_user - type: User - role: - - Victim + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 100 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml index 07654823a8..7c9483cab6 100644 --- a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml +++ b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml @@ -7,77 +7,89 @@ status: production type: TTP data_source: - Windows Security 5136 -description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies the minimum required extended rights to perform the DCShadow attack. -search: >- - `wineventlog_security` EventCode=5136 ObjectClass=domainDNS - | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId - | rex field=old_value max_match=10000 "\((?P.*?)\)" - | rex field=new_value max_match=10000 "\((?P.*?)\)" - | mvexpand new_ace - | where NOT new_ace IN (old_values) - | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" +description: This detection identifies an Active Directory access-control list (ACL) + modification event, which applies the minimum required extended rights to perform + the DCShadow attack. +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) + as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value + values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) + as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | + rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value + max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN + (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | search aceObjectGuid IN ("9923a32a-3607-11d2-b9be-0000f87a36b2","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") - | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" - | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group - | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) - | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user - | search (aceControlAccessRights="Add/Remove Replica In Domain" AND aceControlAccessRights="Manage Replication Topology" AND aceControlAccessRights="Replication Synchronization") OR (aceControlAccessRights="9923a32a-3607-11d2-b9be-0000f87a36b2" AND aceControlAccessRights="1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") - | `windows_ad_dcshadow_privileges_acl_addition_filter` -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. - See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid + OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string + as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags + OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup + identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | + lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup + builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval + aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This + object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), + user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) + as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) + as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) + as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user + user | search (aceControlAccessRights="Add/Remove Replica In Domain" AND aceControlAccessRights="Manage + Replication Topology" AND aceControlAccessRights="Replication Synchronization") + OR (aceControlAccessRights="9923a32a-3607-11d2-b9be-0000f87a36b2" AND aceControlAccessRights="1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" + AND aceControlAccessRights="1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") | `windows_ad_dcshadow_privileges_acl_addition_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136. See lantern article in references for further on how to onboard AD audit + data. Ensure the wineventlog_security macro is configured with the correct indexes + and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://www.labofapenetrationtester.com/2018/04/dcshadow.html - https://github.com/samratashok/nishang/blob/master/ActiveDirectory/Set-DCShadowPermissions.ps1 - https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $user$ and $src_user$ + search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 100 impact: 100 - message: ACL modification Event Initiated by $src_user$ applying $user$ the minimum required extended rights to perform a DCShadow attack. + message: ACL modification Event Initiated by $src_user$ applying $user$ the minimum + required extended rights to perform a DCShadow attack. mitre_attack_id: - T1484 - T1207 - T1222.001 observable: - - name: user - type: User - role: - - Victim - - name: src_user - type: User - role: - - Victim + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud risk_score: 100 required_fields: - - _time - - OperationType - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/application/windows_ad_domain_root_acl_deletion.yml b/detections/application/windows_ad_domain_root_acl_deletion.yml index 3d117d3d82..bb199da51d 100644 --- a/detections/application/windows_ad_domain_root_acl_deletion.yml +++ b/detections/application/windows_ad_domain_root_acl_deletion.yml @@ -7,78 +7,88 @@ status: production type: TTP data_source: - Windows Security 5136 -description: ACL deletion performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. -search: >- - `wineventlog_security` EventCode=5136 ObjectClass=domainDNS - | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId - | rex field=old_value max_match=10000 "\((?P.*?)\)" - | rex field=new_value max_match=10000 "\((?P.*?)\)" - | mvexpand old_values - | where NOT old_values IN (new_values) - | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" - | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" - | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group - | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) - | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID - | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') - | `windows_ad_domain_root_acl_deletion_filter` -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. - See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +description: ACL deletion performed on the domain root object, significant AD change + with high impact. Following MS guidance all changes at this level should be reviewed. + Drill into the logonID within EventCode 4624 for information on the source device + during triage. +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) + as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value + values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) + as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | + rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value + max_match=10000 "\((?P.*?)\)" | mvexpand old_values | where NOT old_values + IN (new_values) | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | + rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid + OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string + as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags + OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup + identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | + lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup + builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval + aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This + object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), + user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType + values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights + values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time + ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_deletion_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136. See lantern article in references for further on how to onboard AD audit + data. Ensure the wineventlog_security macro is configured with the correct indexes + and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb - https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $user$ and $src_user$ + search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 100 impact: 100 - message: $src_user$ has removed $user$ $aceAccessRights$ ACL rights to domain root $ObjectDN$ + message: $src_user$ has removed $user$ $aceAccessRights$ ACL rights to domain root + $ObjectDN$ mitre_attack_id: - T1484 - T1222 - T1222.001 observable: - - name: user - type: User - role: - - Victim - - name: src_user - type: User - role: - - Victim + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 100 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/application/windows_ad_domain_root_acl_modification.yml b/detections/application/windows_ad_domain_root_acl_modification.yml index b6e2a09041..664a9dd119 100644 --- a/detections/application/windows_ad_domain_root_acl_modification.yml +++ b/detections/application/windows_ad_domain_root_acl_modification.yml @@ -7,78 +7,87 @@ status: production type: TTP data_source: - Windows Security 5136 -description: ACL modification performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. -search: >- - `wineventlog_security` EventCode=5136 ObjectClass=domainDNS - | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId - | rex field=old_value max_match=10000 "\((?P.*?)\)" - | rex field=new_value max_match=10000 "\((?P.*?)\)" - | mvexpand new_ace - | where NOT new_ace IN (old_values) - | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" - | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" - | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group - | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",'access_rights_value'), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) - | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID - | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') - | `windows_ad_domain_root_acl_modification_filter` -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. - See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +description: ACL modification performed on the domain root object, significant AD + change with high impact. Following MS guidance all changes at this level should + be reviewed. Drill into the logonID within EventCode 4624 for information on the + source device during triage. +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) + as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value + values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) + as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | + rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value + max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN + (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid + OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string + as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags + OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup + identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | + lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup + builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval + aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",''access_rights_value''), + aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, + user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType + values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights + values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass + ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_modification_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136. See lantern article in references for further on how to onboard AD audit + data. Ensure the wineventlog_security macro is configured with the correct indexes + and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb - https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $user$ and $src_user$ + search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 100 impact: 100 - message: $src_user$ has granted $user$ $aceAccessRights$ ACL rights to domain root $ObjectDN$ + message: $src_user$ has granted $user$ $aceAccessRights$ ACL rights to domain root + $ObjectDN$ mitre_attack_id: - T1484 - T1222 - T1222.001 observable: - - name: user - type: User - role: - - Victim - - name: src_user - type: User - role: - - Victim + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 100 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/application/windows_ad_gpo_deleted.yml b/detections/application/windows_ad_gpo_deleted.yml index 7caec33736..e91fbf4172 100644 --- a/detections/application/windows_ad_gpo_deleted.yml +++ b/detections/application/windows_ad_gpo_deleted.yml @@ -7,26 +7,33 @@ status: production type: TTP data_source: - Windows Security 5136 -description: This detection identifies when an Active Directory Group Policy is deleted using the Group Policy Management Console. +description: This detection identifies when an Active Directory Group Policy is deleted + using the Group Policy Management Console. search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=gpLink | eval ObjectDN=upper(ObjectDN) - | stats min(_time) as eventTime values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(src_user) as src_user by OpCorrelationID ObjectDN SubjectLogonId - | rex field=old_value max_match=10000 "(?i)LDAP://(?Pcn.*?);(?P\d)\]" + | stats min(_time) as eventTime values(eval(if(OperationType=="%%14675",AttributeValue,null))) + as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value + values(OperationType) as OperationType values(src_user) as src_user by OpCorrelationID + ObjectDN SubjectLogonId | rex field=old_value max_match=10000 "(?i)LDAP://(?Pcn.*?);(?P\d)\]" | rex field=new_value max_match=10000 "(?i)LDAP://(?Pcn.*?);(?P\d)\]" - | mvexpand old_dn - | where NOT old_dn IN (new_dn) - | eval ObjectDN=upper(old_dn) - | join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by ObjectDN ] - | stats min(eventTime) as _time values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId - | `windows_ad_gpo_deleted_filter`' -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display - the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security and admon macros are configured with the correct indexes. + | mvexpand old_dn | where NOT old_dn IN (new_dn) | eval ObjectDN=upper(old_dn) | + join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*" + admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) + as displayName by ObjectDN ] | stats min(eventTime) as _time values(OpCorrelationID) + as OpCorrelationID values(displayName) as policyName values(src_user) as src_user + by ObjectDN SubjectLogonId | `windows_ad_gpo_deleted_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136, admon data is also used to display the display name of the GPO. See + lantern article in references for further on how to onboard AD audit data. Ensure + the wineventlog_security and admon macros are configured with the correct indexes. known_false_positives: Unknown references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $src_user$ + search: '%orginal_detection_search% | search src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 80 impact: 80 @@ -35,33 +42,33 @@ tags: - T1562.001 - T1484.001 observable: - - name: src_user - type: User - role: - - Victim + - name: src_user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 64 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-admon.log - source: ActiveDirectory - sourcetype: ActiveDirectory \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-admon.log + source: ActiveDirectory + sourcetype: ActiveDirectory diff --git a/detections/application/windows_ad_gpo_disabled.yml b/detections/application/windows_ad_gpo_disabled.yml index ee6167057a..9ff48a920c 100644 --- a/detections/application/windows_ad_gpo_disabled.yml +++ b/detections/application/windows_ad_gpo_disabled.yml @@ -7,21 +7,31 @@ status: production type: TTP data_source: - Windows Security 5136 -description: This detection identifies when an Active Directory Group Policy is disabled using the Group Policy Management Console. -search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=flags OperationType="%%14674" AttributeValue!=0 - | eval AttributeValueExp=case(AttributeValue==0,"Enabled",AttributeValue==1,"User configuration settings disabled",AttributeValue==2,"Computer configuration settings disabled",AttributeValue==3,"Disabled"), ObjectDN=upper(ObjectDN) - | join ObjectDN type=inner [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by ObjectDN ] - | stats min(_time) as _time values(AttributeValue) as AttributeValue values(AttributeValueExp) as AttributeValueExp values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId +description: This detection identifies when an Active Directory Group Policy is disabled + using the Group Policy Management Console. +search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=flags OperationType="%%14674" + AttributeValue!=0 | eval AttributeValueExp=case(AttributeValue==0,"Enabled",AttributeValue==1,"User + configuration settings disabled",AttributeValue==2,"Computer configuration settings + disabled",AttributeValue==3,"Disabled"), ObjectDN=upper(ObjectDN) | join ObjectDN + type=inner [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update + | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName + by ObjectDN ] | stats min(_time) as _time values(AttributeValue) as AttributeValue + values(AttributeValueExp) as AttributeValueExp values(OpCorrelationID) as OpCorrelationID + values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId | `windows_ad_gpo_disabled_filter`' -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display - the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security and admon macros are configured with the correct indexes. +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136, admon data is also used to display the display name of the GPO. See + lantern article in references for further on how to onboard AD audit data. Ensure + the wineventlog_security and admon macros are configured with the correct indexes. known_false_positives: Unknown references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $src_user$ + search: '%orginal_detection_search% | search src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 80 impact: 80 @@ -30,33 +40,33 @@ tags: - T1562.001 - T1484.001 observable: - - name: src_user - type: User - role: - - Victim + - name: src_user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 64 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-security.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-admon.log - source: ActiveDirectory - sourcetype: ActiveDirectory \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-security.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-admon.log + source: ActiveDirectory + sourcetype: ActiveDirectory diff --git a/detections/application/windows_ad_gpo_new_cse_addition.yml b/detections/application/windows_ad_gpo_new_cse_addition.yml index 7404ec85a7..d398f3d7cd 100644 --- a/detections/application/windows_ad_gpo_new_cse_addition.yml +++ b/detections/application/windows_ad_gpo_new_cse_addition.yml @@ -7,68 +7,80 @@ status: production type: TTP data_source: - Windows Security 5136 -description: This detection identifies when a a new client side extension is added to an Active Directory Group Policy using the Group Policy Management Console. +description: This detection identifies when a a new client side extension is added + to an Active Directory Group Policy using the Group Policy Management Console. search: '`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames - | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId - | rex field=old_value max_match=10000 "(?P\{.*?\})" - | rex field=new_value max_match=10000 "(?P\{.*?\})" - | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" - | mvexpand new_values - | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") - | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType - | eval newPolicy=if(policyType like "%",policyType,new_values) - | join ObjectDN [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | stats latest(displayName) as displayName by distinguishedName | eval ObjectDN=upper(distinguishedName)] - | stats values(OpCorrelationID) as OpCorrelationID values(src_user) as src_user values(SubjectLogonId) as SubjectLogonId values(newPolicy) as newPolicy values(displayName) as policyName by ObjectDN - | `windows_ad_gpo_new_cse_addition_filter`' -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display - the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security and admon macros are configured with the correct indexes. -known_false_positives: General usage of group policy will trigger this detection, also please not GPOs modified using tools such as SharpGPOAbuse will not generate the AD audit events which enable this detection. + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) + as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value + values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user + SubjectLogonId | rex field=old_value max_match=10000 "(?P\{.*?\})" | + rex field=new_value max_match=10000 "(?P\{.*?\})" | rex field=ObjectDN + max_match=10000 "CN=(?P\{.*?\})" | mvexpand new_values | where NOT + new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) + AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") + | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType + | eval newPolicy=if(policyType like "%",policyType,new_values) | join ObjectDN [| + search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update + | stats latest(displayName) as displayName by distinguishedName | eval ObjectDN=upper(distinguishedName)] + | stats values(OpCorrelationID) as OpCorrelationID values(src_user) as src_user + values(SubjectLogonId) as SubjectLogonId values(newPolicy) as newPolicy values(displayName) + as policyName by ObjectDN | `windows_ad_gpo_new_cse_addition_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136, admon data is also used to display the display name of the GPO. See + lantern article in references for further on how to onboard AD audit data. Ensure + the wineventlog_security and admon macros are configured with the correct indexes. +known_false_positives: General usage of group policy will trigger this detection, + also please not GPOs modified using tools such as SharpGPOAbuse will not generate + the AD audit events which enable this detection. references: - https://wald0.com/?p=179 - https://learn.microsoft.com/en-gb/archive/blogs/mempson/group-policy-client-side-extension-list - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory - https://github.com/FSecureLABS/SharpGPOAbuse +drilldown_searches: +- name: View the detection results for $src_user$ + search: '%orginal_detection_search% | search src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 100 impact: 100 - message: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the policy $policyName$ + message: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the + policy $policyName$ mitre_attack_id: - T1484 - T1484.001 - T1222 - T1222.001 observable: - - name: src_user - type: User - role: - - Victim + - name: src_user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 100 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-admon.log - source: ActiveDirectory - sourcetype: ActiveDirectory \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-admon.log + source: ActiveDirectory + sourcetype: ActiveDirectory diff --git a/detections/application/windows_ad_hidden_ou_creation.yml b/detections/application/windows_ad_hidden_ou_creation.yml index edc4f97dc3..cf3ea89d0c 100644 --- a/detections/application/windows_ad_hidden_ou_creation.yml +++ b/detections/application/windows_ad_hidden_ou_creation.yml @@ -7,40 +7,50 @@ status: production type: TTP data_source: - Windows Security 5136 -description: This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators. -search: >- - `wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit - | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId - | rex field=old_value max_match=10000 "\((?P.*?)\)" - | rex field=new_value max_match=10000 "\((?P.*?)\)" - | mvexpand new_ace - | where NOT new_ace IN (old_values) - | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" - | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" - | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group - | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) - | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID - | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') - | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) - | `windows_ad_hidden_ou_creation_filter` -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. - See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. -known_false_positives: None. +description: This analytic is looking for when an ACL is applied to an OU which denies + listing the objects residing in the OU. This activity combined with modifying the + owner of the OU will hide AD objects even from domain administrators. +search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats + min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) + as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value + values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user + SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | + rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | + where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | + rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid + OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string + as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string + as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName + as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | + lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name + as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This + object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), + user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType + values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights + values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) + as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user + OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search + aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) + | `windows_ad_hidden_ou_creation_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136. See lantern article in references for further on how to onboard AD audit + data. Ensure the wineventlog_security macro is configured with the correct indexes + and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: None. references: - https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $user$ and $src_user$ + search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 100 impact: 100 @@ -50,34 +60,34 @@ tags: - T1222 - T1222.001 observable: - - name: user - type: User - role: - - Victim - - name: src_user - type: User - role: - - Victim + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 100 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/application/windows_ad_object_owner_updated.yml b/detections/application/windows_ad_object_owner_updated.yml index 3aca7ad031..cfff50ae40 100644 --- a/detections/application/windows_ad_object_owner_updated.yml +++ b/detections/application/windows_ad_object_owner_updated.yml @@ -7,35 +7,42 @@ status: production type: TTP data_source: - Windows Security 5136 -description: AD Object Owner Updated. The owner provides Full control level privileges over the target AD Object. This event has significant impact alone and is also a precursor activity for hiding an AD object. -search: ' `wineventlog_security` EventCode=5136 - | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName - | rex field=old_value "O:(?P.*?)G:" - | rex field=new_value "O:(?P.*?)G:" - | where old_owner!=new_owner - ``` optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user - | lookup admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group - | lookup identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user - | lookup admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group - ``` - | lookup builtin_groups_lookup builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group - | lookup builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group - | eval user=coalesce(new_owner_user, new_owner_group, new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, old_owner_group, old_owner_group_builtin_group, old_owner) - | stats values(previousOwner) as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId by _time ObjectClass ObjectDN src_user OpCorrelationID DSName - | `windows_ad_object_owner_updated_filter`' -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. - See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +description: AD Object Owner Updated. The owner provides Full control level privileges + over the target AD Object. This event has significant impact alone and is also a + precursor activity for hiding an AD object. +search: ' `wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) + as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value + values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user + SubjectLogonId DSName | rex field=old_value "O:(?P.*?)G:" | rex field=new_value + "O:(?P.*?)G:" | where old_owner!=new_owner ``` optional SID resolution + lookups | lookup identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName + as new_owner_user | lookup admon_groups_def objectSid as new_owner OUTPUT cn as + new_owner_group | lookup identity_lookup_expanded objectSid as old_owner OUTPUT + downLevelDomainName as old_owner_user | lookup admon_groups_def objectSid as old_owner + OUTPUT cn as old_owner_group ``` | lookup builtin_groups_lookup builtin_group_string as + new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group | lookup + builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name + as old_owner_group_builtin_group | eval user=coalesce(new_owner_user, new_owner_group, + new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, + old_owner_group, old_owner_group_builtin_group, old_owner) | stats values(previousOwner) + as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId by + _time ObjectClass ObjectDN src_user OpCorrelationID DSName | `windows_ad_object_owner_updated_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136. See lantern article in references for further on how to onboard AD audit + data. Ensure the wineventlog_security macro is configured with the correct indexes + and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb - https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $user$ and $src_user$ + search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 100 impact: 100 @@ -45,34 +52,34 @@ tags: - T1222 - T1222.001 observable: - - name: user - type: User - role: - - Victim - - name: src_user - type: User - role: - - Victim + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 100 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/application/windows_ad_privileged_group_modification.yml b/detections/application/windows_ad_privileged_group_modification.yml index 82aaff088d..d4dd23b4b6 100644 --- a/detections/application/windows_ad_privileged_group_modification.yml +++ b/detections/application/windows_ad_privileged_group_modification.yml @@ -7,16 +7,22 @@ status: experimental type: TTP data_source: - XmlWinEventLog:Security -description: Detect users added to privileged AD Groups. -search: '`wineventlog_security` EventCode IN (4728) - | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name,src_user - | lookup admon_groups_def cn as Group_Name OUTPUT category - | where category="privileged" | `windows_ad_privileged_group_modification_filter`' -how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. - See splunkbase app listed in the references for further details. +description: Detect users added to privileged AD Groups. +search: '`wineventlog_security` EventCode IN (4728) | stats min(_time) as _time dc(user) + as usercount, values(user) as user values(user_category) as user_category values(src_user_category) + as src_user_category values(dvc) as dvc by signature, Group_Name,src_user | lookup + admon_groups_def cn as Group_Name OUTPUT category | where category="privileged" + | `windows_ad_privileged_group_modification_filter`' +how_to_implement: This analytic requires eventCode 4728 to be ingested along with + the admon_groups_def lookup being configured to include a list of AD groups along + with a category to identify privileged groups. See splunkbase app listed in the + references for further details. known_false_positives: None references: - https://splunkbase.splunk.com/app/6853 +drilldown_searches: +- name: View the detection results for $user$ + search: '%orginal_detection_search% | search user = $user$' tags: analytic_story: - Active Directory Privilege Escalation @@ -45,10 +51,11 @@ tags: - Group_Name - dest security_domain: identity - manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested. + manual_test: This search uses a lookup provided by Enterprise Security and needs + to be manually tested. tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog diff --git a/detections/application/windows_ad_self_dacl_assignment.yml b/detections/application/windows_ad_self_dacl_assignment.yml index 25e3e509fa..2b0b8a1408 100644 --- a/detections/application/windows_ad_self_dacl_assignment.yml +++ b/detections/application/windows_ad_self_dacl_assignment.yml @@ -7,73 +7,80 @@ status: production type: TTP data_source: - Windows Security 5136 -description: Detect when a user creates a new DACL in AD for their own AD object. -search: >- - `wineventlog_security` EventCode=5136 - | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId - | rex field=old_value max_match=10000 "\((?P.*?)\)" - | rex field=new_value max_match=10000 "\((?P.*?)\)" - | mvexpand new_ace - | where NOT new_ace IN (old_values) - | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" - | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" - | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group - ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group - | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) - | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID - | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') - | rex field=user "\\\(?P.*?)$" - | where lower(src_user)=lower(nt_user) - | `windows_ad_self_dacl_assignment_filter` -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. - See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +description: Detect when a user creates a new DACL in AD for their own AD object. +search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) + as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value + values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user + SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | + rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | + where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | + rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string + as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup + access_rights_string as AccessRights OUTPUT access_rights_value | lookup msad_guid_lookup + guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID + resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT + downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT + cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT + builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), + aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write + member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All + validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), + user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType + values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights + values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) + as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user + OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | rex field=user + "\\\(?P.*?)$" | where lower(src_user)=lower(nt_user) | `windows_ad_self_dacl_assignment_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136. See lantern article in references for further on how to onboard AD audit + data. Ensure the wineventlog_security macro is configured with the correct indexes + and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $src_user$ + search: '%orginal_detection_search% | search src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 100 impact: 80 - message: $src_user$ has created a DACL on $ObjectDN$ to grant themselves $aceControlAccessRights$ across $aceAccessRights$ + message: $src_user$ has created a DACL on $ObjectDN$ to grant themselves $aceControlAccessRights$ + across $aceAccessRights$ mitre_attack_id: - T1484 - T1098 observable: - - name: src_user - type: User - role: - - Victim + - name: src_user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 80 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/application/windows_ad_suspicious_attribute_modification.yml b/detections/application/windows_ad_suspicious_attribute_modification.yml index f006dae853..c2f01a7729 100644 --- a/detections/application/windows_ad_suspicious_attribute_modification.yml +++ b/detections/application/windows_ad_suspicious_attribute_modification.yml @@ -7,67 +7,75 @@ status: production type: TTP data_source: - Windows Security 5136 -description: >- - This detection monitors changes to the following Active Directory attributes: "msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-KeyCredentialLink", "scriptPath", and "msTSInitialProgram". - Modifications to these attributes can indicate potential malicious activity or privilege escalation attempts. Immediate investigation is recommended upon alert. -search: >- - `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName IN ("msDS-AllowedToDelegateTo","msDS-AllowedToActOnBehalfOfOtherIdentity","scriptPath","msTSInitialProgram") OperationType=%%14674 - ```Changes to the attribute "msDS-KeyCredentialLink" are also worth moniroting, however tuning will need to be applied``` - | table _time ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName AttributeValue AttributeLDAPDisplayName - | rename SubjectLogonId as TargetLogonId, src_user as initiator, _time as eventTime - | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] - | stats min(eventTime) as _time values(initiator) as src_user, values(DSName) as targetDomain, values(ObjectDN) as ObjectDN, values(ObjectClass) as ObjectClass, values(src_category) as src_category, values(src_ip) as src_ip values(LogonType) as LogonType values(AttributeValue) as AttributeValue values(AttributeLDAPDisplayName) as AttributeLDAPDisplayName by TargetLogonId - | rex field=ObjectDN "^CN=(?P.*?),[A-Z]{2}\=" - | eval dest=if(ObjectClass="computer",cn,null), user=if(ObjectClass="user",cn,null) - | fields - cn - | `windows_ad_suspicious_attribute_modification_filter` -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. - See lantern article in references for further on how to onboard AD audit data. Ensure the - wineventlog_security macro is configured with the correct indexes. -known_false_positives: If key credentials are regularly assigned to users, these events will need to be tuned out. +description: 'This detection monitors changes to the following Active Directory attributes: + "msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-KeyCredentialLink", + "scriptPath", and "msTSInitialProgram". Modifications to these attributes can indicate + potential malicious activity or privilege escalation attempts. Immediate investigation + is recommended upon alert.' +search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName IN ("msDS-AllowedToDelegateTo","msDS-AllowedToActOnBehalfOfOtherIdentity","scriptPath","msTSInitialProgram") + OperationType=%%14674 ```Changes to the attribute "msDS-KeyCredentialLink" are + also worth moniroting, however tuning will need to be applied``` | table _time ObjectClass + ObjectDN OpCorrelationID src_user SubjectLogonId DSName AttributeValue AttributeLDAPDisplayName | + rename SubjectLogonId as TargetLogonId, src_user as initiator, _time as eventTime | + appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] | + stats min(eventTime) as _time values(initiator) as src_user, values(DSName) as targetDomain, + values(ObjectDN) as ObjectDN, values(ObjectClass) as ObjectClass, values(src_category) + as src_category, values(src_ip) as src_ip values(LogonType) as LogonType values(AttributeValue) + as AttributeValue values(AttributeLDAPDisplayName) as AttributeLDAPDisplayName by + TargetLogonId | rex field=ObjectDN "^CN=(?P.*?),[A-Z]{2}\=" | eval dest=if(ObjectClass="computer",cn,null), + user=if(ObjectClass="user",cn,null) | fields - cn | `windows_ad_suspicious_attribute_modification_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136. See lantern article in references for further on how to onboard AD audit + data. Ensure the wineventlog_security macro is configured with the correct indexes. +known_false_positives: If key credentials are regularly assigned to users, these events + will need to be tuned out. references: - https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $src_user$ and $dest$ + search: '%orginal_detection_search% | search src_user = $src_user$ dest = $dest$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 100 impact: 100 - message: $src_user$ has added $AttributeLDAPDisplayName$ ACL rights to $ObjectClass$ $ObjectDN$ + message: $src_user$ has added $AttributeLDAPDisplayName$ ACL rights to $ObjectClass$ + $ObjectDN$ mitre_attack_id: - T1550 - T1222 - T1222.001 observable: - - name: src_user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim + - name: src_user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 100 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/suspicious_acl_modification-windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/suspicious_acl_modification-windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/application/windows_ad_suspicious_gpo_modification.yml b/detections/application/windows_ad_suspicious_gpo_modification.yml index 7abeb092eb..81f342edbe 100644 --- a/detections/application/windows_ad_suspicious_gpo_modification.yml +++ b/detections/application/windows_ad_suspicious_gpo_modification.yml @@ -8,34 +8,45 @@ type: TTP data_source: - Windows Security 5136 - Windows Security 5145 -description: This analytic looks for a the creation of potentially harmful GPO which could lead to persistence or code execution on remote hosts. - Note, this analyic is looking for the absence of the corresponding 5136 events which is evidence of the GPOs being manually edited (using a tool like PowerView) or potentially missing logs. -search: >- - `wineventlog_security` EventCode=5145 ShareName="\\\\*\\SYSVOL" RelativeTargetName IN (*\\ScheduledTasks.xml, *\\Groups.xml, *\\Registry.xml, *\\Services.xml, *\\Scripts\\*) NOT RelativeTargetName=*\\Scripts\\scripts.ini AccessMask=0x2 - | rex field=AccessList max_match=0 "(?P%%\d+)" - | table _time AccessMask src_ip src_user RelativeTargetName Logon_ID dvc - | rex field=RelativeTargetName "Policies\\\(?P{.*?})\\\(?P\w+?)\\\(\w+)\\\(?P\w+)\\\(?P\w+\.\w+)$" - | eval src=if(match(src_ip, "(?i)^fe80:"),dvc,src_ip), folder=case(RelativeTargetName like "%\\Scripts\\%","Scripts",folder="Groups","Local users and groups",1=1,folder) - | appendpipe - [| map search="search `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames $gpo_guid$" - | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId - | rex field=old_value max_match=10000 "(?P\{.*?\})" - | rex field=new_value max_match=10000 "(?P\{.*?\})" - | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" - | mvexpand new_values - | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") - | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType - | eval newPolicy=if(policyType like "%",policyType,new_values) - | stats values(OpCorrelationID) as OpCorrelationID values(newPolicy) as newPolicy by ObjectDN - | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" - | fields - ObjectDN] - | stats values(AccessMask) as AccessMask values(src) as src values(src_user) as src_user values(RelativeTargetName) as RelativeTargetName values(Logon_ID) as Logon_ID values(newPolicy) as newPolicy values(OpCorrelationID) as OpCorrelationID values(folder) as folder values(file) as file by gpo_guid - | mvexpand folder - | where NOT folder IN (newPolicy) - | `windows_ad_suspicious_gpo_modification_filter` -how_to_implement: Ingest EventCodes 5145 and 5136 from domain controllers. Additional SACLs required to capture EventCode 5136, see references for further information on how to configure this. - The Group Policy - Audit Detailed File Share will need to be enabled on the DCs to generate event code 5145, this event is very noisy on DCs, consider tuning out sysvol events which do not match access mask 0x2. -known_false_positives: When a GPO is manually edited and 5136 events are not logging to Splunk. +description: This analytic looks for a the creation of potentially harmful GPO which + could lead to persistence or code execution on remote hosts. Note, this analyic + is looking for the absence of the corresponding 5136 events which is evidence of + the GPOs being manually edited (using a tool like PowerView) or potentially missing + logs. +search: "`wineventlog_security` EventCode=5145 ShareName=\"\\\\\\\\*\\\\SYSVOL\" RelativeTargetName\ + \ IN (*\\\\ScheduledTasks.xml, *\\\\Groups.xml, *\\\\Registry.xml, *\\\\Services.xml,\ + \ *\\\\Scripts\\\\*) NOT RelativeTargetName=*\\\\Scripts\\\\scripts.ini AccessMask=0x2\ + \ | rex field=AccessList max_match=0 \"(?P%%\\d+)\" | table _time\ + \ AccessMask src_ip src_user RelativeTargetName Logon_ID dvc | rex field=RelativeTargetName\ + \ \"Policies\\\\\\(?P{.*?})\\\\\\(?P\\w+?)\\\\\\(\\w+)\\\\\\(?P\\\ + w+)\\\\\\(?P\\w+\\.\\w+)$\" | eval src=if(match(src_ip, \"(?i)^fe80:\"),dvc,src_ip),\ + \ folder=case(RelativeTargetName like \"%\\\\Scripts\\\\%\",\"Scripts\",folder=\"\ + Groups\",\"Local users and groups\",1=1,folder) | appendpipe \n [| map search=\"\ + search `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames\ + \ $gpo_guid$\" \n | stats min(_time) as _time values(eval(if(OperationType==\"\ + %%14675\",AttributeValue,null))) as old_value values(eval(if(OperationType==\"%%14674\"\ + ,AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass\ + \ ObjectDN OpCorrelationID src_user SubjectLogonId \n | rex field=old_value max_match=10000\ + \ \"(?P\\{.*?\\})\" \n | rex field=new_value max_match=10000 \"(?P\\\ + {.*?\\})\" \n | rex field=ObjectDN max_match=10000 \"CN=(?P\\{.*?\\\ + })\" \n | mvexpand new_values \n | where NOT new_values IN (old_values,\"{00000000-0000-0000-0000-000000000000}\"\ + ,policy_guid) AND match(new_values, \"^\\{[A-Z|\\d]+\\-[A-Z|\\d]+\\-[A-Z|\\d]+\\\ + -[A-Z|\\d]+\\-[A-Z|\\d]+\\}\") \n | lookup msad_guid_lookup guid as new_values\ + \ OUTPUTNEW displayName as policyType \n | eval newPolicy=if(policyType like \"\ + %\",policyType,new_values) \n | stats values(OpCorrelationID) as OpCorrelationID\ + \ values(newPolicy) as newPolicy by ObjectDN \n | rex field=ObjectDN max_match=10000\ + \ \"CN=(?P\\{.*?\\})\" \n | fields - ObjectDN] \n| stats values(AccessMask)\ + \ as AccessMask values(src) as src values(src_user) as src_user values(RelativeTargetName)\ + \ as RelativeTargetName values(Logon_ID) as Logon_ID values(newPolicy) as newPolicy\ + \ values(OpCorrelationID) as OpCorrelationID values(folder) as folder values(file)\ + \ as file by gpo_guid | mvexpand folder | where NOT folder IN (newPolicy) | `windows_ad_suspicious_gpo_modification_filter`" +how_to_implement: Ingest EventCodes 5145 and 5136 from domain controllers. Additional + SACLs required to capture EventCode 5136, see references for further information + on how to configure this. The Group Policy - Audit Detailed File Share will need + to be enabled on the DCs to generate event code 5145, this event is very noisy on + DCs, consider tuning out sysvol events which do not match access mask 0x2. +known_false_positives: When a GPO is manually edited and 5136 events are not logging + to Splunk. references: - https://github.com/PowerShellMafia/PowerSploit/blob/26a0757612e5654b4f792b012ab8f10f95d391c9/Recon/PowerView.ps1#L5907-L6122 - https://github.com/X-C3LL/GPOwned @@ -43,47 +54,51 @@ references: - https://wald0.com/?p=179 - https://github.com/FSecureLABS/SharpGPOAbuse - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for $user$ and $src_user$ + search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 80 impact: 100 - message: $src_user$ has added new GPO Client Side Extensions $folder$ to the policy $gpo_guid$ + message: $src_user$ has added new GPO Client Side Extensions $folder$ to the policy + $gpo_guid$ mitre_attack_id: - T1484 - T1484.001 - T1222 - T1222.001 observable: - - name: user - type: User - role: - - Victim - - name: src_user - type: User - role: - - Victim + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud risk_score: 80 required_fields: - - _time - - OperationType - - ObjectDN - - OpCorrelationID - - src_user - - AttributeLDAPDisplayName - - AttributeValue - - ObjectClass - - SubjectLogonId - - DSName + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName security_domain: endpoint tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/gpo_new_cse/windows-security.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/gpo_new_cse/windows-security.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog diff --git a/detections/application/windows_increase_in_group_or_object_modification_activity.yml b/detections/application/windows_increase_in_group_or_object_modification_activity.yml index e3099cbb2a..0417a7b781 100644 --- a/detections/application/windows_increase_in_group_or_object_modification_activity.yml +++ b/detections/application/windows_increase_in_group_or_object_modification_activity.yml @@ -12,21 +12,22 @@ description: This analytic detects an increase in modifications to AD groups or such as unauthorized access attempts, impairing defences or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment. -search: >- - `wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764) - | bucket span=5m _time - | stats values(object) as object, dc(object) as objectCount, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status - | eventstats avg(objectCount) as comp_avg, stdev(objectCount) as comp_std by src_user, signature - | eval upperBound=(comp_avg+comp_std) - | eval isOutlier=if(objectCount > 10 and (objectCount >= upperBound), 1, 0) - | search isOutlier=1 - | `windows_increase_in_group_or_object_modification_activity_filter` -how_to_implement: Run this detection looking over a 7 day timeframe for best results. +search: '`wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764) | bucket + span=5m _time | stats values(object) as object, dc(object) as objectCount, values(src_user_category) + as src_user_category, values(dest) as dest, values(dest_category) as dest_category + by _time, src_user, signature, status | eventstats avg(objectCount) as comp_avg, + stdev(objectCount) as comp_std by src_user, signature | eval upperBound=(comp_avg+comp_std) + | eval isOutlier=if(objectCount > 10 and (objectCount >= upperBound), 1, 0) | search + isOutlier=1 | `windows_increase_in_group_or_object_modification_activity_filter`' +how_to_implement: Run this detection looking over a 7 day timeframe for best results. known_false_positives: Unknown references: [] +drilldown_searches: +- name: View the detection results for $src_user$ + search: '%orginal_detection_search% | search src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 40 impact: 20 @@ -54,4 +55,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog diff --git a/detections/application/windows_increase_in_user_modification_activity.yml b/detections/application/windows_increase_in_user_modification_activity.yml index 2f6baf93a7..641ab13457 100644 --- a/detections/application/windows_increase_in_user_modification_activity.yml +++ b/detections/application/windows_increase_in_user_modification_activity.yml @@ -12,22 +12,26 @@ description: This analytic detects an increase in modifications to AD user objec such as unauthorized access attempts, impairing defences or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment. -search: >- - `wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780) - | bucket span=5m _time - | stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status - | eventstats avg(userCount) as comp_avg , stdev(userCount) as comp_std by src_user, signature - | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0) - | search isOutlier=1 - | stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category values(signature) as signature by _time, src_user, status - | `windows_increase_in_user_modification_activity_filter` -how_to_implement: Run this detection looking over a 7 day timeframe for best results. +search: '`wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780) + | bucket span=5m _time | stats values(TargetDomainName) as TargetDomainName, values(user) + as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) + as src_user_category, values(dest) as dest, values(dest_category) as dest_category + by _time, src_user, signature, status | eventstats avg(userCount) as comp_avg , + stdev(userCount) as comp_std by src_user, signature | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0) | search + isOutlier=1 | stats values(TargetDomainName) as TargetDomainName, values(user) as + user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) + as src_user_category, values(dest) as dest, values(dest_category) as dest_category + values(signature) as signature by _time, src_user, status | `windows_increase_in_user_modification_activity_filter`' +how_to_implement: Run this detection looking over a 7 day timeframe for best results. known_false_positives: Genuine activity references: [] +drilldown_searches: +- name: View the detection results for $src_user$ + search: '%orginal_detection_search% | search src_user = $src_user$' tags: analytic_story: - - Sneaky Active Directory Persistence Tricks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 40 impact: 20 @@ -55,4 +59,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog