admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-11-02 11:56:14 -07:00
committed by GitHub
parent 5459d17d29 5e300eafa3
commit bb1b3ed291
78 changed files with 6184 additions and 563 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-and-validate.yml
+95 -90
View File
@@ -23,7 +23,7 @@ jobs:
steps:
- name: TAGGED, Validate that the tag is in the correct format
run: |
echo "The GITHUB_REF: $GITHUB_REF"
#First check to see if the release is a tag
@@ -32,7 +32,7 @@ jobs:
#is in the correct format (like v1.10.20)
if [[ $GITHUB_REF =~ refs/tags/v[0-9]+.[0-9]+.[0-9]+ ]]; then
echo "PASS: Tagged release with good format"
exit 0
exit 0
else
echo "FAIL: Tagged release with bad format"
exit 1
@@ -49,14 +49,14 @@ jobs:
runs-on: ubuntu-latest
needs: [validate-tag-if-present]
steps:
#Previous config chose which branch/tag to operate on.
#Previous config chose which branch/tag to operate on.
#I think Github is smart enough to choose based on whether it's a pull request or push + other info?
- name: Check out the repository code
- name: Check out the repository code
uses: actions/checkout@v2
#with:
# repository: splunk/security-content #check out https://github.com/mitre/cti.git, defaults to HEAD
# path: "security-content"
- uses: actions/setup-python@v2
with:
@@ -66,14 +66,14 @@ jobs:
#TODO: CircleCI restore_cache equivalent
#don't need to install python3 or python3-dev since it was handled by the action above?
#don't need to install python3 or python3-dev since it was handled by the action above?
#Also, no support for YAML anchors/aliases in Github Actions...
- name: Install System Packages
run: |
run: |
sudo apt update -qq
sudo apt install jq -qq
#TODO: CircleCI save_cache equivalent
sudo apt install jq -qq
#TODO: CircleCI save_cache equivalent
- name: Install Python Dependencies
run: |
#Get the virtualenv set up
@@ -83,19 +83,19 @@ jobs:
python3 -m pip install --upgrade pip
python3 -m pip install wheel
python3 -m pip install -q -r requirements.txt
- name: run validate
run: |
- name: run validate
run: |
source venv/bin/activate
python3 contentctl.py --path . --verbose validate
- name: Get CTI Repo for Mitre context
uses: actions/checkout@v2
- name: Get CTI Repo for Mitre context
uses: actions/checkout@v2
with:
repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD
path: "cti/"
#Now generate the documentation (uses Node)
- uses: actions/setup-node@v2
@@ -108,18 +108,18 @@ jobs:
#Enter the virtualenv and run the docgen
source venv/bin/activate
python3 bin/doc_gen.py --path . --output docs -v
#Now generate the spec docs
npm install -g @adobe/jsonschema2md
jsonschema2md -d spec -o docs/spec -f yaml -e spec.json -x -
#Clean up extra properties on docs
rm -rf docs/spec/*-*.md
echo "****** BRANCH INFORMATION ******"
git branch
git branch --show-current
build-sources:
runs-on: ubuntu-latest
needs: validate-content
@@ -128,10 +128,10 @@ jobs:
uses: actions/checkout@v2
- name: Install System Packages
run: |
run: |
sudo apt update -qq
sudo apt install jq -qq
sudo apt install jq -qq
- name: Install Python Dependencies
run: |
#Get the virtualenv set up
@@ -143,18 +143,15 @@ jobs:
python3 -m pip install -q -r requirements.txt
- name: Run Generate
run: |
run: |
source venv/bin/activate
python3 contentctl.py --path . --verbose generate --product ESCU --output dist/escu
python3 contentctl.py --path . --verbose generate --product SAAWS --output dist/saaws
python3 contentctl.py --path . --verbose generate --product DevSecOps --output dist/devsecops
# make a copy of use_case_lib in order to have ES work :-(
# cp dist/escu/default/use_case_library.conf dist/escu/default/analyticstories.conf
# cp dist/saaws/default/use_case_library.conf dist/saaws/default/analyticstories.conf
# cp dist/devsecops/default/use_case_library.conf dist/devsecops/default/analyticstories.conf
python3 contentctl.py --path . --verbose generate --product SSA --output dist/ssa
- name: Copy lookups .csv files
run: |
run: |
# clean up current lookups
rm -rf dist/escu/lookups
rm -rf dist/saaws/lookups
@@ -167,7 +164,7 @@ jobs:
cp -rv *.csv ../dist/escu/lookups
cp -rv *.csv ../dist/saaws/lookups
cp -rv *.csv ../dist/devsecops/lookups
#Tag is '' for non-tagged push and the tag name for a tagged release
- name: Set tag
id: vars
@@ -198,7 +195,7 @@ jobs:
sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/escu/app.manifest
sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/content-version.conf
tar -czf content-pack-build-escu.tar.gz dist/escu/*
# update build number and version for saaws
sed -i "s/build = .*$/build = ${{ github.run_number }}/g" dist/saaws/default/app.conf
sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/app.conf
@@ -209,6 +206,9 @@ jobs:
# update build number and version for devsecops
tar -czf content-pack-build-devsecops.tar.gz dist/devsecops/*
# update build number and version for ssa
tar -czf content-pack-build-ssa.tar.gz dist/ssa/*
- name: Persist to Workspace
uses: actions/upload-artifact@v2
with:
@@ -217,12 +217,13 @@ jobs:
content-pack-build-escu.tar.gz
content-pack-build-saaws.tar.gz
content-pack-build-devsecops.tar.gz
content-pack-build-ssa.tar.gz
build-package:
runs-on: ubuntu-latest
needs: [validate-content, build-sources]
steps:
- uses: actions/download-artifact@v2
with:
@@ -234,12 +235,12 @@ jobs:
with:
python-version: '2.7' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
- name: Get virtualenv for Python 2.7
run: |
sudo apt install virtualenv
sudo apt install virtualenv
- name: Grab Splunk Packaging Toolkit
- name: Grab Splunk Packaging Toolkit
run : |
curl -Ls https://download.splunk.com/misc/packaging-toolkit/splunk-packaging-toolkit-0.9.0.tar.gz -o splunk-packaging-toolkit-latest.tar.gz
mkdir slim-latest
@@ -264,6 +265,7 @@ jobs:
mv dist/escu DA-ESS-ContentUpdate
mv dist/saaws DA-ESS_AmazonWebServices_Content
mv dist/devsecops dev_sec_ops_analytics
slim package -o upload DA-ESS-ContentUpdate
slim package -o upload DA-ESS_AmazonWebServices_Content
slim package -o upload dev_sec_ops_analytics
@@ -276,6 +278,9 @@ jobs:
cp upload/dev_sec_ops_analytics-*tar.gz dev_sec_ops_analytics-latest.tar.gz
cp content-pack-build-ssa.tar.gz upload/SSA_Content-latest.tar.gz
sha256sum upload/SSA_Content-latest.tar.gz >> checksum.txt
touch tag-canary.txt
- name: store_artifacts
@@ -292,8 +297,9 @@ jobs:
build/DA-ESS-ContentUpdate-latest.tar.gz
build/DA-ESS_AmazonWebServices_Content-latest.tar.gz
build/dev_sec_ops_analytics-latest.tar.gz
build/SSA_Content-latest.tar.gz
build/checksum.txt
#Everything below this line should ONLY run on a tag and nothing else
#We still want all of the above checks to run and pass before running these
@@ -301,7 +307,7 @@ jobs:
runs-on: ubuntu-latest
needs: [validate-content, build-sources, build-package]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
if: startsWith(github.ref, 'refs/tags/')
steps:
- name: Checkout Repo
@@ -319,10 +325,10 @@ jobs:
- name: Install System Packages
run: |
run: |
sudo apt update -qq
sudo apt install jq -qq
- name: Submit ESCU Package to AppInspect API
@@ -333,8 +339,8 @@ jobs:
cd bin
#Enclose in quotes in case there are any special characters in the username/password
#Better not to pass these arguments on the command line, if possible
./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
- name: Submit SAAWS Package to AppInspect API
env:
APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }}
@@ -342,20 +348,20 @@ jobs:
run: |
cd bin
./appinspect.sh ../ DA-ESS_AmazonWebServices_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
- name: Create report artifact
if: always()
run: |
#Always create this, regardless of whether success or failure above
tar -cvzf report.tar.gz report/
- name: store_artifacts
- name: store_artifacts
uses: actions/upload-artifact@v2
with:
name: appinspect_reports
path: |
report.tar.gz
#Still store the report, even if we have failed (otherwise we don't know why/how we failed)
- name: store_artifacts_on_failure
uses: actions/upload-artifact@v2
@@ -364,7 +370,7 @@ jobs:
name: appinspect_reports_failure
path: |
report.tar.gz
create-report:
runs-on: ubuntu-latest
needs: [validate-content, build-sources, build-package, run-appinspect]
@@ -375,13 +381,13 @@ jobs:
uses: actions/checkout@v2
with:
ref: 'develop'
- name: Install System Packages
run: |
run: |
sudo apt update -qq
sudo apt install jq -qq
- uses: actions/setup-python@v2
with:
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
@@ -396,12 +402,12 @@ jobs:
python3 -m pip install --upgrade pip
python3 -m pip install wheel
python3 -m pip install -q -r requirements.txt
- name: run reporting
run: |
run: |
source venv/bin/activate
python3 bin/reporting.py
#Official, Verified Amazon-AWS Github Account Provided Action
- uses: aws-actions/configure-aws-credentials@v1
with:
@@ -410,23 +416,23 @@ jobs:
# aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
- name: Upload Reporting
- name: Upload Reporting
run: |
aws s3 cp bin/reporting s3://security-content/reporting --recursive --exclude "*" --include "*.svg"
update-sources-github:
runs-on: ubuntu-latest
needs: [validate-content, build-sources, build-package, run-appinspect, create-report]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
steps:
- name: Checkout Repo
uses: actions/checkout@v2
with:
token: ${{ secrets.PROTECTED_BRANCH_PUSH_TOKEN }}
ref: 'develop'
- uses: actions/setup-python@v2
with:
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
@@ -443,6 +449,8 @@ jobs:
tar -zxf DA-ESS-ContentUpdate-latest.tar.gz -C latest-escu --strip-components=1
mkdir latest-saaws
tar -zxf DA-ESS_AmazonWebServices_Content-latest.tar.gz -C latest-saaws --strip-components=1
mkdir latest-ssa
tar -zxf SSA_Content-latest.tar.gz -C latest-saaws --strip-components=1
- name: Install Python Dependencies
run: |
#Get the virtualenv set up
@@ -452,9 +460,9 @@ jobs:
python3 -m pip install --upgrade pip
python3 -m pip install wheel
python3 -m pip install -q -r requirements.txt
- name: Get CTI Repo for Mitre context
uses: actions/checkout@v2
- name: Get CTI Repo for Mitre context
uses: actions/checkout@v2
with:
repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD
path: "cti/"
@@ -463,33 +471,30 @@ jobs:
id: vars
run: |
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
- name: Run doc-gen
run: |
source venv/bin/activate
python3 bin/doc_gen.py --path . --output docs -v
- name: Make YAMLs Pretty
- name: Run doc-gen
run: |
source venv/bin/activate
python3 bin/pretty_yaml.py --path . -v
python3 bin/doc_gen.py --path . --output docs -v
- name: Make YAMLs Pretty
run: |
source venv/bin/activate
python3 bin/pretty_yaml.py --path . -v
- name: Run generate-coverage-map
run: |
source venv/bin/activate
python3 bin/generate-coverage-map.py --projects_path . --output docs/mitre-map
- name: Update github with new docs and package bits
run: |
rm -rf dist
mkdir dist
echo "Directory layout 3"
pwd
ls -lah
mv latest-escu dist/escu
mv latest-saaws dist/saaws
mv latest-ssa dist/ssa
# configure git to prep for commit
#git config credential.helper 'cache --timeout=120'
git config user.email "research@splunk.com"
git config user.name "research bot"
git config --global push.default simple
@@ -500,7 +505,7 @@ jobs:
# Push quietly to prevent showing the token in log
#No need to provide any credentials
git push
publish-github-release:
#Github-maintained release action is in archived state: https://github.com/actions/create-release
@@ -510,7 +515,7 @@ jobs:
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
#Get the artifacts that we need
- uses: actions/download-artifact@v2
with:
@@ -520,23 +525,24 @@ jobs:
with:
name: appinspect_reports
#Rename those artifacts appropriately
- name: Set tag
id: vars
run: echo "::set-output name=tag::${GITHUB_REF#refs/*/}"
- name: Rename the content-update appropriately
- name: Rename the content-update appropriately
run: |
cp DA-ESS-ContentUpdate-latest.tar.gz DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz
cp DA-ESS_AmazonWebServices_Content-latest.tar.gz DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz
cp SSA_Content-latest.tar.gz SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz
#No checksum on the reports
cp report.tar.gz report-${{ steps.vars.outputs.tag }}.tar.gz
cp checksum.txt checksum-${{ steps.vars.outputs.tag }}.txt
#Upload all of the artifacts that we have created using the third party
#action recommended bu Github
- name: Upload Release Artifacts
@@ -545,18 +551,19 @@ jobs:
files: |
DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz
DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz
SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz
report-${{ steps.vars.outputs.tag }}.tar.gz
checksum-${{ steps.vars.outputs.tag }}.txt
attack-range-update:
runs-on: ubuntu-latest
needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
steps:
#Get the artifacts that we need
- uses: actions/download-artifact@v2
with:
@@ -569,20 +576,20 @@ jobs:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
# aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
- name: Sync latest ESCU to the Attack Range S3 bucket for apps
run: |
aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/
# make the file public since it is not by default
aws s3api put-object-acl --bucket attack-range-appbinaries --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read
master-api-update:
runs-on: ubuntu-latest
needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
steps:
- name: Checkout Repo
uses: actions/checkout@v2
with:
@@ -607,7 +614,7 @@ jobs:
- name: Create Baseline Folder
run: |
source venv/bin/activate
python3 bin/create_baseline_folder.py
python3 bin/create_baseline_folder.py
#Official, Verified Amazon-AWS Github Account Provided Action
- uses: aws-actions/configure-aws-credentials@v1
@@ -615,7 +622,7 @@ jobs:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
# aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
- name: Update API sources
run: |
@@ -637,5 +644,3 @@ jobs:
echo "Error [Security Content API status: $API_STATUS]"
exit 1
fi
bin/generate.py
+60 -46
View File
@@ -92,6 +92,29 @@ def generate_collections_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH):
return output_path
def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH):
'''
@param detections: input list of individual YAML detections in detections/ directory
@return: the enhanced yaml file located in /detections directory
'''
# disable yaml pointers https://stackoverflow.com/questions/51272814/python-yaml-dumping-pointer-references
yaml.Dumper.ignore_aliases = lambda *args : True
for d in detections:
manifest_file = OUTPUT_PATH + '/detections/' + d['name'].lower().replace(" ", "_") + '.yml'
# remove unused fields
del d['risk']
del d['deployment']
del d['mappings']
del d['savedsearch_annotations']
with open(manifest_file, 'w') as file:
documents = yaml.dump(d, file, sort_keys=True)
return OUTPUT_PATH + '/detections/'
def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_PATH):
'''
@param detections: input list of individual YAML detections in detections/ directory
@@ -113,19 +136,6 @@ def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_P
return output_path
# def generate_analytic_story_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH):
# utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
# j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
# trim_blocks=True)
# template = j2_env.get_template('analytic_stories.j2')
# output_path = path.join(OUTPUT_PATH, 'default/analytic_stories.conf')
# output = template.render(stories=stories, time=utc_time)
# with open(output_path, 'w', encoding="utf-8") as f:
# f.write(output)
# return output_path
def generate_use_case_library_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH):
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
@@ -245,7 +255,6 @@ def get_deployments(object, deployments):
for tag_value_deployment in tag_array_deployment:
if tag_value == tag_value_deployment:
# print("tag value: {}, matched deployment tag: {} on deployment: {}".format(tag_value,tag_value_deployment, deployment))
matched_deployments.append(deployment)
continue
@@ -257,9 +266,7 @@ def get_deployments(object, deployments):
last_deployment = deployment
else:
last_deployment = matched_deployments[-1]
# last_deployment = replace_vars_in_deployment(last_deployment, object) # Not needed because of custom_jinja2_enrichment_filter
# print(last_deployment)
return last_deployment
def get_nes_fields(search, deployment):
@@ -336,18 +343,18 @@ def add_annotations(detection):
savedsearch_annotations[key] = detection['tags'][key]
detection['savedsearch_annotations'] = savedsearch_annotations
# add SSA risk_severity
if 'risk_score' in detection['tags']:
if detection['tags']['risk_score'] >= 80:
detection['tags']['risk_severity'] = 'high'
elif(50>= detection['tags']['risk_score'] <=79):
detection['tags']['risk_severity'] = 'medium'
else:
detection['tags']['risk_severity'] = 'low'
return detection
def add_rba(detection):
# removed since this is causing a duplicate bug in ES 6.4+
# if 'risk_object' in detection['tags']:
# detection['risk_object'] = detection['tags']['risk_object']
# if 'risk_object_type' in detection['tags']:
# detection['risk_object_type'] = detection['tags']['risk_object_type']
# if 'risk_score' in detection['tags']:
# detection['risk_score'] = detection['tags']['risk_score']
# grab risk message
if 'message' in detection['tags']:
detection['risk_message'] = detection['tags']['message']
@@ -433,7 +440,6 @@ def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH):
elif detection['type'] == 'Correlation':
detection['search'] = detection['search'] + ' | collect index=alerts'
# parse out data_models
data_model = parse_data_models_from_search(detection['search'])
if data_model:
@@ -465,7 +471,7 @@ def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH):
if 'product' in detection['tags']:
detection['product'] = detection['tags']['product']
# turn all SAAWS detections
# enable all SAAWS detections
if (OUTPUT_PATH) == 'dist/saaws':
detection['disabled'] = 'false'
@@ -626,14 +632,17 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH):
objects["detections"] = [object for object in objects["detections"] if 'Dev Sec Ops Analytics' in object['tags']['product']]
objects["stories"] = [object for object in objects["stories"] if 'Dev Sec Ops Analytics' in object['tags']['product']]
if PRODUCT == "ESCU":
# only use ESCU detections to the configurations
objects["detections"] = sorted(filter(lambda d: not 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name'])
objects["stories"] = sorted(filter(lambda s: not 'Splunk Behavioral Analytics' in s['tags']['product'], objects["stories"]), key=lambda s: s['name'])
# only use ESCU detections to the configurations
objects["detections"] = sorted(filter(lambda d: not 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name'])
# only use ESCU stories to the configuration
objects["stories"] = sorted(filter(lambda s: not 'Splunk Behavioral Analytics' in s['tags']['product'], objects["stories"]), key=lambda s: s['name'])
if PRODUCT == "SSA":
# only SSA detections, also no need to calculate stories
objects["detections"] = sorted(filter(lambda d: 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name'])
objects["stories"] = sorted(filter(lambda s: 'Splunk Behavioral Analytics' in s['tags']['product'], objects["stories"]), key=lambda s: s['name'])
objects["macros"] = sorted(objects["macros"], key=lambda m: m['name'])
objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], objects["playbooks"], OUTPUT_PATH)
objects["stories"] = prepare_stories(objects["stories"], objects["detections"], objects["playbooks"])
@@ -654,31 +663,36 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
try:
if VERBOSE:
print("generating Mitre lookups")
generate_mitre_lookup(OUTPUT_PATH)
# generate_mitre_lookup(OUTPUT_PATH)
except Exception as e:
print('Error: ' + str(e))
print("WARNING: Generation of Mitre lookup failed.")
lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
# story_path = generate_analytic_story_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
# calculate deprecation totals
deprecated = []
for d in objects['detections']:
if 'deprecated' in d:
deprecated.append(d)
detection_path = ''
lookups_path = ''
lookups_files= ''
use_case_lib_path = ''
macros_path = ''
workbench_panels_objects = ''
if global_product == 'SSA':
detection_path = generate_ssa_yaml(objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
objects["macros"] = []
else:
detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
if VERBOSE:
print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path))
print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
contentctl.py
+3 -6
View File
@@ -103,16 +103,13 @@ def main(args):
# validate arguments
validate_parser.set_defaults(func=validate, epilog="""
Validates security manifest for correctness, adhering to spec and other common items.
VALIDATE DOES NOT PROCESS RESPONSES SPEC for the moment.""")
Validates security manifest for correctness, adhering to spec and other common items.""")
# generate arguments
generate_parser.add_argument("-f", "--format", required=False, type=str, default="splunk_app",
help="Format of our deployment package, defaults to `splunk_app`.\n The deployment `splunk_app` runs on product Splunk Enterprise Security and Splunk Enterprise.")
generate_parser.add_argument("-o", "--output", required=False, type=str, default="dist/escu",
help="Path where to store the deployment package, defaults to `dist/escu`")
generate_parser.add_argument("--product", required=False, type=str, default="ESCU",
help="Type of package to create, choose between `ESCU`, or `SAAWS`. Defaults to `ESCU`")
generate_parser.add_argument("-p", "--product", required=False, type=str, default="ESCU",
help="Type of package to create, choose between `ESCU`, `DevSecOps`, `SAAWS`, or `SSA`. Defaults to `ESCU`")
generate_parser.set_defaults(func=generate)
# # parse them
dist/escu/default/analyticstories.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-10-28T22:30:10 UTC
# On Date: 2021-11-01T18:33:22 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-10-28T22:30:10 UTC
# On Date: 2021-11-01T18:33:22 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/macros.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-10-28T22:30:10 UTC
# On Date: 2021-11-01T18:33:22 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/savedsearches.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-10-28T22:30:10 UTC
# On Date: 2021-11-01T18:33:22 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-10-28T22:30:10 UTC
# On Date: 2021-11-01T18:33:22 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/analyticstories.conf
Vendored
+81 -81
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-10-28T22:30:45 UTC
# On Date: 2021-11-01T18:33:43 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -26,7 +26,7 @@ version = 2
references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
spec_version = 3
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.
@@ -37,7 +37,7 @@ version = 1
references = ["https://aws.amazon.com/security-hub/features/"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
spec_version = 3
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
description = This story is focused around detecting Security Hub alerts generated from AWS
narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.
@@ -48,7 +48,7 @@ version = 1
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
spec_version = 3
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \
@@ -106,7 +106,7 @@ version = 2
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
spec_version = 3
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
@@ -119,7 +119,7 @@ version = 1
references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
spec_version = 3
searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"]
searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"]
description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity.
narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\
This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS.
@@ -131,7 +131,7 @@ version = 1
references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
spec_version = 3
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.
@@ -163,6 +163,26 @@ In addition to compromising the security of your data, when bad actors leverage
### DETECTIONS ###
[savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
known_false_positives =
providing_technologies = []
[savedsearch://ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
known_false_positives =
providing_technologies = []
[savedsearch://ESCU - AWS Create Policy Version to allow all resources - Rule]
type = detection
asset_type = AWS Account
@@ -343,46 +363,6 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
providing_technologies = []
[savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
known_false_positives =
providing_technologies = []
[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
type = detection
asset_type = Cloud Instance
confidence = medium
explanation = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
providing_technologies = []
[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
type = detection
asset_type = Cloud Instance
confidence = medium
explanation = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
providing_technologies = []
[savedsearch://ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
known_false_positives =
providing_technologies = []
[savedsearch://ESCU - Cloud API Calls From Previously Unseen User Roles - Rule]
type = detection
asset_type = AWS Instance
@@ -527,16 +507,6 @@ annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives
known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
providing_technologies = []
[savedsearch://ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
type = detection
asset_type = S3 Bucket
confidence = medium
explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
how_to_implement =
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
providing_technologies = []
[savedsearch://ESCU - Detect New Open S3 buckets - Rule]
type = detection
asset_type = S3 Bucket
@@ -547,14 +517,14 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
providing_technologies = []
[savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
[savedsearch://ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
type = detection
asset_type = AWS Instance
asset_type = S3 Bucket
confidence = medium
explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
known_false_positives = None
explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
how_to_implement =
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
providing_technologies = []
[savedsearch://ESCU - Detect shared ec2 snapshot - Rule]
@@ -567,6 +537,16 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives
known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose.
providing_technologies = []
[savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
type = detection
asset_type = AWS Instance
confidence = medium
explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
known_false_positives = None
providing_technologies = []
[savedsearch://ESCU - O365 Add App Role Assignment Grant User - Rule]
type = detection
asset_type = Office 365
@@ -677,10 +657,38 @@ annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
type = detection
asset_type = Cloud Instance
confidence = medium
explanation = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
providing_technologies = []
[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
type = detection
asset_type = Cloud Instance
confidence = medium
explanation = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
providing_technologies = []
### END DETECTIONS ###
### RESPONSE TASKS ###
[savedsearch://ESCU - Amazon EKS Kubernetes activity by src ip - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch EKS inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - AWS Investigate Security Hub alerts by dest - Response Task]
type = investigation
explanation = none
@@ -689,7 +697,7 @@ known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - AWS Investigate User Activities By ARN - Response Task]
[savedsearch://ESCU - AWS Investigate User Activities By AccessKeyId - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
@@ -697,7 +705,7 @@ known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - AWS Investigate User Activities By AccessKeyId - Response Task]
[savedsearch://ESCU - AWS Investigate User Activities By ARN - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
@@ -729,14 +737,6 @@ known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Amazon EKS Kubernetes activity by src ip - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch EKS inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Get All AWS Activity From City - Response Task]
type = investigation
explanation = none
@@ -785,14 +785,6 @@ known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Investigate AWS User Activities by user field - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Investigate AWS activities via region name - Response Task]
type = investigation
explanation = none
@@ -801,4 +793,12 @@ known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
[savedsearch://ESCU - Investigate AWS User Activities by user field - Response Task]
type = investigation
explanation = none
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
known_false_positives = not defined
earliest_time_offset = 14400
latest_time_offset = 0
### END RESPONSE TASKS ###
dist/saaws/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-10-28T22:30:45 UTC
# On Date: 2021-11-01T18:33:43 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/macros.conf
Vendored
+37 -37
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-10-28T22:30:45 UTC
# On Date: 2021-11-01T18:33:43 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -483,6 +483,18 @@ description = customer specific splunk configurations(eg- index, source, sourcet
definition = index=zeek sourcetype="zeek:ssl:json"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_number_of_cloud_security_group_api_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[amazon_eks_kubernetes_activity_by_src_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_create_policy_version_to_allow_all_resources_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -535,15 +547,11 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_investigate_user_activities_by_arn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_investigate_user_activities_by_accesskeyid_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_network_acl_details_from_id_filter]
[aws_investigate_user_activities_by_arn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -555,6 +563,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_network_acl_details_from_id_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_network_interface_details_via_resourceid_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -579,26 +591,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_number_of_cloud_instances_destroyed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_number_of_cloud_instances_launched_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_number_of_cloud_security_group_api_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[amazon_eks_kubernetes_activity_by_src_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[baseline_of_cloud_infrastructure_api_calls_per_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -671,15 +663,11 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_open_s3_buckets_over_aws_cli_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_open_s3_buckets_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
[detect_new_open_s3_buckets_over_aws_cli_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -687,6 +675,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_all_aws_activity_from_city_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -711,11 +703,11 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[investigate_aws_user_activities_by_user_field_filter]
[investigate_aws_activities_via_region_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[investigate_aws_activities_via_region_name_filter]
[investigate_aws_user_activities_by_user_field_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -827,11 +819,19 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[previously_seen_users_in_cloudtrail___update_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[previously_seen_users_in_cloudtrail___initial_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[previously_seen_users_in_cloudtrail___update_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_number_of_cloud_instances_destroyed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_number_of_cloud_instances_launched_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
dist/saaws/default/savedsearches.conf
Vendored
+296 -296
View File
@@ -1,12 +1,90 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-10-28T22:30:45 UTC
# On Date: 2021-11-01T18:33:43 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
### ESCU DETECTIONS ###
[ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
action.escu.data_models = ["Change"]
action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
action.escu.known_false_positives =
action.escu.creation_date = 2020-09-07
action.escu.modification_date = 2020-09-07
action.escu.confidence = high
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Suspicious Cloud User Activities"]
action.risk = 1
action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = false
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_api_calls_v1 threshold=0.005 | rename "IsOutlier(api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where api_calls > expected_upper_threshold | eval distance_from_threshold = api_calls - expected_upper_threshold | table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`
[ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
action.escu.data_models = ["Change"]
action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model.
action.escu.known_false_positives =
action.escu.creation_date = 2020-09-07
action.escu.modification_date = 2020-09-07
action.escu.confidence = high
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Suspicious Cloud User Activities"]
action.risk = 1
action.risk.param._risk_message = user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:Inbound", "Outcome:Allowed", "Stage:Execution", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = false
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls - expected_upper_threshold | table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`
[ESCU - AWS Create Policy Version to allow all resources - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -709,162 +787,6 @@ realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success| search userIdentity.userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`
[ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
action.escu.data_models = ["Change"]
action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
action.escu.known_false_positives =
action.escu.creation_date = 2020-09-07
action.escu.modification_date = 2020-09-07
action.escu.confidence = high
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Suspicious Cloud User Activities"]
action.risk = 1
action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = false
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_api_calls_v1 threshold=0.005 | rename "IsOutlier(api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where api_calls > expected_upper_threshold | eval distance_from_threshold = api_calls - expected_upper_threshold | table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`
[ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
action.escu.data_models = ["Change"]
action.escu.eli5 = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
action.escu.known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
action.escu.creation_date = 2020-08-21
action.escu.modification_date = 2020-08-21
action.escu.confidence = high
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
action.risk = 1
action.risk.param._risk_message =
action.risk.param._risk = []
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
schedule_window = auto
alert.digest_mode = 1
disabled = false
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1] | where cardinality >=16 | apply cloud_excessive_instances_destroyed_v1 threshold=0.005 | rename "IsOutlier(instances_destroyed)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_destroyed - expected_upper_threshold | table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter`
[ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
action.escu.data_models = ["Change"]
action.escu.eli5 = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
action.escu.creation_date = 2020-08-21
action.escu.modification_date = 2020-08-21
action.escu.confidence = high
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]
action.risk = 1
action.risk.param._risk_message =
action.risk.param._risk = []
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule
action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
schedule_window = auto
alert.digest_mode = 1
disabled = false
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1] | where cardinality >=16 | apply cloud_excessive_instances_created_v1 threshold=0.005 | rename "IsOutlier(instances_launched)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_launched - expected_upper_threshold | table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_launched_filter`
[ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
action.escu.data_models = ["Change"]
action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model.
action.escu.known_false_positives =
action.escu.creation_date = 2020-09-07
action.escu.modification_date = 2020-09-07
action.escu.confidence = high
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Suspicious Cloud User Activities"]
action.risk = 1
action.risk.param._risk_message = user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:Inbound", "Outcome:Allowed", "Stage:Execution", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = false
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls - expected_upper_threshold | table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`
[ESCU - Cloud API Calls From Previously Unseen User Roles - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -1415,45 +1337,6 @@ realtime_schedule = 0
is_visible = false
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Region | join user type=outer [| inputlookup previously_seen_users_console_logins | stats earliest(firstTime) AS earliestseen by user Region | fields earliestseen user Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userRegion = "New Region" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user Region userStatus userRegion | `detect_aws_console_login_by_user_from_new_region_filter`
[ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
action.escu.how_to_implement =
action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
action.escu.creation_date = 2021-07-19
action.escu.modification_date = 2021-07-19
action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
action.risk = 1
action.risk.param._risk_message = User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userIdentity.userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = false
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter`
[ESCU - Detect New Open S3 buckets - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -1493,33 +1376,33 @@ realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter`
[ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
[ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
action.escu.known_false_positives = None
action.escu.creation_date = 2021-01-26
action.escu.modification_date = 2021-01-26
action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
action.escu.how_to_implement =
action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
action.escu.creation_date = 2021-07-19
action.escu.modification_date = 2021-07-19
action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
action.escu.full_search_name = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["AWS Security Hub Alerts"]
action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
action.risk = 1
action.risk.param._risk_message = Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
action.risk.param._risk_message = User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Execution"], "impact": 30, "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userIdentity.userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = false
@@ -1530,7 +1413,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`
search = `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter`
[ESCU - Detect shared ec2 snapshot - Rule]
action.escu = 0
@@ -1571,6 +1454,45 @@ realtime_schedule = 0
is_visible = false
search = `cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter`
[ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
action.escu.data_models = []
action.escu.eli5 = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
action.escu.known_false_positives = None
action.escu.creation_date = 2021-01-26
action.escu.modification_date = 2021-01-26
action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["AWS Security Hub Alerts"]
action.risk = 1
action.risk.param._risk_message = Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Execution"], "impact": 30, "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = false
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`
[ESCU - O365 Add App Role Assignment Grant User - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -2000,6 +1922,84 @@ realtime_schedule = 0
is_visible = false
search = `o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingSmtpAddress | where count_src_user > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_user_email_forwarding_filter`
[ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
action.escu.data_models = ["Change"]
action.escu.eli5 = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
action.escu.known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
action.escu.creation_date = 2020-08-21
action.escu.modification_date = 2020-08-21
action.escu.confidence = high
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
action.risk = 1
action.risk.param._risk_message =
action.risk.param._risk = []
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
schedule_window = auto
alert.digest_mode = 1
disabled = false
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1] | where cardinality >=16 | apply cloud_excessive_instances_destroyed_v1 threshold=0.005 | rename "IsOutlier(instances_destroyed)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_destroyed - expected_upper_threshold | table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter`
[ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
action.escu.data_models = ["Change"]
action.escu.eli5 = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
action.escu.creation_date = 2020-08-21
action.escu.modification_date = 2020-08-21
action.escu.confidence = high
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]
action.risk = 1
action.risk.param._risk_message =
action.risk.param._risk = []
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule
action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
schedule_window = auto
alert.digest_mode = 1
disabled = false
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = | tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1] | where cardinality >=16 | apply cloud_excessive_instances_created_v1 threshold=0.005 | rename "IsOutlier(instances_launched)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_launched - expected_upper_threshold | table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_launched_filter`
### END ESCU DETECTIONS ###
@@ -2447,28 +2447,6 @@ disabled = false
is_visible = false
search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions | stats count
[ESCU - Previously Seen Users In CloudTrail - Update]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = support
action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Update
description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.
action.escu.creation_date = 2020-05-28
action.escu.modification_date = 2020-05-28
action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
action.escu.data_models = ["Authentication"]
cron_schedule = 10 0 * * *
enableSched = 1
dispatch.earliest_time = -1450m@m
dispatch.latest_time = -10m@m
schedule_window = auto
action.escu.providing_technologies = []
action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.
action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.
disabled = false
is_visible = false
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins
[ESCU - Previously Seen Users in CloudTrail - Initial]
action.escu = 0
action.escu.enabled = 1
@@ -2491,10 +2469,53 @@ disabled = false
is_visible = false
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count
[ESCU - Previously Seen Users In CloudTrail - Update]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = support
action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Update
description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.
action.escu.creation_date = 2020-05-28
action.escu.modification_date = 2020-05-28
action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
action.escu.data_models = ["Authentication"]
cron_schedule = 10 0 * * *
enableSched = 1
dispatch.earliest_time = -1450m@m
dispatch.latest_time = -10m@m
schedule_window = auto
action.escu.providing_technologies = []
action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.
action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.
disabled = false
is_visible = false
search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins
### ESCU RESPONSE TASKS ###
[ESCU - Amazon EKS Kubernetes activity by src ip - Response Task]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = investigative
action.escu.full_search_name = ESCU - Amazon EKS Kubernetes activity by src ip - Response Task
description = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address
action.escu.creation_date = 2020-04-13
action.escu.modification_date = 2020-04-13
action.escu.analytic_story = ["Kubernetes Scanning Activity"]
action.escu.earliest_time_offset = 3600
action.escu.latest_time_offset = 86400
action.escu.providing_technologies = []
action.escu.data_models = []
action.escu.eli5 = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address
action.escu.how_to_implement = none
action.escu.known_false_positives = None at this time
disabled = true
schedule_window = auto
is_visible = false
search = `aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip
[ESCU - AWS Investigate Security Hub alerts by dest - Response Task]
action.escu = 0
action.escu.enabled = 1
@@ -2516,27 +2537,6 @@ schedule_window = auto
is_visible = false
search = `aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation
[ESCU - AWS Investigate User Activities By ARN - Response Task]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = investigative
action.escu.full_search_name = ESCU - AWS Investigate User Activities By ARN - Response Task
description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
action.escu.creation_date = 2019-04-30
action.escu.modification_date = 2019-04-30
action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "Cloud Cryptomining", "Command and Control", "Suspicious AWS EC2 Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Unusual AWS EC2 Modifications", "Suspicious Cloud User Activities", "AWS Suspicious Provisioning Activities", "Suspicious Cloud Instance Activities", "AWS Security Hub Alerts"]
action.escu.earliest_time_offset = 3600
action.escu.latest_time_offset = 86400
action.escu.providing_technologies = []
action.escu.data_models = []
action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
action.escu.how_to_implement = none
action.escu.known_false_positives = None at this time
disabled = true
schedule_window = auto
is_visible = false
search = `cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType
[ESCU - AWS Investigate User Activities By AccessKeyId - Response Task]
action.escu = 0
action.escu.enabled = 1
@@ -2558,6 +2558,27 @@ schedule_window = auto
is_visible = false
search = `cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage
[ESCU - AWS Investigate User Activities By ARN - Response Task]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = investigative
action.escu.full_search_name = ESCU - AWS Investigate User Activities By ARN - Response Task
description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
action.escu.creation_date = 2019-04-30
action.escu.modification_date = 2019-04-30
action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "Cloud Cryptomining", "Command and Control", "Suspicious AWS EC2 Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Unusual AWS EC2 Modifications", "Suspicious Cloud User Activities", "AWS Suspicious Provisioning Activities", "Suspicious Cloud Instance Activities", "AWS Security Hub Alerts"]
action.escu.earliest_time_offset = 3600
action.escu.latest_time_offset = 86400
action.escu.providing_technologies = []
action.escu.data_models = []
action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
action.escu.how_to_implement = none
action.escu.known_false_positives = None at this time
disabled = true
schedule_window = auto
is_visible = false
search = `cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType
[ESCU - AWS Network ACL Details from ID - Response Task]
action.escu = 0
action.escu.enabled = 1
@@ -2621,27 +2642,6 @@ schedule_window = auto
is_visible = false
search = `aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList
[ESCU - Amazon EKS Kubernetes activity by src ip - Response Task]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = investigative
action.escu.full_search_name = ESCU - Amazon EKS Kubernetes activity by src ip - Response Task
description = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address
action.escu.creation_date = 2020-04-13
action.escu.modification_date = 2020-04-13
action.escu.analytic_story = ["Kubernetes Scanning Activity"]
action.escu.earliest_time_offset = 3600
action.escu.latest_time_offset = 86400
action.escu.providing_technologies = []
action.escu.data_models = []
action.escu.eli5 = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address
action.escu.how_to_implement = none
action.escu.known_false_positives = None at this time
disabled = true
schedule_window = auto
is_visible = false
search = `aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip
[ESCU - Get All AWS Activity From City - Response Task]
action.escu = 0
action.escu.enabled = 1
@@ -2768,27 +2768,6 @@ schedule_window = auto
is_visible = false
search = `cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName
[ESCU - Investigate AWS User Activities by user field - Response Task]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = investigative
action.escu.full_search_name = ESCU - Investigate AWS User Activities by user field - Response Task
description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
action.escu.creation_date = 2018-03-12
action.escu.modification_date = 2018-03-12
action.escu.analytic_story = ["AWS User Monitoring", "Suspicious Cloud Authentication Activities"]
action.escu.earliest_time_offset = 3600
action.escu.latest_time_offset = 86400
action.escu.providing_technologies = []
action.escu.data_models = []
action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
action.escu.how_to_implement = none
action.escu.known_false_positives = None at this time
disabled = true
schedule_window = auto
is_visible = false
search = `cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType
[ESCU - Investigate AWS activities via region name - Response Task]
action.escu = 0
action.escu.enabled = 1
@@ -2810,6 +2789,27 @@ schedule_window = auto
is_visible = false
search = `cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region
[ESCU - Investigate AWS User Activities by user field - Response Task]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = investigative
action.escu.full_search_name = ESCU - Investigate AWS User Activities by user field - Response Task
description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
action.escu.creation_date = 2018-03-12
action.escu.modification_date = 2018-03-12
action.escu.analytic_story = ["AWS User Monitoring", "Suspicious Cloud Authentication Activities"]
action.escu.earliest_time_offset = 3600
action.escu.latest_time_offset = 86400
action.escu.providing_technologies = []
action.escu.data_models = []
action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
action.escu.how_to_implement = none
action.escu.known_false_positives = None at this time
disabled = true
schedule_window = auto
is_visible = false
search = `cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType
### END ESCU RESPONSE TASKS ###
dist/saaws/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-10-28T22:30:45 UTC
# On Date: 2021-11-01T18:33:43 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml
Vendored
+91
View File
@@ -0,0 +1,91 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token
attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 759a653f-cb92-40f9-94c9-ec4e47b0f709
known_false_positives: None identified.
name: Applying Stolen Credentials via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
- https://adsecurity.org/?p=1275
risk_message: Mimikatz malware is violating authentication processes by injecting
golden or silver Kerberos tickets or passing stolen authentication tokens. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line,
/(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log
impact: 90
kill_chain_phases:
- Actions on Objectives
message: Mimikatz malware is violating authentication processes by injecting golden
or silver Kerberos tickets or passing stolen authentication tokens. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1055
- T1068
- T1078
- T1098
- T1134
- T1543
- T1547
- T1548
- T1554
- T1556
- T1558
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 90
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml
Vendored
+95
View File
@@ -0,0 +1,95 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
description: Stolen credentials are applied by methods such as user impersonation,
credential injection, spoofing of authentication processes or getting hold of critical
accounts. This detection indicates such activities carried out by PowerSploit exploit
kit APIs.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 270b482d-2af2-448f-9923-9cf005f61be4
known_false_positives: None identified.
name: Applying Stolen Credentials via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is violating authentication by injecting stolen
credentials, manipulating authentication tokens or impersonating system or user
accounts. Operation is performed at the device $dest_device_id$, by the account
$dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true
OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line,
/(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
impact: 90
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is violating authentication by injecting stolen credentials,
manipulating authentication tokens or impersonating system or user accounts. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1055
- T1068
- T1078
- T1098
- T1134
- T1543
- T1547
- T1548
- T1554
- T1555
- T1558
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 90
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml
Vendored
+80
View File
@@ -0,0 +1,80 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
description: This detection identifies use of DSInternals modules that verify password
strength, i.e., identify week accounts that would be easily compromised.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f
known_false_positives: None identified.
name: Assessment of Credential Strength via DSInternals modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/MichaelGrafnetter/DSInternals
risk_message: DSInternals tool kit is assessing password strength at the device $dest_device_id$.
Account attempting this operation is $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Test-PasswordQuality/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 85
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
- Stage:Credential Access
impact: 30
kill_chain_phases:
- Actions on Objectives
message: DSInternals tool kit is assessing password strength at the device $dest_device_id$.
Account attempting this operation is $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1078
- T1098
- T1087
- T1201
- T1552
- T1555
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 25
risk_severity: medium
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/attempt_to_delete_services.yml
Vendored
+61
View File
@@ -0,0 +1,61 @@
author: Teoderick Contreras, splunk
datamodel:
- Endpoint
date: '2021-06-18'
description: This analytic identifies suspicious series of attempt to kill multiple
services on a system using either `net.exe` or `sc.exe`. This technique is use by
adversaries to terminate security services or other related services to continue
there objective and evade detections.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
id: a0c8c292-d01a-11eb-aa18-acde48001122
known_false_positives: unknown
name: Attempt To delete Services
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
tags:
analytic_story:
- XMRig
- Ransomware
cis20:
- CIS 8
- CIS 13
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1489
nist:
- PR.DS
- PR.IP
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_severity: high
security_domain: endpoint
type: TTP
version: 2
dist/ssa/detections/attempt_to_disable_services.yml
Vendored
+63
View File
@@ -0,0 +1,63 @@
author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-18'
description: This analytic will identify suspicious series of command-line to disable
several services. This technique is seen where the adversary attempts to disable
security app services or other malware services to complete the objective on the
compromised system.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
id: afb31de4-d023-11eb-98d5-acde48001122
known_false_positives: unknown
name: Attempt To Disable Services
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
"_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%")
AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
tags:
analytic_story:
- XMRig
- Ransomware
cis20:
- CIS 9
- CIS 8
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1489
nist:
- PR.DS
- PR.IP
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_severity: medium
security_domain: endpoint
type: TTP
version: 2
dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
Vendored
+80
View File
@@ -0,0 +1,80 @@
author: Jose Hernandez, Splunk
datamodel: []
date: 2020-6-04
description: Monitor for execution of reg.exe with parameters specifying an export
of keys that contain hashed credentials that attackers may try to crack offline.
how_to_implement: You must be ingesting windows endpoint data that tracks process
activity, including parent-child relationships from your endpoints.
id: 14038953-e5f2-4daf-acff-5452062baf03
known_false_positives: None identified.
name: Attempted Credential Dump From Registry via Reg exe
product:
- Splunk Behavioral Analytics
references:
- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
risk_message: Malicious actor is dumping stored credentials from the registry sections
SAM, Security, or System. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
"process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe"
OR process_name="reg.exe" | where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true
AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line,
/(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line,
/(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time
= timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
| into write_ssa_detected_events(); '
tags:
analytic_story:
- Credential Dumping
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Malicious actor is dumping stored credentials from the registry sections
SAM, Security, or System. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1003
nist:
- DE.CM
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- _time
- dest_device_id
- dest_user_id
- process
risk_score: 63
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
Vendored
+89
View File
@@ -0,0 +1,89 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-18'
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. FGdump is
a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
Windows. Cachedump is a publicly-available tool that extracts cached password hashes
from a system's registry.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 312582f2-5e91-42c1-a275-cd67f31373c8
known_false_positives: None identified.
name: Credential Extraction indicative of FGDump and CacheDump with s option
product:
- Splunk Behavioral Analytics
references: []
risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND process_name != null AND parent_process_name != null
AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name,
/(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true
AND match_regex(cmd_line, /(?i)\-s/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Unusual Processes
- Credential Dumping
asset_type: Windows
cis20:
- CIS 16
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Malicious actor is accessing stored credentials via FGDump or CacheDump
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
mitre_attack_id:
- T1003
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- process_name
- parent_process_name
- _time
- process_path
- dest_user_id
- process
risk_score: 70
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
Vendored
+86
View File
@@ -0,0 +1,86 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-18'
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. FGdump is
a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
Windows. Cachedump is a publicly-available tool that extracts cached password hashes
from a system's registry.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38
known_false_positives: None identified.
name: Credential Extraction indicative of FGDump and CacheDump with v option
product:
- Splunk Behavioral Analytics
references: []
risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name,
/(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true
AND match_regex(cmd_line, /(?i)\-v/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Unusual Processes
- Credential Dumping
asset_type: Windows
cis20:
- CIS 16
confidence: 90
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Malicious actor is accessing stored credentials via FGDump or CacheDump
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
mitre_attack_id:
- T1003
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- process_name
- _time
- process_path
- dest_user_id
- process
risk_score: 63
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml
Vendored
+80
View File
@@ -0,0 +1,80 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-18'
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. LaZagne is
a tool that extracts various kinds of credentials from a local computer, including
account passwords, domain passwords, browser passwords, etc.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 341975fa-4ad0-4f01-9acc-df4f69742db7
known_false_positives: None identified.
name: Credential Extraction indicative of Lazagne command line options
product:
- Splunk Behavioral Analytics
references: []
risk_message: Lazagne malware is extracting/decoding encoded credentials. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line,
/(?i)all\s+\-oA\s+\-output/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
asset_type: Windows
cis20:
- CIS 16
confidence: 90
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Lazagne malware is extracting/decoding encoded credentials. Operation is
performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
mitre_attack_id:
- T1003
- T1555
nist:
- PR.IP
- PR.AC
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 63
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
Vendored
+92
View File
@@ -0,0 +1,92 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-21'
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. DSInternals
is a collection of PowerShell modules commonly employed in exploits.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2
known_false_positives: None identified.
name: Credential Extraction indicative of use of DSInternals credential conversion
modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/MichaelGrafnetter/DSInternals
risk_message: DSInternals tool kit is converting stolen credential material to a form
applicable to authentications. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true
OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line,
/(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true
OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line,
/(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true
OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line,
/(?i)ConvertTo-UnicodePassword/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
- Malicious PowerShell
asset_type: Windows
cis20:
- CIS 16
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: DSInternals tool kit is converting stolen credential material to a form
applicable to authentications. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1003
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- process_name
- parent_process_name
- _time
- process_path
- dest_user_id
- process
risk_score: 70
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml
Vendored
+95
View File
@@ -0,0 +1,95 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-21'
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. DSInternals
is a collection of PowerShell modules commonly employed in exploits.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d
known_false_positives: None identified.
name: Credential Extraction indicative of use of DSInternals modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/MichaelGrafnetter/DSInternals
risk_message: DSInternals tool kit is accessing sensitive credential material such
as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true
OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,
/(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true
OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,
/(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true
OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true
OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true
OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line,
/(?i)Get-SamPasswordPolicy/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
- Malicious PowerShell
asset_type: Windows
cis20:
- CIS 16
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: DSInternals tool kit is accessing sensitive credential material such as
KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
mitre_attack_id:
- T1003
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- process_name
- parent_process_name
- _time
- process_path
- dest_user_id
- process
risk_score: 70
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml
Vendored
+85
View File
@@ -0,0 +1,85 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-21'
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. Mimikatz
is a collection of tools and modules commonly employed in Windows exploits.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 966b635f-98e8-4aa4-9b49-47ed2cedcc85
known_false_positives: None identified.
name: Credential Extraction indicative of use of Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk_message: Mimikatz malware is extracting/decoding encoded credentials from stores
such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true
OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true
OR match_regex(cmd_line, /(?i)lsadump::sam/)=true OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true
OR match_regex(cmd_line, /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true
OR match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
- Unusual Processes
asset_type: Windows
cis20:
- CIS 16
confidence: 95
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Mimikatz malware is extracting/decoding encoded credentials from stores
such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1003
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 66
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml
Vendored
+86
View File
@@ -0,0 +1,86 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-21'
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. PowerSploit
is a collection of Microsoft PowerShell modules commonly employed in exploits.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 5f1186a4-e681-446e-851c-dc9574ad28eb
known_false_positives: None identified.
name: Credential Extraction indicative of use of PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is extracting encoded credentials or spoofing automated
logings. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true
OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true
OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line,
/(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true
OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line,
/(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
- Malicious PowerShell
asset_type: Windows
cis20:
- CIS 16
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is extracting encoded credentials or spoofing automated
logings. Operation is performed at the device $dest_device_id$, by the account
$dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1003
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 70
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
Vendored
+90
View File
@@ -0,0 +1,90 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-18'
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. Native Microsoft
debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential
material directly from memory and process dumps.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: c20bb8ec-e1b0-4640-b0ef-3a4c54f8c112
known_false_positives: Although unlikely, using debuggers this way may be indicative
of developers analyzing crash dumps of their code. Note, even for developers this
is an unusual way of working on code - debuggers are mostly used to step through
code, not analyze its crash dumps.
name: Credential Extraction native Microsoft debuggers peek into the kernel
product:
- Splunk Behavioral Analytics
references:
- https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29
risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
native debugging tools. Operation is performed at the device $dest_device_id$, by
the account $dest_user_id$ via command $cmd_line$
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line != null AND parent_process_name != null AND process_name
!= null AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name,
/(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true
AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\-ForceV1/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
- Unusual Processes
asset_type: Windows
cis20:
- CIS 16
confidence: 90
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
native debugging tools. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1003
nist:
- PR.IP
- PR.AC
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- parent_process_name
- _time
- dest_device_id
- dest_user_id
- process
risk_score: 63
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
Vendored
+86
View File
@@ -0,0 +1,86 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-18'
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. Native Microsoft
debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential
material directly from memory and process dumps.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: adc51a77-90c9-4358-b43c-f10dd1a27d05
known_false_positives: Although unlikely, using debuggers this way may be indicative
of developers analyzing crash dumps of their code. Note, even for developers this
is an unusual way of working on code - debuggers are mostly used to step through
code, not analyze its crash dumps.
name: Credential Extraction native Microsoft debuggers via z command line option
product:
- Splunk Behavioral Analytics
references: []
risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
native debugging tools. Operation is performed at the device $dest_device_id$, by
the account $dest_user_id$ via command $cmd_line$
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line != null AND process_name != null AND ( match_regex(process_name,
/^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line,
/(?i)\-z\s+/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
- Unusual Processes
asset_type: Windows
cis20:
- CIS 16
confidence: 90
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
native debugging tools. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1003
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- _time
- dest_device_id
- dest_user_id
- process
risk_score: 63
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
Vendored
+81
View File
@@ -0,0 +1,81 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-18'
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. PowerSploit
and DSInternals are common exploit APIs offering PowerShell modules for various
exploits of Windows and Active Directory environments.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: e4f126b5-e6bc-4a5c-b1a8-d07bc6c4a49f
known_false_positives: None identified.
name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and
DSInternals
product:
- Splunk Behavioral Analytics
references: []
risk_message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount
module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line,
/(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\|]+/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
- Malicious PowerShell
asset_type: Windows
cis20:
- CIS 16
confidence: 90
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount
module. Operation is performed at the device $dest_device_id$, by the account
$dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1003
nist:
- PR.IP
- PR.AC
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 63
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/delete_a_net_user.yml
Vendored
+64
View File
@@ -0,0 +1,64 @@
author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-21'
description: This analytic will detect a suspicious net.exe/net1.exe command-line
to delete a user on a system. This technique may be use by an administrator for
legitimate purposes, however this behavior has been used in the wild to impair some
user or deleting adversaries tracks created during its lateral movement additional
systems. During triage, review parallel processes for additional behavior. Identify
any other user accounts created before or after.
how_to_implement: o successfully implement this search, you need to be ingesting logs
with the process name, parent process, and command-line executions from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
Tune and filter known instances where renamed net.exe may be used.
id: 8776d79c-d26e-11eb-9a56-acde48001122
known_false_positives: System administrators or scripts may delete user accounts via
this technique. Filter as needed.
name: Delete A Net User
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
tags:
analytic_story:
- XMRig
- Ransomware
cis20:
- CIS 4
- CIS 16
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1489
nist:
- PR.AC
- PR.IP
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_severity: high
security_domain: endpoint
type: Anomaly
version: 2
dist/ssa/detections/deny_permission_using_cacls_utility.yml
Vendored
+80
View File
@@ -0,0 +1,80 @@
author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-14'
description: This analytic identifies a potential adversary that changes the security
permission of a specific file or directory. This technique is commonly seen in APT
tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection
and prevent access to their component files.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
id: b76eae28-cd25-11eb-9c92-acde48001122
known_false_positives: network administrator may use this windows utility but this
is not a common practice.
name: Deny Permission using Cacls Utility
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to deny
a permission of a file or directory in host $dest_device_id$
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
tags:
analytic_story:
- XMRig
cis20:
- CIS 14
- CIS 16
confidence: 70
context:
- source:endpoint
- stage: Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
impact: 50
kill_chain_phases:
- Exploitation
message: A cacls process $process_name$ with commandline $cmd_line$ try to deny
a permission of a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
nist:
- PR.AC
- PR.IP
observable:
- name: dest_device_id
role:
- Victim
type: Hostname
- name: dest_user_id
role:
- Victim
type: user
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_score: 35
risk_severity: medium
security_domain: endpoint
type: TTP
version: 2
dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml
Vendored
+79
View File
@@ -0,0 +1,79 @@
author: Jose Hernandez, Splunk
datamodel: []
date: '2020-09-15'
description: This search detects the memory of lsass.exe being dumped for offline
credential theft attack.
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including Windows command line logging. You can see how we test this with [Event
Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml).
id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
known_false_positives: None identified.
name: Detect Dump LSASS Memory using comsvcs
product:
- Splunk Behavioral Analytics
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
risk_message: Malicious actor is dumping encoded credentials via Microsoft's native
comsvc DLL. Operation is performed at the device $dest_device_id$, by the account
$dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
"_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
"string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
/(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
"process_name", process_name, "process", process]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
asset_type: Endpoint
cis20:
- CIS 8
- CIS 16
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc
DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
mitre_attack_id:
- T1003.003
- T1003
nist:
- DE.CM
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- _tenant
- _time
- dest_device_id
- process
risk_score: 70
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/detect_kerberoasting.yml
Vendored
+82
View File
@@ -0,0 +1,82 @@
author: Xiao Lin, Splunk
datamodel: []
date: '2020-10-21'
description: This search detects a potential kerberoasting attack via service principal
name requests
how_to_implement: The test data is converted from Windows Security Event logs generated
from Attach Range simulation and used in SPL search and extended to SPL2
id: dabdd6d7-3e10-42be-8711-4e124f7a3850
known_false_positives: Older systems that support kerberos RC4 by default NetApp may
generate false positives
name: Detect Kerberoasting
product:
- Splunk Behavioral Analytics
references:
- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss
risk_message: Kerberoasting malware is potentially applying stolen credentials. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"),
EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
"ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
"service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769"
AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event
input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
| eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id,
"EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions,
"TicketEncryptionType", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null))| select start_time, end_time, entities, body | into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
cis20:
- CIS 8
- CIS 16
confidence: 20
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Kerberoasting malware is potentially applying stolen credentials. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1558.003
- T1558
nist:
- DE.CM
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- service_name
- _time
- event_code
- ticket_encryption_type
- service_id
- ticket_options
risk_score: 14
risk_severity: medium
security_domain: endpoint
type: TTP
version: 2
dist/ssa/detections/detect_pass_the_hash.yml
Vendored
+87
View File
@@ -0,0 +1,87 @@
author: Xiao Lin, Splunk
datamodel: []
date: '2020-10-21'
description: This search looks for specific authentication events from the Windows
Security Event logs to detect potential attempts using Pass-the-Hash technique.
how_to_implement: The test data is converted from Windows Security Event logs generated
from Attach Range simulation and used in SPL search and extended to SPL2
id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f
known_false_positives: Legitimate logon activity by authorized NTLM systems may be
detected by this search. Please investigate as appropriate.
name: Detect Pass the Hash
product:
- Splunk Behavioral Analytics
references:
- Initial ESCU implementation by Bhavin Patel and Patrick Bareiss
risk_message: Potential use of the pass the hash/token attacks that spoof authentication.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
| eval signature_id=map_get(input_event, "signature_id"), authentication_type=map_get(input_event,
"authentication_type"), authentication_method=map_get(input_event, "authentication_method"),
origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event,
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9"
AND authentication_method="seclogo")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type,
"authentication_method", authentication_method]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Lateral Movement
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 20
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
impact: 80
kill_chain_phases:
- Actions on Objectives
message: Potential use of the pass the hash/token attacks that spoof authentication.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
mitre_attack_id:
- T1550
- T1550.002
nist:
- PR.PT
- PR.AT
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- signature_id
- authentication_type
- _time
- authentication_method
- origin_device_domain
- dest_user_id
- dest_device_id
risk_score: 16
risk_severity: medium
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml
Vendored
+89
View File
@@ -0,0 +1,89 @@
author: Ignacio Bermudez Corrales, Splunk
datamodel: []
date: 2020-7-13
description: This search looks for executions of cmd.exe spawned by a process that
is often abused by attackers and that does not typically launch cmd.exe. This is
a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe`
by @bpatel.
how_to_implement: You must be ingesting sysmon logs. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
known_false_positives: There are circumstances where an application may legitimately
execute and interact with the Windows command-line interface. Investigate and modify
the lookup file, as appropriate.
name: Detect Prohibited Applications Spawning cmd exe
product:
- Splunk Behavioral Analytics
references: []
risk_message: Potential malicious landing to the console via unexpected programs that
called cmd.exe. Operation is performed at the device $dest_device_id$, by the account
$dest_user_id$ where parent process $parent_process$ spwaned $process_name$.
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
| eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null)
| where process_name="cmd.exe" | rex field=parent_process "(?<field0>[^\\\\]+)$"
| where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe"
OR field0="visio.exe" OR field0="mspub.exe" OR field0="acrobat.exe" OR field0="acrord32.exe"
OR field0="chrome.exe" OR field0="iexplore.exe" OR field0="opera.exe" OR field0="firefox.exe"
OR field0="java.exe" OR field0="powershell.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name,
"parent_process_name", parent_process]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Suspicious Command-Line Executions
- Suspicious MSHTA Activity
- Suspicious Zoom Child Processes
- Sunburst Malware
cis20:
- CIS 8
confidence: 80
context:
- Source:AD
- Source:Endpoint
- Stage:Command And Control
- Consequence:Loss Of Control
impact: 70
kill_chain_phases:
- Exploitation
message: Potential malicious landing to the console via unexpected programs that
called cmd.exe. Operation is performed at the device $dest_device_id$, by the
account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$.
mitre_attack_id:
- T1059
nist:
- PR.PT
- DE.CM
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- parent_process_name
- _time
- dest_device_id
- dest_user_id
risk_score: 56
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/disable_net_user_account.yml
Vendored
+63
View File
@@ -0,0 +1,63 @@
author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-21'
description: This analytic will identify a suspicious command-line that disables a
user account using the `net.exe` utility native to Windows. This technique may used
by the adversaries to interrupt availability of such users to do their malicious
act.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
used.
id: ba858b08-d26c-11eb-af9b-acde48001122
known_false_positives: network operator may use this approach to quickly disable an
account but not a common practice.
name: Disable Net User Account
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
tags:
analytic_story:
- XMRig
- Ransomware
cis20:
- CIS 4
- CIS 16
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1489
nist:
- PR.AC
- PR.IP
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_severity: medium
security_domain: endpoint
type: TTP
version: 2
dist/ssa/detections/first_time_seen_command_line_argument.yml
Vendored
+82
View File
@@ -0,0 +1,82 @@
author: Ignacio Bermudez Corrales, Splunk
datamodel: []
date: 2021-2-1
description: This search looks for command-line arguments that use a `/c` parameter
to execute a command that has not previously been seen. This is an implementation
on SPL2 of the rule `First time seen command line argument` by @bpatel.
how_to_implement: You must be populating the endpoint data model for SSA and specifically
the process_name and the process fields
id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
known_false_positives: Legitimate programs can also use command-line arguments to
execute. Please verify the command-line arguments to check what command/program
is being executed. We recommend customizing the `first_time_seen_cmd_line_filter`
macro to exclude legitimate parent_process_name
name: First time seen command line argument
product:
- Splunk Behavioral Analytics
references: []
risk_message: A cmd process $process_name$ with commandline $cmd_line$ try to execute
command has not previously seen in host $dest_device_id$
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
"string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line),
cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/,
"GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/,
"\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext"
*/ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
/* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm,
/\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) |
where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.*
\/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id,
dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Unusual Processes
cis20:
- CIS 3
- CIS 8
confidence: 60
context:
- source:endpoint
- stage: Defense Evasion
impact: 50
kill_chain_phases:
- Command and Control
- Actions on Objectives
message: A cmd process $process_name$ with commandline $cmd_line$ try to execute
command has not previously seen in host $dest_device_id$
mitre_attack_id:
- T1059
- T1117
- T1202
nist:
- PR.PT
- DE.CM
- PR.IP
observable:
- name: dest_device_id
role:
- Victim
type: Hostname
- name: dest_user_id
role:
- Victim
type: user
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- _time
- dest_device_id
- dest_user_id
- process
risk_score: 30
risk_severity: medium
security_domain: endpoint
type: Anomaly
version: 3
dist/ssa/detections/grant_permission_using_cacls_utility.yml
Vendored
+80
View File
@@ -0,0 +1,80 @@
author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-14'
description: This analytic identifies potential adversaries that modify the security
permission of a specific file or directory. This technique is commonly seen in APT
tradecraft, ransomware and coinminer scripts to evade detections and restrict access
to their component files.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
id: c6da561a-cd29-11eb-ae65-acde48001122
known_false_positives: network administrator may use this windows utility but this
is not a common practice.
name: Grant Permission Using Cacls Utility
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to grant
user a permission to a file or directory in host $dest_device_id$
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
tags:
analytic_story:
- XMRig
cis20:
- CIS 14
- CIS 16
confidence: 70
context:
- source:endpoint
- stage: Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
impact: 50
kill_chain_phases:
- Exploitation
message: A cacls process $process_name$ with commandline $cmd_line$ try to grant
user a permission to a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
nist:
- PR.AC
- PR.IP
observable:
- name: dest_device_id
role:
- Victim
type: Hostname
- name: dest_user_id
role:
- Victim
type: user
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_score: 35
risk_severity: medium
security_domain: endpoint
type: TTP
version: 2
dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml
Vendored
+87
View File
@@ -0,0 +1,87 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
description: This detection identifies access to PowerSploit modules that enable illegaly
access user content, such as key logging, audio recording, screenshots, tapping
into http and RDP sessions, etc.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 01fc7d91-eb0c-478e-8633-e4fa4904463a
known_false_positives: None identified.
name: Illegal Access To User Content via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is tapping into user content - microphone, camera,
ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR
match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true
OR match_regex(cmd_line, /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line,
/(?i)Get-WebConfig/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Malicious PowerShell
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Exfiltration
- Stage:Command And Control
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
impact: 85
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is tapping into user content - microphone, camera,
ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1021
- T1113
- T1123
- T1563
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 85
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml
Vendored
+78
View File
@@ -0,0 +1,78 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
description: This detection identifies access to PowerSploit modules that create accounts
illegaly.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 20fba62a-fa5b-46cc-b39f-473fa248fee2
known_false_positives: None identified.
name: Illegal Account Creation via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is creating illegal domain accounts. Operation is
performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)New-DomainUser/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Persistence Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Persistence
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log
impact: 80
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is creating illegal domain accounts. Operation is performed
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1585
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 80
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml
Vendored
+79
View File
@@ -0,0 +1,79 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
description: This detection identifies access to PowerSploit modules that delete event
logs.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 4ddb3b0d-f95f-4ae2-b4e8-663296453a7b
known_false_positives: None identified.
name: Illegal Deletion of Logs via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk_message: Mimikatz malware is deleting event logs to cover tracks of malicious
activity. Operation is performed at the device $dest_device_id$, by the account
$dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Log Manipulation
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Command And Control
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log
impact: 50
kill_chain_phases:
- Actions on Objectives
message: Mimikatz malware is deleting event logs to cover tracks of malicious activity.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
mitre_attack_id:
- T1070
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 50
risk_severity: medium
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
Vendored
+81
View File
@@ -0,0 +1,81 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
description: This detection identifies use of DSInternals modules that enable or disable
accounts illegaly.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 3e0f9962-9989-445f-878c-939443326b63
known_false_positives: None identified.
name: Illegal Enabling or Disabling of Accounts via DSInternals modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/MichaelGrafnetter/DSInternals
risk_message: DSInternals malware is illegally enabling or disabling accounts. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Persistence Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Command And Control
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
impact: 80
kill_chain_phases:
- Actions on Objectives
message: DSInternals malware is illegally enabling or disabling accounts. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1078
- T1098
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 80
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
Vendored
+84
View File
@@ -0,0 +1,84 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
description: This detection identifies use of DSInternals modules for illegal management
of Active Directoty elements and policies.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: a587ca9f-c138-47b4-ba51-699f319b8cc5
known_false_positives: None identified.
name: Illegal Management of Active Directory Elements and Policies via DSInternals
modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/MichaelGrafnetter/DSInternals
risk_message: DSInternals malware is controlling infrastructure by modifying Active
Directory elements, domain controllers, and policies. Operation is performed at
the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true
OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line,
/(?i)Set-LsaPolicyInformation/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Persistence Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Command And Control
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log
impact: 90
kill_chain_phases:
- Actions on Objectives
message: DSInternals malware is controlling infrastructure by modifying Active Directory
elements, domain controllers, and policies. Operation is performed at the device
$dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1098
- T1207
- T1484
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 90
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
Vendored
+85
View File
@@ -0,0 +1,85 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
description: This detection identifies access to PowerSploit modules that enable illegal
management of computers and Active Directory elements.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 75760c11-7d48-4968-b828-013b299e8f6d
known_false_positives: None identified.
name: Illegal Management of Computers and Active Directory Elements via PowerSploit
modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is controlling infrastructure by modifying Active
Directory elements or local Master Boot Records. Operation is performed at the device
$dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR
match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line,
/(?i)Set-MasterBootRecord/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Persistence Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Command And Control
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log
impact: 90
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is controlling infrastructure by modifying Active Directory
elements or local Master Boot Records. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1098
- T1207
- T1484
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 90
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
Vendored
+87
View File
@@ -0,0 +1,87 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
description: This detection identifies access to PowerSploit modules that illegaly
elevate general privileges or ensure persistence, e.g., enable manipulation of registry,
task scheduling, persistent WMI, access to OS objects under desired identities.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 88c10ee9-fe72-4bce-b343-5b129044b991
known_false_positives: None identified.
name: Illegal Privilege Elevation and Persistence via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is planting attack persistence elements, altering
privileges and access controls. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true
OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true
OR match_regex(cmd_line, /(?i)New-UserPersistenceOption/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Malicious PowerShell
- Windows Persistence Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Command And Control
- Stage:Persistence
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log
impact: 90
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is planting attack persistence elements, altering privileges
and access controls. Operation is performed at the device $dest_device_id$, by
the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1053
- T1134
- T1548
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 90
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml
Vendored
+82
View File
@@ -0,0 +1,82 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
description: This detection identifies use of Mimikatz modules for illegal privilege
elevation.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 2f873b1f-6352-4844-b7b9-b419f09a42c7
known_false_positives: None identified.
name: Illegal Privilege Elevation via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk_message: Mimikatz malware is setting highest privileges to malicious entities.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Privilege Escalation
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Command And Control
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log
impact: 90
kill_chain_phases:
- Actions on Objectives
message: Mimikatz malware is setting highest privileges to malicious entities. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1134
- T1548
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 90
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml
Vendored
+84
View File
@@ -0,0 +1,84 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
description: This detection identifies use of Mimikatz modules for illegal control
over services and processes, including the authentication service.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: aaf3adf1-73e1-4477-b4ee-3771898964f1
known_false_positives: None identified.
name: Illegal Service and Process Control via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk_message: Mimikatz malware is controlling computer's processess and services.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line,
/(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line,
/(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true
OR match_regex(cmd_line, /(?i)misc::memssp/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Service Abuse
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Command And Control
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
impact: 90
kill_chain_phases:
- Actions on Objectives
message: Mimikatz malware is controlling computer's processess and services. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1055
- T1106
- T1569
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 90
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml
Vendored
+94
View File
@@ -0,0 +1,94 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
description: This detection identifies access to PowerSploit modules that enable illegal
control of services and processes, such as installing or spoofing of malicious services,
injecting malicious code in DLLs and EXEs, invoking shell code and WMI commands,
modifying access to service objects, etc.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 0e910e5b-309d-4bc3-8af2-0030c02aa353
known_false_positives: None identified.
name: Illegal Service and Process Control via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is controlling computer's processess and services.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true
OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line,
/(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true
OR match_regex(cmd_line, /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line,
/(?i)Invoke-ReflectivePEInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true
OR match_regex(cmd_line, /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line,
/(?i)Invoke-Shellcode/)=true OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true
OR match_regex(cmd_line, /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line,
/(?i)Write-HijackDll/)=true OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Service Abuse
- Malicious PowerShell
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
impact: 90
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is controlling computer's processess and services.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
mitre_attack_id:
- T1055
- T1106
- T1569
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 90
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml
Vendored
+77
View File
@@ -0,0 +1,77 @@
author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-15'
description: This analytic identifies suspicious modification of ACL permission to
a files or folder to make it available to everyone or to a specific user. This technique
may be used by the adversary to evade ACLs or protected files access. This changes
is commonly configured by the file or directory owner with appropriate permission.
This behavior is a good indicator if this command seen on a machine utilized by
an account with no permission to do so.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
id: 9ae9a48a-cdbe-11eb-875a-acde48001122
known_false_positives: network administrator may use this windows utility. filter
is needed.
name: Modify ACLs Permission Of Files Or Folders
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to modify
a permission of a file or directory in host $dest_device_id$
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line,
/(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe"
OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
tags:
analytic_story:
- XMRig
confidence: 70
context:
- source:endpoint
- stage: Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
impact: 50
kill_chain_phases:
- Exploitation
message: A cacls process $process_name$ with commandline $cmd_line$ try to modify
a permission of a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
observable:
- name: dest_device_id
role:
- Victim
type: Hostname
- name: dest_user_id
role:
- Victim
type: user
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_score: 35
risk_severity: medium
security_domain: endpoint
type: Anomaly
version: 1
dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
Vendored
+94
View File
@@ -0,0 +1,94 @@
author: Ignacio Bermudez Corrales, Splunk
datamodel: []
date: '2020-08-25'
description: Attacker activity may compromise executing several LOLBAS applications
in conjunction to accomplish their objectives. We are looking for more than usual
LOLBAS applications over a window of time, by building profiles per machine.
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
id: 59c0dd70-169c-4900-9a1f-bfcf13302f93
known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS
applications in a short period of time. This might trigger false positives at the
beginning when it hasn''t collected yet enough data to construct the baseline.
'
name: More than usual number of LOLBAS applications in short time period
product:
- Splunk Behavioral Analytics
references:
- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
risk_message: A system process $process_name$ with commandline $cmd_line$ spawn iin
short period of time in host $dest_device_id$
search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event,
"process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe"
OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe"
OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe"
OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe"
OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe"
OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe"
OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe"
OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe"
OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe"
OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe"
OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe"
OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe"
OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe"
OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe"
OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe"
OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe"
OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe"
OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe"
OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe"
OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe"
OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR
process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe"
OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe"
OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe"
OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe"
OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by
device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end
as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device"
window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start,
end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter",
lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Unusual Processes
cis20:
- CIS 8
confidence: 50
context:
- source:endpoint
- stage: Defense Evasion
impact: 50
kill_chain_phases:
- Exploitation
message: A system process $process_name$ with commandline $cmd_line$ spawn iin short
period of time in host $dest_device_id$
mitre_attack_id:
- T1059
- T1053
nist:
- PR.PT
- DE.CM
observable:
- name: dest_device_id
role:
- Victim
type: Hostname
- name: process_name
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- _time
- process_name
risk_score: 25
risk_severity: medium
security_domain: endpoint
type: Anomaly
version: 2
dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml
Vendored
+62
View File
@@ -0,0 +1,62 @@
author: Xiao Lin, Splunk
datamodel: []
date: '2020-08-25'
description: Malicious mails can conduct phishing that induces readers to open attachment,
click links or trigger third party service. This detect uses Natural Language Processing
(NLP) approach to analyze an email message's content (Sender, Subject and Body)
and judge whether it is a phishing email. The detection adopts a deep learning (neural
network) model that employs character level embeddings plus LSTM layers to perform
classification. The model is pre-trained and then published as ONNX format. Current
sample model is trained using the dataset published at https://github.com/splunk/attack_data/tree/master/datasets/T1566_Phishing_Email/splunk_train.json
User are expected to re-train the model by combining with their own training data
for better accuracy using the provided model file (SMLE notebook). DSP pipeline
then processes the email message and passes it as an event to Apply ML Models function,
which returns the probability of a phishing email. Current implementation assumes
the email is fed to DSP in JSON format contains at least email's sender, subject
and its message body, including reply content, if any.
how_to_implement: Events are fed to DSP contains at least email's sender, subject
and its message body.
id: 4b237388-dfa1-41a6-91d4-4de2d598376f
known_false_positives: Because of imbalance of anomaly data in training, the model
will less likely report false positive. Instead, the model is more prone to false
negative. Current best recall score is ~85%
name: Phishing Email Detection by Machine Learning Method - SSA
product:
- Splunk Behavioral Analytics
references: []
search: '| from read_ssa_enriched_events() | eval eventLine=concat(ucast(map_get(input_event,
"From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", "
"), " ", ucast(map_get(input_event, "Content"), "string", " "), " "),
_time=map_get(input_event, "_time") | where eventLine IS NOT NULL | eval mapC={"
": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40,
")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49,
"2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58,
";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67,
"D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76,
"M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85,
"V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94,
"_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g":
103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o":
111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w":
119, "x": 120, "y": 121, "z": 122, "{": 123, "|": 124, "}": 125, "~": 126}, ml_in
= for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i,
1)), "float") ) | apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v8"
path="s3://smle-experiments/models/phishing_email" | eval probability = mvindex(ml_out,
0) | where probability > 0.5 | eval start_time=_time, end_time=_time, entities="TBD",
body="TBD" | select probability, body, entities, start_time, end_time | into write_ssa_detected_events();'
tags:
cis20:
- CIS 8
kill_chain_phases:
- Actions on Objectives
mitre_attack_id:
- T1566
nist:
- PR.PT
- DE.CM
product:
- Splunk Behavioral Analytics
risk_severity: low
security_domain: mail server
type: Anomaly
version: 1
dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
Vendored
+98
View File
@@ -0,0 +1,98 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2021-09-01'
description: This detection identifies potential Pass the Token or Pass the Hash credential
exploits. We detect the main side effect of these attacks, which is a transition
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
by a detination device.
how_to_implement: You must be ingesting Windows Security logs from endpoint devices,
i.e., destinations of interest. Please make sure that event ID 4624 is being logged.
id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
known_false_positives: Environments in which NTLM is used extremely rarely and for
benign purposes (such as a rare use of SMB shares).
name: Potential Pass the Token or Hash Observed at the Destination Device
product:
- Splunk Behavioral Analytics
references:
- https://attack.mitre.org/techniques/T1550/002/
risk_message: Potential lateral movement and credential stealing via Pass the Token
or Pass the Hash techniques. Operation is performed via credentials of the account
$dest_user_id$ and observed by the destination device $dest_device_id$
search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event,
"_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
"string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"),
"string", null)), dest_device_id= lower(ucast(map_get(input_event, "dest_device_id"),
"string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"),
"string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
"string", null))
| where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
AND dest_user_id != null AND dest_device_id != null
| eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
== "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
| stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as
startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as
endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s)
| where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
| eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime,
"long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["total_kerberos",
totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Lateral Movement
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 90
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
- Stage:Lateral Movement
impact: 80
kill_chain_phases:
- Lateral Movement
message: Potential lateral movement and credential stealing via Pass the Token or
Pass the Hash techniques. Operation is performed via credentials of the account
$dest_user_id$ and observed by the destination device $dest_device_id$
mitre_attack_id:
- T1550
- T1550.002
nist:
- PR.PT
- PR.AT
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Other
type: Hostname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- signature_id
- dest_user
- dest_user_id
- dest_device_id
- authentication_method
risk_score: 72
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
Vendored
+100
View File
@@ -0,0 +1,100 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2021-09-01'
description: This detection identifies potential Pass the Token or Pass the Hash credential
exploits. We detect the main side effect of these attacks, which is a transition
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
by an event-collecting device (i.e., a specific domain controller or an endpoint
destination).
how_to_implement: You must be ingesting Windows Security logs from devices of interest
- at least from domain controllers. Please make sure that event ID 4624 is being
logged.
id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87
known_false_positives: Environments in which NTLM is used extremely rarely and for
benign purposes (such as a rare use of SMB shares).
name: Potential Pass the Token or Hash Observed by an Event Collecting Device
product:
- Splunk Behavioral Analytics
references:
- https://attack.mitre.org/techniques/T1550/002/
risk_message: Potential lateral movement and credential stealing via Pass the Token
or Pass the Hash techniques. Operation is performed via credentials of the account
$dest_user_id$ and observed by the logging device $origin_device_id$
search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event,
"_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
"string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"),
"string", null)), origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"),
"string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"),
"string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
"string", null))
| where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
AND dest_user_id != null AND origin_device_id != null
| eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
== "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
| stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as
startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as
endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s)
| where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
| eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id,
origin_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm",
totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time",
startNTLMTime, "detection_end_time", endNTLMTime])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Lateral Movement
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 80
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
- Stage:Lateral Movement
impact: 80
kill_chain_phases:
- Lateral Movement
message: Potential lateral movement and credential stealing via Pass the Token or
Pass the Hash techniques. Operation is performed via credentials of the account
$dest_user_id$ and observed by the logging device $origin_device_id$
mitre_attack_id:
- T1550
- T1550.002
nist:
- PR.PT
- PR.AT
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: origin_device_id
role:
- Other
type: Hostname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- signature_id
- dest_user
- dest_user_id
- origin_device_id
- authentication_method
risk_score: 64
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml
Vendored
+79
View File
@@ -0,0 +1,79 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-04'
description: This detection identifies use of PowerSploit modules that facilitate
access probing with admin credentials as well as probing access to system services.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: d405af5d-99f1-45af-8dfb-b8f98b764247
known_false_positives: None identified.
name: Probing Access with Stolen Credentials via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is probing access with stolen credentials. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true
OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Privilege Escalation
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
- Stage:Credential Access
impact: 60
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is probing access with stolen credentials. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1078
- T1098
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_user_id
- dest_device_id
risk_score: 60
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/rare_parent-child_process_relationship.yml
Vendored
+87
View File
@@ -0,0 +1,87 @@
author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
datamodel: []
date: '2021-05-20'
description: An attacker may use LOLBAS tools spawned from vulnerable applications
not typically used by system administrators. This search leverages the Splunk Streaming
ML DSP plugin to find rare parent/child relationships. The list of application has
been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
id: cf090c78-bcc6-11eb-8529-0242ac130003
known_false_positives: 'Some custom tools used by admins could be used rarely to launch
remotely applications. This might trigger false positives at the beginning when
it hasn''t collected yet enough data to construct the baseline.
'
name: Rare Parent-Child Process Relationship
product:
- Splunk Behavioral Analytics
references: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event,
"parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process,
"\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event,
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where parent_process_name!=null | select parent_process_name, process_name, cmd_line,
timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name"
target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe"
OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe"
OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe"
OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe"
OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe"
OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe"
OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe"
OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe"
OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe"
OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe"
OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe"
OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe"
OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe"
OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe"
OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe"
OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe"
OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe"
OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe"
OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe"
OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe"
OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR
process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe"
OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe"
OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe"
OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")
| eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001
window=604800000L | where label AND input > mean | eval start_time = timestamp,
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body =
create_map(["process_name", process_name, "parent_process_name", parent_process_name,
"input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
cmd_line]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Unusual Processes
cis20:
- CIS 8
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1203
- T1059
- T1053
- T1072
nist:
- PR.PT
- DE.CM
product:
- Splunk Behavioral Analytics
required_fields:
- process
- process_name
- parent_process_name
- _time
- dest_device_id
- dest_user_id
risk_severity: low
security_domain: endpoint
type: Anomaly
version: 1
dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
Vendored
+80
View File
@@ -0,0 +1,80 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-05'
description: This detection identifies use of Mimikatz modules for discovery of accounts
and groups and access to them.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 1bce67aa-3fc4-4886-9089-67f0bfebbef6
known_false_positives: None identified.
name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk_message: Mimikatz malware is searching for and using specific accounts and groups.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
- Stage:Command And Control
- Consequence:Loss Of Control
impact: 80
kill_chain_phases:
- Actions on Objectives
message: Mimikatz malware is searching for and using specific accounts and groups.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
mitre_attack_id:
- T1078
- T1087
- T1484
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 80
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
Vendored
+104
View File
@@ -0,0 +1,104 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-05'
description: This detection identifies access to PowerSploit modules that discover
accounts, groups and policies that can be accessed or taken over.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 63422f8e-766c-468f-8133-2ba6795e263b
known_false_positives: None identified.
name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is searching for and using specific accounts, groups
and policies, such as the last logged on account, a local Net group, etc. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true
OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line,
/(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true
OR match_regex(cmd_line, /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line,
/(?i)Get-DomainForeignGroupMember/)=true OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true
OR match_regex(cmd_line, /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line,
/(?i)Find-ForeignUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true
OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true
OR match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line,
/(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true
OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line,
/(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true
OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true
OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line,
/(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true
OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true
OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true
OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line,
/(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true
OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line,
/(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true
OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line,
/(?i)Get-LastLoggedOn/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
- Stage:Command And Control
- Consequence:Loss Of Control
impact: 80
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is searching for and using specific accounts, groups
and policies, such as the last logged on account, a local Net group, etc. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1078
- T1087
- T1484
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 80
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
Vendored
+93
View File
@@ -0,0 +1,93 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
description: This detection identifies access to PowerSploit modules for reconnaissance
and access to elements of Active Directory infrastructure, such as domain identifiers,
AD sites and forests, and trust relations.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: db08ac40-ee14-43e9-9a75-dddd059ef812
known_false_positives: None identified.
name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit
modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is seaching for or accessing Active Directory objects
such as domain sites, domain trusts, AD forests, etc. Operation is performed at
the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR
match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true
OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true
OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line,
/(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true
OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true
OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-NetForestDomain/)=true
OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true OR match_regex(cmd_line,
/(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line, /(?i)Get-ForestTrust/)=true
OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
- Stage:Command And Control
- Consequence:Loss Of Control
impact: 80
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is seaching for or accessing Active Directory objects
such as domain sites, domain trusts, AD forests, etc. Operation is performed at
the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1199
- T1482
- T1590
- T1591
- T1595
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 80
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
Vendored
+85
View File
@@ -0,0 +1,85 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
description: This detection identifies access to PowerSploit modules that discover
computers, servers and domains that can be accessed or taken over.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: fe1c4c5a-09f3-4b43-8129-560a7f38a08b
known_false_positives: None identified.
name: Reconnaissance and Access to Computers and Domains via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is seaching for or accessing domain controllers,
computers, file servers, etc. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR
match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true
OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true
OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line,
/(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
- Stage:Command And Control
- Consequence:Loss Of Control
impact: 80
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is seaching for or accessing domain controllers, computers,
file servers, etc. Operation is performed at the device $dest_device_id$, by the
account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1592
- T1590
- T1087
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 80
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
Vendored
+76
View File
@@ -0,0 +1,76 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
description: This detection identifies use of Mimikatz modules for discovery of computers
and servers and access to them.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 48664505-7d22-44ee-87d2-4c8a5bdc3d14
known_false_positives: None identified.
name: Reconnaissance and Access to Computers via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk_message: Mimikatz malware is collecting information about computers. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)net::ServerInfo/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
impact: 50
kill_chain_phases:
- Actions on Objectives
message: Mimikatz malware is collecting information about computers. Operation is
performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
mitre_attack_id:
- T1592
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 50
risk_severity: medium
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
Vendored
+93
View File
@@ -0,0 +1,93 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
description: This detection identifies access to PowerSploit modules that discover
and access operating system elements, such as processes, services, registry locations,
security packages and files.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: c1d33ad9-1727-4f9f-a474-4adbe4fed68a
known_false_positives: None identified.
name: Reconnaissance and Access to Operating System Elements via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is searching for and tapping into ongoing processes,
mounted drives or other operating system elements. Operation is performed at the
device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true
OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line,
/(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR
match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true
OR match_regex(cmd_line, /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true
OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line,
/(?i)Get-RegistryMountedDrive/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
- Stage:Command And Control
- Consequence:Loss Of Control
impact: 80
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is searching for and tapping into ongoing processes,
mounted drives or other operating system elements. Operation is performed at the
device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1057
- T1083
- T1592.002
- T1046
- T1012
- T1007
- T1047
- T1592
- T1518
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 80
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
Vendored
+76
View File
@@ -0,0 +1,76 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
description: This detection identifies use of Mimikatz modules for discovery and access
to services and processes.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 0243d37c-57c1-4182-bfd1-39b212255fc8
known_false_positives: None identified.
name: Reconnaissance and Access to Processes and Services via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk_message: Mimikatz malware is listing processes and services. Operation is performed
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
impact: 50
kill_chain_phases:
- Actions on Objectives
message: Mimikatz malware is listing processes and services. Operation is performed
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1007
- T1046
- T1057
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 50
risk_severity: medium
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
Vendored
+81
View File
@@ -0,0 +1,81 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
description: This detection identifies use of Mimikatz modules for discovery and access
to network shares.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: c97b6eb9-1d8b-4017-bbbb-2af7fc17bc3f
known_false_positives: None identified.
name: Reconnaissance and Access to Shared Resources via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk_message: Mimikatz malware is searching for and accessing network shares. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)net::share/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
- Stage:Lateral Movement
- Stage:Collection
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Mimikatz malware is searching for and accessing network shares. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1021
- T1039
- T1135
- T1021.002
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 70
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
Vendored
+85
View File
@@ -0,0 +1,85 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
description: This detection identifies access to PowerSploit modules that discover
and access network and distributed file system shares.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 6b7ca431-6b1e-4b40-9589-21cb368e369e
known_false_positives: None identified.
name: Reconnaissance and Access to Shared Resources via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is searching for and accessing network shares. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true
OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line,
/(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true
OR match_regex(cmd_line, /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line,
/(?i)Get-DFSshare/)=true OR match_regex(cmd_line, /(?i)Get-NetShare/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
- Stage:Lateral Movement
- Stage:Collection
impact: 70
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is searching for and accessing network shares. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1021
- T1039
- T1135
- T1021.002
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 70
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
Vendored
+96
View File
@@ -0,0 +1,96 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-05'
description: This detection identifies use of PowerSploit modules that discover opportunities
for malicious access and persistence. Some examples include access to admin accounts,
weak access control policies, landing paths for dropping malicious software or data
to exfiltrate, registry locations to land autorun parameters, task scheduling opportunities,
as well as services and system files that can be compromised.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 3d8bd7f3-1061-4ac7-9225-6764cc0684d7
known_false_positives: None identified.
name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is searching for an entry point into the infrastructure,
such as local admin accounts, opportunities to hijack processes, unattended install
files, or modifiable access objects. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true
OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line,
/(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true
OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line,
/(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true
OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line,
/(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true
OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line,
/(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true
OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line,
/(?i)Get-UnquotedService/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
impact: 60
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is searching for an entry point into the infrastructure,
such as local admin accounts, opportunities to hijack processes, unattended install
files, or modifiable access objects. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1053
- T1068
- T1078
- T1543
- T1547
- T1574
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 60
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml
Vendored
+86
View File
@@ -0,0 +1,86 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
description: This detection identifies access to PowerSploit modules for reconnaissance
of connectivity.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 525d32fd-65dd-4732-9b72-3cfc7ddddbd2
known_false_positives: None identified.
name: Reconnaissance of Connectivity via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is performing port scans or searching for various
connectivity details such as DNS data, proxies, or ongoing RDP connections. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true
OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line,
/(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true
OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line,
/(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true
OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
impact: 70
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is performing port scans or searching for various connectivity
details such as DNS data, proxies, or ongoing RDP connections. Operation is performed
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1021
- T1039
- T1135
- T1021.002
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 70
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
Vendored
+86
View File
@@ -0,0 +1,86 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
description: This detection identifies reconnaissance of credential stores and use
of CryptoAPI services by Mimikatz modules.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 5facee5b-79e4-47ab-b0e6-c625acc0554f
known_false_positives: None identified.
name: Reconnaissance of Credential Stores and Services via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk_message: Mimikatz malware is searching for and accessing credential stores. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line,
/(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true
OR match_regex(cmd_line, /(?i)crypto::sc/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
- Stage:Credential Access
impact: 80
kill_chain_phases:
- Actions on Objectives
message: Mimikatz malware is searching for and accessing credential stores. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1098
- T1590.001
- T1078
- T1589.001
- T1590
- T1068
- T1589
- T1590.003
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 80
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml
Vendored
+79
View File
@@ -0,0 +1,79 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-05'
description: This detection identifies use of PowerSploit modules for assessment of
presence of defensive tools.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 24b4e659-63a2-4e7b-89ac-87dd659c7110
known_false_positives: None identified.
name: Reconnaissance of Defensive Tools via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is looking for presence of anti virus software.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Find-AVSignature/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
impact: 40
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is looking for presence of anti virus software. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1592.002
- T1595.002
- T1592
- T1595
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 40
risk_severity: medium
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
Vendored
+78
View File
@@ -0,0 +1,78 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-05'
description: This detection identifies use of PowerSploit modules for assessment of
privilege escalation opportunities.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: b9b4492c-2af8-449b-beb4-b1b78d963321
known_false_positives: None identified.
name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is engaging its privilege escalation module. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Invoke-PrivescAudit/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
impact: 60
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is engaging its privilege escalation module. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1068
- T1078
- T1098
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 60
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
Vendored
+85
View File
@@ -0,0 +1,85 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-05'
description: This detection identifies use of Mimikatz modules for discovery of process
or service hijacking opportunities via Microsoft Detours compatibility. Microsoft
Detours is an open source library for intercepting, monitoring and instrumenting
binary functions on Microsoft Windows. Detours intercepts Win32 functions by re-writing
the in-memory code for target functions. The Detours package also contains utilities
to attach arbitrary DLLs and data segments called payloads to any Win32 binary.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: fc5c1cbd-7494-4314-aad2-458d6fd4fada
known_false_positives: None identified.
name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
- https://en.wikipedia.org/wiki/Microsoft_Detours
risk_message: Mimikatz malware is looking for and invoking Microsoft Detours package
that enables spoofing of in-memory code. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)misc::detours/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Discovery Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Recon
- Stage:Command And Control
- Consequence:Loss Of Control
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Mimikatz malware is looking for and invoking Microsoft Detours package
that enables spoofing of in-memory code. Operation is performed at the device
$dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1543
- T1055
- T1574
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- process
- dest_device_id
- dest_user_id
risk_score: 70
risk_severity: low
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/resize_shadowstorage_volume.yml
Vendored
+65
View File
@@ -0,0 +1,65 @@
author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-21'
description: The following analytics identifies the resizing of shadowstorage by ransomware
malware to avoid the shadow volumes being made again. this technique is an alternative
by ransomware attacker than deleting the shadowstorage which is known alert in defensive
team. one example of ransomware that use this technique is CLOP ransomware where
it drops a .bat file that will resize the shadowstorage to minimum size as much
as possible
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
id: dbc30554-d27e-11eb-9e5e-acde48001122
known_false_positives: network admin can resize the shadowstorage for valid purposes.
name: Resize Shadowstorage Volume
product:
- Splunk Behavioral Analytics
references:
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%")
AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
tags:
analytic_story:
- Clop Ransomware
- Ransomware
cis20:
- CIS 10
- CIS 13
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1489
nist:
- PR.DS
- PR.IP
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_severity: high
security_domain: endpoint
type: TTP
version: 2
dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml
Vendored
+91
View File
@@ -0,0 +1,91 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
description: This detection identifies illegal setting of credentials via DSInternals
modules.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: d5ef590f-9bde-49eb-9c63-2f5b62a65b9c
known_false_positives: None identified.
name: Setting Credentials via DSInternals modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/MichaelGrafnetter/DSInternals
risk_message: DSInternals malware is accessing, using or setting Active Directory
or Azure credentials and accounts. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true
OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true
OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line,
/(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true
OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Persistence Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Source:Cloud Data
- Stage:Credential Access
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
impact: 80
kill_chain_phases:
- Actions on Objectives
message: DSInternals malware is accessing, using or setting Active Directory or
Azure credentials and accounts. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
mitre_attack_id:
- T1068
- T1078
- T1098
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- process_name
- parent_process_name
- _time
- process_path
- dest_user_id
- process
risk_score: 80
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml
Vendored
+81
View File
@@ -0,0 +1,81 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
description: This detection identifies illegal setting of credentials via Mimikatz
modules.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: c8b84699-7652-4363-910f-efd1ca82f780
known_false_positives: None identified.
name: Setting Credentials via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk_message: Mimikatz malware is accessing, using or setting account credentials.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Persistence Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log
impact: 80
kill_chain_phases:
- Actions on Objectives
message: Mimikatz malware is accessing, using or setting account credentials. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1068
- T1078
- T1098
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 80
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/setting_credentials_via_powersploit_modules.yml
Vendored
+81
View File
@@ -0,0 +1,81 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
description: This detection identifies illegal setting of credentials via PowerSploit
modules.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 07b2a501-f967-4ddc-9f56-2dce46dfce44
known_false_positives: None identified.
name: Setting Credentials via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk_message: PowerSploit malware is setting passwords on Active Directory accounts.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Set-DomainUserPassword/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Persistence Techniques
asset_type: Windows
cis20:
- CIS 16
- CIS 20
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log
impact: 90
kill_chain_phases:
- Actions on Objectives
message: PowerSploit malware is setting passwords on Active Directory accounts.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
mitre_attack_id:
- T1068
- T1078
- T1098
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
role:
- Actor
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: cmd_line
role:
- Others
type: processname
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- dest_user_id
- process
- _time
risk_score: 90
risk_severity: high
security_domain: endpoint
type: TTP
version: 1
dist/ssa/detections/system_process_running_from_unexpected_location.yml
Vendored
+279
View File
@@ -0,0 +1,279 @@
author: Ignacio Bermudez Corrales, Splunk
datamodel: []
date: '2020-08-25'
description: An attacker tries might try to use different version of a system command
without overriding original, or they might try to avoid some detection running the
process from a different folder. This detection checks that a list of system processes
run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes
has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
id: 28179107-099a-464a-94d3-08301e6c055f
known_false_positives: None
name: System Process Running from Unexpected Location
product:
- Splunk Behavioral Analytics
references: []
risk_message: A system process $process_name$ with commandline $cmd_line$ spawn in
non-default folder path in host $dest_device_id$
search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
$cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe"
OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe"
OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe"
OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe"
OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe"
OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe"
OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe"
OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe"
OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe"
OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR
process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR
process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe"
OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR
process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe"
OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe"
OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR
process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe"
OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe"
OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe"
OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe"
OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe"
OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe"
OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe"
OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe"
OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe"
OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR
process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe"
OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe"
OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe"
OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe"
OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe"
OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe"
OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe"
OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe"
OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe"
OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe"
OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe";
$cond_2 = | from $ssa_input | where process_name="openwith.exe" OR process_name="optionalfeatures.exe"
OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe"
OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe"
OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe"
OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe"
OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR
process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe"
OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR
process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe"
OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe"
OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe"
OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe"
OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe"
OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe"
OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR
process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe"
OR process_name="settingsynchost.exe" OR process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe"
OR process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe"
OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe"
OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe"
OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe"
OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe"
OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe"
OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe"
OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe"
OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe"
OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe"
OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe"
OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe"
OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR
process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR
process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe"
OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe"
OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe"
OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe"
OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe"
OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe"
OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe"
OR process_name="windowsanytimeupgraderesults.exe";
$cond_3 = | from $ssa_input | where process_name="windowsanytimeupgradeui.exe" OR
process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe"
OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe"
OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe"
OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe"
OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe"
OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe"
OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe"
OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe"
OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe"
OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe"
OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe"
OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe"
OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe"
OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe"
OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe"
OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe"
OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe"
OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe"
OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe"
OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe"
OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe"
OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe"
OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe"
OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe"
OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe"
OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe"
OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe"
OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe"
OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe"
OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe"
OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe"
OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe"
OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe"
OR process_name="easinvoker.exe" OR process_name="efsui.exe";
$cond_4 = | from $ssa_input | where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe"
OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe"
OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe"
OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe"
OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe"
OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe"
OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe"
OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe"
OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe"
OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe"
OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe"
OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe"
OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe"
OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe"
OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe"
OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe"
OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe"
OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe"
OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe"
OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe"
OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe"
OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe"
OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe"
OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe"
OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe"
OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe"
OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe"
OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe"
OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe"
OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe"
OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe"
OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe"
OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe"
OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe";
$cond_5 = | from $ssa_input | where process_name="openfiles.exe" OR process_name="osk.exe"
OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe"
OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe"
OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe"
OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe"
OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe"
OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe"
OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe"
OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe"
OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe"
OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe"
OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe"
OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe"
OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe"
OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe"
OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe"
OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe"
OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe"
OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe"
OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe"
OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe"
OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe"
OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe"
OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe"
OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe"
OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe"
OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe"
OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe"
OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe"
OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe"
OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe"
OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe"
OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe"
OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe";
$cond_6 = | from $ssa_input | where process_name="tracerpt.exe" OR process_name="tscon.exe"
OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe"
OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe"
OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe"
OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe"
OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe"
OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe"
OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe"
OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe"
OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe"
OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe"
OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe"
OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe"
OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe"
OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe"
OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe"
OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe"
OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe"
OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe"
OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";
| from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Masquerading - Rename System Utilities
cis20:
- CIS 8
confidence: 80
context:
- source:endpoint
- stage: Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default
folder path in host $dest_device_id$
mitre_attack_id:
- T1036
nist:
- PR.PT
- DE.CM
observable:
- name: dest_device_id
role:
- Victim
type: Hostname
- name: dest_user_id
role:
- Victim
type: user
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- process_name
- _time
- dest_user_id
- process_path
risk_score: 56
risk_severity: low
security_domain: endpoint
type: Anomaly
version: 3
dist/ssa/detections/unusually_long_command_line.yml
Vendored
+75
View File
@@ -0,0 +1,75 @@
author: Ignacio Bermudez Corrales, Splunk
datamodel: []
date: '2020-10-06'
description: Command lines that are extremely long may be indicative of malicious
activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin
to help identify command lines with lengths that are unusual for a given user. This
detection is inspired on Unusually Long Command Line authored by Rico Valdez.
how_to_implement: You must be ingesting sysmon endpoint data that monitors command
lines.
id: 58f43aba-1775-445e-b19c-be2b87d83ae3
known_false_positives: This detection may flag suspiciously long command lines when
there is not sufficient evidence (samples) for a given process that this detection
is tracking; or when there is high variability in the length of the command line
for the tracked process. Also, some legitimate applications may use long command
lines. Such is the case of Ansible, that encodes Powershell scripts using long base64.
Attackers may use this technique to obfuscate their payloads.
name: Unusually Long Command Line
product:
- Splunk Behavioral Analytics
references: []
risk_message: A process $process_name$ with a long commandline $cmd_line$ executed
in host $dest_device_id$
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval
cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm,
/\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm,
""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line,
input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
| where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
"cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id",
event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Unusual Processes
cis20:
- CIS 8
confidence: 40
context:
- source:endpoint
- stage: Defense Evasion
impact: 30
kill_chain_phases:
- Actions on Objectives
message: A process $process_name$ with a long commandline $cmd_line$ executed in
host $dest_device_id$
nist:
- PR.PT
- DE.CM
observable:
- name: dest_device_id
role:
- Victim
type: Hostname
- name: dest_user_id
role:
- Victim
type: user
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- _time
- dest_device_id
- dest_user_id
- process
risk_score: 12
risk_severity: medium
security_domain: endpoint
type: Anomaly
version: 1
dist/ssa/detections/wevtutil_usage_to_clear_logs.yml
Vendored
+85
View File
@@ -0,0 +1,85 @@
author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-15'
description: The wevtutil.exe application is the windows event log utility. This searches
for wevtutil.exe with parameters for clearing the application, security, setup,
powershell, sysmon, or system event logs.
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
id: 5438113c-cdd9-11eb-93b8-acde48001122
known_false_positives: The wevtutil.exe application is a legitimate Windows event
log utility. Administrators may use it to manage Windows event logs.
name: WevtUtil Usage To Clear Logs
product:
- Splunk Behavioral Analytics
references:
- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html
risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear
event logs in host $dest_device_id$
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line,
/(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,
/(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,
/(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Log Manipulation
- Ransomware
- Clop Ransomware
cis20:
- CIS 8
- CIS 13
confidence: 90
context:
- source:endpoint
- stage: Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
impact: 70
kill_chain_phases:
- Exploitation
message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear
event logs in host $dest_device_id$
mitre_attack_id:
- T1070
- T1070.001
nist:
- PR.DS
- PR.IP
observable:
- name: dest_device_id
role:
- Victim
type: Hostname
- name: dest_user_id
role:
- Victim
type: user
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_score: 63
risk_severity: low
security_domain: endpoint
type: TTP
version: 2
dist/ssa/detections/wevtutil_usage_to_disable_logs.yml
Vendored
+81
View File
@@ -0,0 +1,81 @@
author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-15'
description: This search is to detect execution of wevtutil.exe to disable logs. This
technique was seen in several ransomware to disable the event logs to evade alerts
and detections in compromised host.
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
id: a4bdc944-cdd9-11eb-ac97-acde48001122
known_false_positives: network operator may disable audit event logs for debugging
purposes.
name: Wevtutil Usage To Disable Logs
product:
- Splunk Behavioral Analytics
references:
- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable
event logs in host $dest_device_id$
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line,
"%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Log Manipulation
- Ransomware
cis20:
- CIS 8
- CIS 13
confidence: 90
context:
- source:endpoint
- stage: Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
impact: 70
kill_chain_phases:
- Exploitation
message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable
event logs in host $dest_device_id$
mitre_attack_id:
- T1070
- T1070.001
nist:
- PR.DS
- PR.IP
observable:
- name: dest_device_id
role:
- Victim
type: Hostname
- name: dest_user_id
role:
- Victim
type: user
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_score: 63
risk_severity: low
security_domain: endpoint
type: TTP
version: 2