Merge branch 'develop' into response_phases

README.md

@@ -30,7 +30,7 @@ Create your customized version of Security Content by forking this project and f
 
 # MITRE ATT&CK
 ### Detection Coverage 
-To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what we are covering. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security-content/blob/mitre_maps/bin/generate-coverage-map.py).
+To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security-content/blob/mitre_maps/bin/generate-coverage-map.py).
 
 ![](docs/mitre-map/coverage.png)
 

bin/generate-actors-map.py

@@ -20,8 +20,8 @@ def main(argv):
 
     # parse input variables
     parser = argparse.ArgumentParser(description='Detection Priority based on APT groups')
-    parser.add_argument('--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma')
-    parser.add_argument('--output', default='output', action='store', help='result output directory, defaults to output')
+    parser.add_argument('-p', '--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma')
+    parser.add_argument('-o', '--output', default='output', action='store', help='result output directory, defaults to output')
     cmdargs = parser.parse_args()
 
     print("get all techniques for group")
@@ -45,6 +45,7 @@ def main(argv):
 
 def count_techniques(techniques, all_techniques):
     counted_techniques = []
+    final_counted_techniques = []
 
     max_count = 0
     actors = []
@@ -54,7 +55,15 @@ def count_techniques(techniques, all_techniques):
             counted_techniques.append({'name': all_technique['name'], 'object': all_technique, 'count': count_technique})
             max_count = count_technique if count_technique > max_count else max_count
 
-    counted_techniques = sorted(counted_techniques, key = lambda i: i['count'], reverse=True)
+    for all_technique in all_techniques:
+        if "." in all_technique["external_references"][0]["external_id"]:
+            parent_id = all_technique["external_references"][0]["external_id"].split(".")[0]
+            for counted in counted_techniques:
+                if parent_id == counted["object"]["external_references"][0]["external_id"]:
+                    counted['count'] += 1
+                final_counted_techniques.append(counted)
+
+    counted_techniques = sorted(final_counted_techniques, key = lambda i: i['count'], reverse=True)
 
     return counted_techniques, max_count
 
@@ -131,13 +140,16 @@ def generate_navigator_layer(matched_techniques, max_count, output):
     for technique in matched_techniques:
         comments = []
 
+        layer_technique = {
+            "techniqueID": technique["ID"],
+            "score" : technique["score"],
+            "showSubtechniques": True
+        }
+
+
         if len(technique["splunk_rules"]) > 0:
             for splunk_rule in technique["splunk_rules"]:
                 comments.append("https://github.com/splunk/security-content/blob/develop/detections/" + splunk_rule['filename'])
-        layer_technique = {
-            "techniqueID": technique["ID"],
-            "score" : technique["score"]
-        }
 
         if len(comments) > 0:
             layer_technique["comment"] = "\n\n".join(comments)

bin/generate-coverage-map.py

@@ -20,14 +20,14 @@ def main(argv):
 
     # parse input variables
     parser = argparse.ArgumentParser(description='Detection Coverage')
-    parser.add_argument('--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma')
-    parser.add_argument('--output', default='output', action='store', help='result output directory, defaults to output')
+    parser.add_argument('-p', '--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma')
+    parser.add_argument('-o', '--output', default='output', action='store', help='result output directory, defaults to output')
     cmdargs = parser.parse_args()
 
     print("get all techniques")
     techniques = get_all_techniques(cmdargs.projects_path)
 
-    print("count techniques")
+    print("load detections")
     detections = load_objects(path.join(cmdargs.projects_path),'detections/*.yml')
 
     print("get matched techniques")
@@ -45,6 +45,7 @@ def main(argv):
 
 def count_detections(matched_techniques):
     scored_detections = []
+    final_scored_detections = []
     max_count = 0
 
     for technique in matched_techniques:
@@ -52,7 +53,16 @@ def count_detections(matched_techniques):
             technique['score'] = len(technique['splunk_rules'])
             max_count = technique['score'] if technique['score'] > max_count else max_count
             scored_detections.append(technique)
-    return scored_detections, max_count
+
+    for technique in matched_techniques:
+        if "." in technique['ID']:
+            parent_id = technique['ID'].split(".")[0]
+            for scored in scored_detections:
+                if parent_id == scored['ID']:
+                    scored['score'] += len(technique['splunk_rules'])
+                final_scored_detections.append(scored)
+
+    return final_scored_detections, max_count
 
 
 def get_all_techniques(projects_path):
@@ -108,6 +118,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):
                 layer_technique = {
                 "techniqueID": technique["ID"],
                 "score" : technique["score"]
+
                 }
         else:
             layer_technique = {}
@@ -120,11 +131,12 @@ def generate_navigator_layer(matched_techniques, max_count, output):
     # ranging from zero (white) to the maximum score in the file (red)
     layer_json["gradient"] = {
         "colors": [
-			"##ffffff",
-			"#8ec843"
+			"#ffffff",
+			"#66b1ff",
+            "#096ed7"
         ],
         "minValue": 0,
-        "maxValue": 0
+        "maxValue": max_count
     }
 
     layer_json["filters"] = {
@@ -146,8 +158,8 @@ def generate_navigator_layer(matched_techniques, max_count, output):
             "color": "#ffffff"
         },
 		{
-			"label": "Available detections",
-			"color": "#8ec843"
+			"label": "Some detections available",
+			"color": "#66b1ff"
 		}
     ]
 

deployments/11_detect_arp_poisoning.yml

@@ -0,0 +1,22 @@
+name: Detect ARP Poisoning deployment configuration
+id: e1d5b4dc-4cf3-404f-905c-b478bbb20474
+date: '2020-08-14'
+description: This configuration file applies to the Detect ARP Poisoning detection
+author: Mikael Bjerkeland
+scheduling:
+  cron_schedule: '59 * * * *'
+  earliest_time: -70m@m
+  latest_time: -10m@m
+  schedule_window: auto
+alert_action:
+  notable:
+    rule_description: 'ARP Poisoning has been detected on interface $src_interface$ on host $orig_host$.
+      This may be an indication of a MITM attack.'
+    rule_title: 'ARP Poisoning Detected on $orig_host$'
+    nes_fields:
+      - src_interface
+      - firstTime
+      - lastTime
+      - count
+tags:
+  detection_name: Detect ARP Poisoning

deployments/12_detect_dhcp_poisoning.yml

@@ -0,0 +1,23 @@
+name: Detect Rogue DHCP Server deployment configuration
+id: 6e4e20ac-e719-4ebe-a52d-d672cd451dbb
+date: '2020-08-14'
+description: This configuration file applies to the Detect Rogue DHCP Server detection
+author: Mikael Bjerkeland
+scheduling:
+  cron_schedule: '59 * * * *'
+  earliest_time: -70m@m
+  latest_time: -10m@m
+  schedule_window: auto
+alert_action:
+  notable:
+    rule_description: 'DHCP Snooping has detected a Rogue DHCP Server on $orig_host$ from $src_mac$.
+      This may be an indication of a MITM attack.'
+    rule_title: 'Rogue DHCP Server Detected on $orig_host$'
+    nes_fields:
+      - src_mac
+      - firstTime
+      - lastTime
+      - count
+      - message_type
+tags:
+  detection_name: Detect Rogue DHCP Server

detections/aws_detect_permanent_key_creation.yml

@@ -6,7 +6,7 @@ id: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01
 known_false_positives: "Not all permanent key creations are malicious. If there is a policy of rotating keys this search can be adjusted to provide better context."
 name: "aws detect permanent key creation"
 references: []
-search: '`aws_cloudwatchlogs_eks` AKIA | spath eventName | search eventName=CreateAccessKey "userIdentity.type!=AssumedRole" | table sourceIPAddress userName src_user userIdentity.type userAgent action status responseElements.accessKey.createDate responseElements.accessKey.status responseElements.accessKey.accessKeyId
+search: '`aws_cloudwatchlogs_eks` CreateAccessKey | spath eventName | search eventName=CreateAccessKey "userIdentity.type"=IAMUser | table sourceIPAddress userName userIdentity.type userAgent action status responseElements.accessKey.createDate responseElements.accessKey.status responseElements.accessKey.accessKeyId
  |`aws_detect_permanent_key_creation_filter`'
 tags:
   analytics_story:

detections/detect_arp_poisoning.yml

@@ -0,0 +1,48 @@
+name: Detect ARP Poisoning
+id: b44bebd6-bd39-467b-9321-73971bcd7aac
+version: 1
+date: '2020-08-11'
+description: By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's 
+  network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure.
+how_to_implement: This search uses a standard SPL query on logs from Cisco Network
+  devices. The network devices must be configured with DHCP Snooping
+  (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html)
+  and Dynamic ARP Inspection
+  (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/security/configuration_guide/b_sec_1522e_2960x_cg/b_sec_1522e_2960x_cg_chapter_01111.html)
+  and log with a severity level of minimum "5 - notification".
+  The search also requires that the Cisco Networks Add-on for Splunk 
+  (https://splunkbase.splunk.com/app/1467) is used to
+  parse the logs from the Cisco network devices.
+type: ESCU
+references: []
+author: Mikael Bjerkeland, Splunk
+search: '`cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection"
+  | eval src_interface=src_int_prefix_long+src_int_suffix
+  | stats min(_time) AS firstTime max(_time) AS lastTime count
+  BY host src_interface
+  | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
+  `detect_arp_poisoning_filter`'
+known_false_positives: This search might be prone to high false positives if
+  DHCP Snooping or ARP inspection has been incorrectly configured,
+  or if a device normally sends many ARP packets (unlikely).
+tags:
+  analytics_story:
+  - Router and Infrastructure Security
+  kill_chain_phases:
+  - Reconnaissance
+  - Delivery
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1200
+  - T1498
+  - T1557
+  cis20:
+  - CIS 1
+  - CIS 11
+  nist:
+  - ID.AM
+  - PR.DS
+  detection_name: Detect ARP Poisoning
+  security_domain: network
+  asset_type: Infrastructure
+  

detections/detect_gcp_storage_access_from_a_new_ip.yml

@@ -0,0 +1,48 @@
+name: Detect GCP Storage access from a new IP
+id: ccc3246a-daa1-11ea-87d0-0242ac130022
+version: 1
+date: '2020-08-10'
+description: This search looks at GCP Storage bucket-access logs and detects new or previously
+  unseen remote IP addresses that have successfully accessed a GCP Storage bucket.
+how_to_implement: This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview). In order to capture public GCP Storage Bucket access logs, you must also enable storage bucket logging to your PubSub Topic as per https://cloud.google.com/storage/docs/access-logs.  These logs are deposited into the nominated Storage Bucket on an hourly basis and typically show up by 15 minutes past the hour.  It is recommended to configure any saved searches or correlation searches in Enterprise Security to run on an hourly basis at 30 minutes past the hour (cron definition of 30 * * * *).  A lookup table (previously_seen_gcp_storage_access_from_remote_ip.csv) stores the previously seen access requests, and is used by this search to determine any newly seen IP addresses accessing the Storage Buckets.
+type: ESCU
+references: []
+author: Shannon Davis, Splunk
+search: '`google_gcp_pubsub_message`
+| multikv
+| rename sc_status_ as status
+| rename cs_object_ as bucket_name
+| rename c_ip_ as remote_ip
+| rename cs_uri_ as request_uri
+| rename cs_method_ as operation
+| search status="\"200\""
+| stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip operation request_uri
+| table firstTime, lastTime, bucket_name, remote_ip, operation, request_uri
+| inputlookup append=t previously_seen_gcp_storage_access_from_remote_ip.csv
+| stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip operation request_uri
+| outputlookup previously_seen_gcp_storage_access_from_remote_ip.csv
+| eval newIP=if(firstTime >= relative_time(now(),"-70m@m"), 1, 0)
+| where newIP=1
+| eval first_time=strftime(firstTime,"%m/%d/%y %H:%M:%S")
+| eval last_time=strftime(lastTime,"%m/%d/%y %H:%M:%S")
+| table  first_time last_time bucket_name remote_ip operation request_uri
+| `detect_gcp_storage_access_from_a_new_ip_filter`'
+known_false_positives: GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow it),
+  as long as it can make a successful connection. This will be a false postive, since the search is looking
+  for a new IP within the past two hours.
+tags:
+  analytics_story:
+  - Suspicious GCP Storage Activities
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1530
+  cis20:
+  - CIS 13
+  - CIS 14
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  security_domain: network
+  asset_type: GCP Storage Bucket

detections/detect_new_open_gcp_storage_buckets.yml

@@ -0,0 +1,39 @@
+name: Detect New Open GCP Storage Buckets
+id: f6ea3466-d6bb-11ea-87d0-0242ac130003
+version: 1
+date: '2020-08-05'
+description: This search looks for GCP PubSub events where a user has created an open/public GCP Storage bucket.
+how_to_implement: 'This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview).'
+type: ESCU
+references: []
+author: Shannon Davis, Splunk
+search: '`google_gcp_pubsub_message` data.resource.type=gcs_bucket data.protoPayload.methodName=storage.setIamPermissions
+| spath output=action path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.action
+| spath output=user path=data.protoPayload.authenticationInfo.principalEmail
+| spath output=location path=data.protoPayload.resourceLocation.currentLocations{}
+| spath output=src path=data.protoPayload.requestMetadata.callerIp
+| spath output=bucketName path=data.protoPayload.resourceName
+| spath output=role path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.role
+| spath output=member path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.member
+| search (member=allUsers AND action=ADD)
+| table  _time, bucketName, src, user, location, action, role, member
+| search `detect_new_open_gcp_storage_buckets_filter`'
+known_false_positives: While this search has no known false positives, it is possible
+  that a GCP admin has legitimately created a public bucket for a specific purpose.
+  That said, GCP strongly advises against granting full control to the "allUsers"
+  group.
+tags:
+  analytics_story:
+  - Suspicious GCP Storage Activities
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1530
+  cis20:
+  - CIS 13
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  security_domain: network
+  asset_type: GCP Storage Bucket

detections/detect_rogue_dhcp_server.yml

@@ -0,0 +1,45 @@
+name: Detect Rogue DHCP Server
+id: 6e1ada88-7a0d-4ac1-92c6-03d354686079
+version: 1
+date: '2020-08-11'
+description: By enabling DHCP Snooping as a Layer 2 Security measure on the organization's 
+  network devices, we will be able to detect unauthorized DHCP servers handing out DHCP
+  leases to devices on the network (Man in the Middle attack).
+how_to_implement: This search uses a standard SPL query on logs from Cisco Network
+  devices. The network devices must be configured with DHCP Snooping enabled
+  (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html)
+  and log with a severity level of minimum "5 - notification".
+  The search also requires that the Cisco Networks Add-on for Splunk 
+  (https://splunkbase.splunk.com/app/1467) is used to
+  parse the logs from the Cisco network devices.
+type: ESCU
+references: []
+author: Mikael Bjerkeland, Splunk
+search: '`cisco_networks` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT" 
+  | stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS 
+  message_type values(src_mac) AS src_mac BY host
+  | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
+  `detect_rogue_dhcp_server_filter`'
+known_false_positives: This search might be prone to high false positives if
+  DHCP Snooping has been incorrectly configured or in the unlikely event that 
+  the DHCP server has been moved to another network interface.
+tags:
+  analytics_story:
+  - Router and Infrastructure Security
+  kill_chain_phases:
+  - Reconnaissance
+  - Delivery
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1200
+  - T1498
+  - T1557
+  cis20:
+  - CIS 1
+  - CIS 11
+  nist:
+  - ID.AM
+  - PR.DS
+  detection_name: Detect Rogue DHCP Server
+  security_domain: network
+  asset_type: Infrastructure

macros/cisco_networks.yml

@@ -0,0 +1,4 @@
+definition: eventtype=cisco_ios
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: cisco_networks

macros/detect_arp_poisoning_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters to prevent i.e. false positives
+name: detect_arp_poisoning_filter

macros/detect_rogue_dhcp_server_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters to prevent i.e. false positives
+name: detect_rogue_dhcp_server_filter

macros/security_content_ctime.yml

@@ -1,5 +1,5 @@
 arguments:
   - field
-definition: 'convert timeformat="%m/%d/%Y %H:%M:%S" ctime($field$)'
+definition: 'convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)'
 description: convert epoch time to string
 name: security_content_ctime

requirements.txt

@@ -11,7 +11,7 @@ contextlib2==0.6.0.post1
 distlib==0.3.1
 filelock==3.0.12
 gitdb==4.0.5
-identify==1.4.28
+identify==1.4.29
 idna==2.10
 importlib-metadata==1.7.0
 importlib-resources==3.0.0
@@ -21,7 +21,7 @@ MarkupSafe==1.1.1
 more-itertools==8.4.0
 nodeenv==1.5.0
 pathlib2==2.3.5
-pre-commit==2.6.0
+pre-commit==2.7.1
 pyrsistent==0.16.0
 python-dateutil==2.8.1
 pytz==2020.1

response_tasks/get_notable_info.yml

@@ -71,3 +71,4 @@ tags:
   - Kubernetes Sensitive Object Access Activity
   - F5 TMUI RCE CVE-2020-5902
   - Windows DNS SIGRed CVE-2020-1350
+  - Suspicious GCP Storage Activities

stories/suspicious_gcp_storage_activities.yml

@@ -0,0 +1,23 @@
+name: Suspicious GCP Storage Activities
+id: 4d656b2e-d6be-11ea-87d0-0242ac130003
+version: 1
+date: '2020-08-05'
+description: Use the searches in this Analytic Story to monitor your GCP Storage buckets
+  for evidence of anomalous activity and suspicious behaviors, such as detecting open
+  storage buckets and buckets being accessed from a new IP. The contextual and investigative
+  searches will give you more information, when required.
+narrative: 'Similar to other cloud providers, GCP operates on a shared responsibility model.
+  This means the end user, you, are responsible for setting appropriate access control lists
+  and permissions on your GCP resources.\
+  This Analytics Story concentrates on detecting things like open storage buckets (both read and write)
+  along with storage bucket access from unfamiliar users and IP addresses.'
+author: Shannon Davis, Splunk
+type: ESCU
+references:
+- https://cloud.google.com/blog/products/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security
+- https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/
+tags:
+  analytics_story: Suspicious GCP Storage Activities
+  usecase: Security Monitoring
+  category:
+  - Cloud Security