mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
Vendored
+1
-1
File diff suppressed because one or more lines are too long
Vendored
+1
-1
File diff suppressed because one or more lines are too long
Vendored
+1
-1
@@ -5,7 +5,7 @@
|
||||
"id": {
|
||||
"group": null,
|
||||
"name": "DA-ESS-ContentUpdate",
|
||||
"version": "4.2.0"
|
||||
"version": "4.3.0"
|
||||
},
|
||||
"author": [
|
||||
{
|
||||
|
||||
+72
-10
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-16T19:38:35 UTC
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -3121,6 +3121,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
|
||||
known_false_positives = False positives will most likely be present based on risk scoring and how the organization handles system to system communication. Filter, or modify as needed. In addition to count by analytics, adding a risk score may be useful. In our testing, with 22 events over 30 days, the risk scores ranged from 500 to 80,000. Your organization will be different, monitor and modify as needed.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Active Directory Privilege Escalation Identified - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = The primary objective of this correlation rule is to detect and alert on potential privilege escalation activities within an organization's Active Directory (AD) environment. By identifying multiple analytics associated with the Active Directory Privilege Escalation analytic story, security analysts can gain better insight into possible threats and respond accordingly to mitigate risks. The correlation rule will trigger an alert when multiple analytics from the Active Directory Privilege Escalation analytic story are detected within a specified time frame. The rule will generate an alert if a predetermined threshold of correlated analytics is reached within the specified time frame. This threshold can be customized to suit the needs and risk appetite of the organization.
|
||||
how_to_implement = Splunk Enterprise Security is required to utilize this correlation. In addition, modify the source_count value to your environment. In our testing, a count of 4 or 5 was decent in a lab, but the number may need to be increased as the analytic story includes over 30 analytics. In addition, based on false positives, modify any analytics to be anomaly and lower or increase risk based on organization importance.
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1484"], "nist": ["DE.AE"]}
|
||||
known_false_positives = False positives will most likely be present based on risk scoring and how the organization handles system to system communication. Filter, or modify as needed. In addition to count by analytics, adding a risk score may be useful. In our testing, with 22 events over 30 days, the risk scores ranged from 500 to 80,000. Your organization will be different, monitor and modify as needed.
|
||||
providing_technologies = null
|
||||
|
||||
[savedsearch://ESCU - Active Setup Registry Autostart - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
@@ -4935,7 +4945,7 @@ providing_technologies = ["Microsoft Windows"]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = The following analytic identifies executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents suspicious behavior as its commonly used by tools like like PsExec/PaExec and others to stage service binaries before creating and starting a Windows service on remote endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral movement and remote code execution. The Trickbot malware family also implements this behavior to try to infect other machines in the infected network.
|
||||
explanation = The following analytic identifies executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents suspicious behavior as its commonly used by tools like PsExec/PaExec and others to stage service binaries before creating and starting a Windows service on remote endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral movement and remote code execution. The Trickbot malware family also implements this behavior to try to infect other machines in the infected network.
|
||||
how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.002"], "nist": ["DE.CM"]}
|
||||
known_false_positives = System Administrators may use looks like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list.
|
||||
@@ -6989,6 +6999,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
|
||||
known_false_positives = A network operator or systems administrator may utilize an automated host discovery application that may generate false positives or an amazon ec2 script that uses this application. Filter as needed.
|
||||
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
|
||||
[savedsearch://ESCU - Network Share Discovery Via Dir Command - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = The following analytic identifies object access on Windows administrative SMB shares (Admin$, IPC$, C$). This represents suspicious behavior as its commonly used by tools like PsExec/PaExec and others to stage service binaries before creating and starting a Windows service on remote endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral movement and remote code execution. The IcedID malware family also implements this behavior to try to infect other machines in the infected network.
|
||||
how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5140 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1135"], "nist": ["DE.AE"]}
|
||||
known_false_positives = System Administrators may use looks like net.exe or "dir commandline" for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list.
|
||||
providing_technologies = ["Microsoft Windows"]
|
||||
|
||||
[savedsearch://ESCU - Nishang PowershellTCPOneLine - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
@@ -10590,6 +10610,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
|
||||
known_false_positives = False positives may be present based on Administrative use. Filter as needed.
|
||||
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
|
||||
[savedsearch://ESCU - Windows Ldifde Directory Object Behavior - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = The following analytic identifies the use of Ldifde.exe, which provides the ability to create, modify, or delete LDAP directory objects. Natively, the binary is only installed on a domain controller. However, adversaries or administrators may install the Windows Remote Server Admin Tools for ldifde.exe. Ldifde.exe is a Microsoft Windows command-line utility used to import or export LDAP directory entries. LDAP stands for Lightweight Directory Access Protocol, which is a protocol used for accessing and managing directory information services over an IP network. LDIF, on the other hand, stands for LDAP Data Interchange Format, a standard plain-text data interchange format for representing LDAP directory entries. -i This is a flag used with Ldifde.exe to denote import mode. In import mode, Ldifde.exe takes an LDIF file and imports its contents into the LDAP directory. The data in the LDIF file might include new objects to be created, or modifications or deletions to existing objects. -f This flag is used to specify the filename of the LDIF file that Ldifde.exe will import from (in the case of the -i flag) or export to (without the -i flag). For example, if you wanted to import data from a file called data.ldif, you would use the command ldifde -i -f data.ldif. Keep in mind that while the use of Ldifde.exe is legitimate in many contexts, it can also be used maliciously. For instance, an attacker who has gained access to a domain controller could potentially use Ldifde.exe to export sensitive data or make unauthorized changes to the directory. Therefore, it's important to monitor for unusual or unauthorized use of this tool.
|
||||
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command And Control", "Exploitation"], "mitre_attack": ["T1105", "T1069.002"], "nist": ["DE.CM"]}
|
||||
known_false_positives = False positives may be present, filter as needed.
|
||||
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
|
||||
[savedsearch://ESCU - Windows Linked Policies In ADSI Discovery - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
@@ -11430,6 +11460,26 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command And Control",
|
||||
known_false_positives = False positives may be present if the organization allows for SSH tunneling outbound or internally. Filter as needed.
|
||||
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
|
||||
[savedsearch://ESCU - Windows Proxy Via Netsh - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This search looks for processes launching netsh.exe for connection proxy. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe and executing commands via the command line.
|
||||
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command And Control"], "mitre_attack": ["T1090.001", "T1090"], "nist": ["DE.AE"]}
|
||||
known_false_positives = Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands.
|
||||
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
|
||||
[savedsearch://ESCU - Windows Proxy Via Registry - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This search looks for processes launching netsh.exe for connection proxy. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe and executing commands via the command line.
|
||||
how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical Sysmon TA. https://splunkbase.splunk.com/app/5709
|
||||
annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command And Control"], "mitre_attack": ["T1090.001", "T1090"], "nist": ["DE.AE"]}
|
||||
known_false_positives = unknown
|
||||
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
|
||||
[savedsearch://ESCU - Windows Query Registry Browser List Application - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
@@ -13281,7 +13331,7 @@ version = 1
|
||||
references = ["https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/", "https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious Copy on System32 - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - Windows Curl Download to Suspicious Path - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Phishing Recent ISO Exec Registry - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Wmic NonInteractive App Uninstallation - Rule"]
|
||||
searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Net Localgroup Discovery - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Share Discovery Via Dir Command - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Remote System Discovery with Net - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious Copy on System32 - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - Windows Curl Download to Suspicious Path - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Phishing Recent ISO Exec Registry - Rule", "ESCU - Windows WMI Process Call Create - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Wmic NonInteractive App Uninstallation - Rule"]
|
||||
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection.
|
||||
narrative = IcedId banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS targetting browser such as firefox and chrom to steal banking information. It is also known to its unique payload downloaded in C2 where it can be a .png file that hides the core shellcode bot using steganography technique or gzip dat file that contains "license.dat" which is the actual core icedid bot.
|
||||
|
||||
@@ -13354,7 +13404,7 @@ version = 1
|
||||
references = ["https://attack.mitre.org/tactics/TA0004/", "https://adsecurity.org/?p=3658", "https://adsecurity.org/?p=2362"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - Kerberos Service Ticket Request Using RC4 Encryption - Rule", "ESCU - Rubeus Command Line Parameters - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - Suspicious Computer Account Name Change - Rule", "ESCU - Suspicious Kerberos Service Ticket Request - Rule", "ESCU - Suspicious Ticket Granting Ticket Request - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - Windows Administrative Shares Accessed On Multiple Hosts - Rule", "ESCU - Windows Admon Default Group Policy Object Modified - Rule", "ESCU - Windows Admon Group Policy Object Created - Rule", "ESCU - Windows Default Group Policy Object Modified - Rule", "ESCU - Windows Default Group Policy Object Modified with GPME - Rule", "ESCU - Windows DnsAdmins New Member Added - Rule", "ESCU - Windows File Share Discovery With Powerview - Rule", "ESCU - Windows Findstr GPP Discovery - Rule", "ESCU - Windows Group Policy Object Created - Rule", "ESCU - Windows Large Number of Computer Service Tickets Requested - Rule", "ESCU - Windows Local Administrator Credential Stuffing - Rule", "ESCU - Windows PowerSploit GPP Discovery - Rule", "ESCU - Windows PowerView AD Access Control List Enumeration - Rule", "ESCU - Windows Rapid Authentication On Multiple Hosts - Rule", "ESCU - Windows Special Privileged Logon On Multiple Hosts - Rule"]
|
||||
searches = ["ESCU - Active Directory Privilege Escalation Identified - Rule", "ESCU - Kerberos Service Ticket Request Using RC4 Encryption - Rule", "ESCU - Rubeus Command Line Parameters - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - Suspicious Computer Account Name Change - Rule", "ESCU - Suspicious Kerberos Service Ticket Request - Rule", "ESCU - Suspicious Ticket Granting Ticket Request - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - Windows Administrative Shares Accessed On Multiple Hosts - Rule", "ESCU - Windows Admon Default Group Policy Object Modified - Rule", "ESCU - Windows Admon Group Policy Object Created - Rule", "ESCU - Windows Default Group Policy Object Modified - Rule", "ESCU - Windows Default Group Policy Object Modified with GPME - Rule", "ESCU - Windows DnsAdmins New Member Added - Rule", "ESCU - Windows File Share Discovery With Powerview - Rule", "ESCU - Windows Findstr GPP Discovery - Rule", "ESCU - Windows Group Policy Object Created - Rule", "ESCU - Windows Large Number of Computer Service Tickets Requested - Rule", "ESCU - Windows Local Administrator Credential Stuffing - Rule", "ESCU - Windows PowerSploit GPP Discovery - Rule", "ESCU - Windows PowerView AD Access Control List Enumeration - Rule", "ESCU - Windows Rapid Authentication On Multiple Hosts - Rule", "ESCU - Windows Special Privileged Logon On Multiple Hosts - Rule"]
|
||||
description = Monitor for activities and techniques associated with Privilege Escalation attacks within Active Directory environments.
|
||||
narrative = Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities.\
|
||||
Active Directory is a central component of most enterprise networks, providing authentication and authorization services for users, computers, and other resources. It stores sensitive information such as passwords, user accounts, and security policies, and is therefore a high-value target for attackers. Privilege escalation attacks in Active Directory typically involve exploiting vulnerabilities or misconfigurations across the network to gain elevated privileges, such as Domain Administrator access. Once an attacker has escalated their privileges and taken full control of a domain, they can easily move laterally throughout the network, access sensitive data, and carry out further attacks. Security teams should monitor for privilege escalation attacks in Active Directory to identify a breach before attackers achieve operational success.\
|
||||
@@ -13867,14 +13917,15 @@ narrative = Adversaries may partially or completely overwrite the contents of a
|
||||
|
||||
[analytic_story://Data Exfiltration]
|
||||
category = Adversary Tactics
|
||||
last_updated = 2020-10-21
|
||||
version = 1
|
||||
references = ["https://attack.mitre.org/tactics/TA0010/"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}]
|
||||
last_updated = 2023-05-17
|
||||
version = 2
|
||||
references = ["https://attack.mitre.org/tactics/TA0010/", "https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436", "https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-277a"]
|
||||
maintainers = [{"company": "Shannon Davis, Splunk", "email": "-", "name": "Bhavin Patel"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - AWS AMI Atttribute Modification for Exfiltration - Rule", "ESCU - AWS Disable Bucket Versioning - Rule", "ESCU - AWS EC2 Snapshot Shared Externally - Rule", "ESCU - AWS Exfiltration via Anomalous GetObject API Activity - Rule", "ESCU - AWS Exfiltration via Batch Service - Rule", "ESCU - AWS Exfiltration via Bucket Replication - Rule", "ESCU - AWS Exfiltration via DataSync Task - Rule", "ESCU - AWS Exfiltration via EC2 Snapshot - Rule", "ESCU - AWS S3 Exfiltration Behavior Identified - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Linux Curl Upload File - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Detect DGA domains using pretrained model in DSDL - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
|
||||
description = The stealing of data by an adversary.
|
||||
narrative = Exfiltration comes in many flavors. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command And Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.
|
||||
description = Data exfiltration refers to the unauthorized transfer or extraction of sensitive or valuable data from a compromised system or network during a cyber attack. It is a critical phase in many targeted attacks, where adversaries aim to steal confidential information, such as intellectual property, financial records, personal data, or trade secrets.
|
||||
narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) leveraged by adversaries to exfiltrate data from your environments. Exfiltration comes in many flavors and its done differently on every environment. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command And Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.\
|
||||
Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission. In context of the cloud, this refers to the unauthorized transfer or extraction of sensitive data from cloud-based systems or services. It involves the compromise of cloud infrastructure or accounts to gain access to valuable information stored in the cloud environment. Attackers may employ various techniques, such as exploiting vulnerabilities, stealing login credentials, or using malicious code to exfiltrate data from cloud repositories or services without detection.
|
||||
|
||||
[analytic_story://Data Protection]
|
||||
category = Abuse
|
||||
@@ -15434,6 +15485,17 @@ searches = ["ESCU - VMware Server Side Template Injection Hunt - Rule", "ESCU -
|
||||
description = Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges.
|
||||
narrative = On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954. Products affected include - VMware Workspace ONE Access (Access) 20.10.0.0 - 20.10.0.1, 21.08.0.0 - 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 - 3.3.6.
|
||||
|
||||
[analytic_story://Volt Typhoon]
|
||||
category = Data Destruction
|
||||
last_updated = 2023-05-25
|
||||
version = 1
|
||||
references = ["https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - Cmdline Tool Not Executed In CMD Shell - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Elevated Group Discovery With Net - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Impacket Lateral Movement smbexec CommandLine Parameters - Rule", "ESCU - Impacket Lateral Movement WMIExec Commandline Parameters - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Net Localgroup Discovery - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Suspicious Copy on System32 - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Windows DNS Gather Network Info - Rule", "ESCU - Windows Ldifde Directory Object Behavior - Rule", "ESCU - Windows Mimikatz Binary Execution - Rule", "ESCU - Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos - Rule", "ESCU - Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos - Rule", "ESCU - Windows Multiple Invalid Users Fail To Authenticate Using Kerberos - Rule", "ESCU - Windows Multiple Invalid Users Failed To Authenticate Using NTLM - Rule", "ESCU - Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials - Rule", "ESCU - Windows Multiple Users Failed To Authenticate From Host Using NTLM - Rule", "ESCU - Windows Multiple Users Failed To Authenticate From Process - Rule", "ESCU - Windows Multiple Users Failed To Authenticate Using Kerberos - Rule", "ESCU - Windows Multiple Users Remotely Failed To Authenticate From Host - Rule", "ESCU - Windows Proxy Via Netsh - Rule", "ESCU - Windows Proxy Via Registry - Rule", "ESCU - Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos - Rule", "ESCU - Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos - Rule", "ESCU - Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM - Rule", "ESCU - Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials - Rule", "ESCU - Windows Unusual Count Of Users Failed To Auth Using Kerberos - Rule", "ESCU - Windows Unusual Count Of Users Failed To Authenticate From Process - Rule", "ESCU - Windows Unusual Count Of Users Failed To Authenticate Using NTLM - Rule", "ESCU - Windows Unusual Count Of Users Remotely Failed To Auth From Host - Rule", "ESCU - Windows WMI Process Call Create - Rule"]
|
||||
description = This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the "Volt Typhoon" group targeting critical infrastructure organizations in United States and Guam. The affected organizations include the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. This Analytic story looks for suspicious process execution, lolbin execution, command-line activity, lsass dump and many more.
|
||||
narrative = Volt Typhoon is a state sponsored group typically focuses on espionage and information gathering.\ Based on Microsoft Threat Intelligence, This threat actor group puts strong emphasis on stealth in this campaign by relying almost exclusively on living-off-the-land techniques and hands-on-keyboard activity. \ They issue commands via the command line to :\ (1) collect data, including credentials from local and network systems, \ (2) put the data into an archive file to stage it for exfiltration, and then \ (3) use the stolen valid credentials to maintain persistence. \ In addition, Volt Typhoon tries to blend into normal network activity by routing traffic through compromised small office and home office (SOHO) network equipment, including routers, firewalls, and VPN hardware. They have also been observed using custom versions of open-source tools to establish a command and control (C2) channel over proxy to further stay under the radar.
|
||||
|
||||
[analytic_story://WhisperGate]
|
||||
category = Data Destruction
|
||||
last_updated = 2022-01-19
|
||||
|
||||
Vendored
+2
-2
@@ -4,7 +4,7 @@
|
||||
is_configured = false
|
||||
state = enabled
|
||||
state_change_requires_restart = false
|
||||
build = 14080
|
||||
build = 14375
|
||||
|
||||
[triggers]
|
||||
reload.analytic_stories = simple
|
||||
@@ -20,7 +20,7 @@ reload.es_investigations = simple
|
||||
|
||||
[launcher]
|
||||
author = Splunk
|
||||
version = 4.2.0
|
||||
version = 4.3.0
|
||||
description = Explore the Analytic Stories included with ES Content Updates.
|
||||
|
||||
[ui]
|
||||
|
||||
Vendored
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-16T19:38:35 UTC
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
+1
-1
@@ -1,2 +1,2 @@
|
||||
[content-version]
|
||||
version = 4.2.0
|
||||
version = 4.3.0
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-16T19:38:35 UTC
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
Vendored
+21
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-16T19:38:35 UTC
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -1225,6 +1225,10 @@ description = Update this macro to limit the output results to filter out false
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[active_directory_privilege_escalation_identified_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[active_setup_registry_autostart_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
@@ -2749,6 +2753,10 @@ description = Update this macro to limit the output results to filter out false
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[network_share_discovery_via_dir_command_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[nishang_powershelltcponeline_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
@@ -4157,6 +4165,10 @@ description = Update this macro to limit the output results to filter out false
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[windows_ldifde_directory_object_behavior_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[windows_linked_policies_in_adsi_discovery_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
@@ -4485,6 +4497,14 @@ description = Update this macro to limit the output results to filter out false
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[windows_proxy_via_netsh_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[windows_proxy_via_registry_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[windows_query_registry_browser_list_application_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
Vendored
+303
-101
File diff suppressed because it is too large
Load Diff
Vendored
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-16T19:38:35 UTC
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2023-05-16T19:38:35 UTC
|
||||
# On Date: 2023-05-30T18:06:50 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
@@ -281,8 +281,8 @@
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1484",
|
||||
"score": 8,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_new_custom_domain_added.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_new_federated_domain_added.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_domain_replication_acl_addition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_admon_default_group_policy_object_modified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_admon_group_policy_object_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_default_group_policy_object_modified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_group_policy_object_created.yml"
|
||||
"score": 9,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_new_custom_domain_added.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_new_federated_domain_added.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/active_directory_privilege_escalation_identified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_domain_replication_acl_addition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_admon_default_group_policy_object_modified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_admon_group_policy_object_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_default_group_policy_object_modified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_group_policy_object_created.yml"
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1484.002",
|
||||
@@ -496,8 +496,8 @@
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1105",
|
||||
"score": 18,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/curl_download_and_bash_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_curl_upload_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_ingress_tool_transfer_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/living_off_the_land.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/lolbas_with_network_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_curl_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wget_download_and_bash_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_curl_download_to_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_curl_upload_to_remote_destination.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml"
|
||||
"score": 19,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/curl_download_and_bash_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_curl_upload_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_ingress_tool_transfer_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/living_off_the_land.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/lolbas_with_network_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_curl_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wget_download_and_bash_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_curl_download_to_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_curl_upload_to_remote_destination.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ldifde_directory_object_behavior.yml"
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1036.005",
|
||||
@@ -631,8 +631,8 @@
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1069.002",
|
||||
"score": 18,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml"
|
||||
"score": 19,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ldifde_directory_object_behavior.yml"
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1078.003",
|
||||
@@ -906,8 +906,8 @@
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1090",
|
||||
"score": 4,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_proxy_socks_curl.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/ngrok_reverse_proxy_on_network.yml"
|
||||
"score": 6,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_proxy_socks_curl.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_proxy_via_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_proxy_via_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/ngrok_reverse_proxy_on_network.yml"
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1102",
|
||||
@@ -999,6 +999,11 @@
|
||||
"score": 1,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_discovery_using_route_windows_app.yml"
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1135",
|
||||
"score": 5,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_share_discovery_via_dir_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_file_share_discovery_with_powerview.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml"
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1555",
|
||||
"score": 4,
|
||||
@@ -1174,11 +1179,6 @@
|
||||
"score": 3,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/windows_ad_replication_service_traffic.yml"
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1135",
|
||||
"score": 4,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_file_share_discovery_with_powerview.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml"
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1484.001",
|
||||
"score": 5,
|
||||
@@ -1319,6 +1319,11 @@
|
||||
"score": 3,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_into_notepad.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_remote_thread.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_with_public_source_path.yml"
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1090.001",
|
||||
"score": 2,
|
||||
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_proxy_via_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_proxy_via_registry.yml"
|
||||
},
|
||||
{
|
||||
"techniqueID": "T1561.002",
|
||||
"score": 2,
|
||||
|
||||
Reference in New Issue
Block a user