admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

pretty print search yaml, update ci

Browse Source
This commit is contained in:
d1vious
2021-11-01 18:55:23 -04:00
parent 69bcff647c
commit bc3209042b
67 changed files with 1233 additions and 3862 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-and-validate.yml
+95 -90
View File
@@ -23,7 +23,7 @@ jobs:
steps:
- name: TAGGED, Validate that the tag is in the correct format
run: |
echo "The GITHUB_REF: $GITHUB_REF"
#First check to see if the release is a tag
@@ -32,7 +32,7 @@ jobs:
#is in the correct format (like v1.10.20)
if [[ $GITHUB_REF =~ refs/tags/v[0-9]+.[0-9]+.[0-9]+ ]]; then
echo "PASS: Tagged release with good format"
exit 0
exit 0
else
echo "FAIL: Tagged release with bad format"
exit 1
@@ -49,14 +49,14 @@ jobs:
runs-on: ubuntu-latest
needs: [validate-tag-if-present]
steps:
#Previous config chose which branch/tag to operate on.
#Previous config chose which branch/tag to operate on.
#I think Github is smart enough to choose based on whether it's a pull request or push + other info?
- name: Check out the repository code
- name: Check out the repository code
uses: actions/checkout@v2
#with:
# repository: splunk/security-content #check out https://github.com/mitre/cti.git, defaults to HEAD
# path: "security-content"
- uses: actions/setup-python@v2
with:
@@ -66,14 +66,14 @@ jobs:
#TODO: CircleCI restore_cache equivalent
#don't need to install python3 or python3-dev since it was handled by the action above?
#don't need to install python3 or python3-dev since it was handled by the action above?
#Also, no support for YAML anchors/aliases in Github Actions...
- name: Install System Packages
run: |
run: |
sudo apt update -qq
sudo apt install jq -qq
#TODO: CircleCI save_cache equivalent
sudo apt install jq -qq
#TODO: CircleCI save_cache equivalent
- name: Install Python Dependencies
run: |
#Get the virtualenv set up
@@ -83,19 +83,19 @@ jobs:
python3 -m pip install --upgrade pip
python3 -m pip install wheel
python3 -m pip install -q -r requirements.txt
- name: run validate
run: |
- name: run validate
run: |
source venv/bin/activate
python3 contentctl.py --path . --verbose validate
- name: Get CTI Repo for Mitre context
uses: actions/checkout@v2
- name: Get CTI Repo for Mitre context
uses: actions/checkout@v2
with:
repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD
path: "cti/"
#Now generate the documentation (uses Node)
- uses: actions/setup-node@v2
@@ -108,18 +108,18 @@ jobs:
#Enter the virtualenv and run the docgen
source venv/bin/activate
python3 bin/doc_gen.py --path . --output docs -v
#Now generate the spec docs
npm install -g @adobe/jsonschema2md
jsonschema2md -d spec -o docs/spec -f yaml -e spec.json -x -
#Clean up extra properties on docs
rm -rf docs/spec/*-*.md
echo "****** BRANCH INFORMATION ******"
git branch
git branch --show-current
build-sources:
runs-on: ubuntu-latest
needs: validate-content
@@ -128,10 +128,10 @@ jobs:
uses: actions/checkout@v2
- name: Install System Packages
run: |
run: |
sudo apt update -qq
sudo apt install jq -qq
sudo apt install jq -qq
- name: Install Python Dependencies
run: |
#Get the virtualenv set up
@@ -143,18 +143,15 @@ jobs:
python3 -m pip install -q -r requirements.txt
- name: Run Generate
run: |
run: |
source venv/bin/activate
python3 contentctl.py --path . --verbose generate --product ESCU --output dist/escu
python3 contentctl.py --path . --verbose generate --product SAAWS --output dist/saaws
python3 contentctl.py --path . --verbose generate --product DevSecOps --output dist/devsecops
# make a copy of use_case_lib in order to have ES work :-(
# cp dist/escu/default/use_case_library.conf dist/escu/default/analyticstories.conf
# cp dist/saaws/default/use_case_library.conf dist/saaws/default/analyticstories.conf
# cp dist/devsecops/default/use_case_library.conf dist/devsecops/default/analyticstories.conf
python3 contentctl.py --path . --verbose generate --product SSA --output dist/ssa
- name: Copy lookups .csv files
run: |
run: |
# clean up current lookups
rm -rf dist/escu/lookups
rm -rf dist/saaws/lookups
@@ -167,7 +164,7 @@ jobs:
cp -rv *.csv ../dist/escu/lookups
cp -rv *.csv ../dist/saaws/lookups
cp -rv *.csv ../dist/devsecops/lookups
#Tag is '' for non-tagged push and the tag name for a tagged release
- name: Set tag
id: vars
@@ -198,7 +195,7 @@ jobs:
sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/escu/app.manifest
sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/content-version.conf
tar -czf content-pack-build-escu.tar.gz dist/escu/*
# update build number and version for saaws
sed -i "s/build = .*$/build = ${{ github.run_number }}/g" dist/saaws/default/app.conf
sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/app.conf
@@ -209,6 +206,9 @@ jobs:
# update build number and version for devsecops
tar -czf content-pack-build-devsecops.tar.gz dist/devsecops/*
# update build number and version for ssa
tar -czf content-pack-build-ssa.tar.gz dist/ssa/*
- name: Persist to Workspace
uses: actions/upload-artifact@v2
with:
@@ -217,12 +217,13 @@ jobs:
content-pack-build-escu.tar.gz
content-pack-build-saaws.tar.gz
content-pack-build-devsecops.tar.gz
content-pack-build-ssa.tar.gz
build-package:
runs-on: ubuntu-latest
needs: [validate-content, build-sources]
steps:
- uses: actions/download-artifact@v2
with:
@@ -234,12 +235,12 @@ jobs:
with:
python-version: '2.7' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
- name: Get virtualenv for Python 2.7
run: |
sudo apt install virtualenv
sudo apt install virtualenv
- name: Grab Splunk Packaging Toolkit
- name: Grab Splunk Packaging Toolkit
run : |
curl -Ls https://download.splunk.com/misc/packaging-toolkit/splunk-packaging-toolkit-0.9.0.tar.gz -o splunk-packaging-toolkit-latest.tar.gz
mkdir slim-latest
@@ -264,6 +265,7 @@ jobs:
mv dist/escu DA-ESS-ContentUpdate
mv dist/saaws DA-ESS_AmazonWebServices_Content
mv dist/devsecops dev_sec_ops_analytics
slim package -o upload DA-ESS-ContentUpdate
slim package -o upload DA-ESS_AmazonWebServices_Content
slim package -o upload dev_sec_ops_analytics
@@ -276,6 +278,9 @@ jobs:
cp upload/dev_sec_ops_analytics-*tar.gz dev_sec_ops_analytics-latest.tar.gz
cp content-pack-build-ssa.tar.gz upload/SSA_Content-latest.tar.gz
sha256sum upload/SSA_Content-latest.tar.gz >> checksum.txt
touch tag-canary.txt
- name: store_artifacts
@@ -292,8 +297,9 @@ jobs:
build/DA-ESS-ContentUpdate-latest.tar.gz
build/DA-ESS_AmazonWebServices_Content-latest.tar.gz
build/dev_sec_ops_analytics-latest.tar.gz
build/SSA_Content-latest.tar.gz
build/checksum.txt
#Everything below this line should ONLY run on a tag and nothing else
#We still want all of the above checks to run and pass before running these
@@ -301,7 +307,7 @@ jobs:
runs-on: ubuntu-latest
needs: [validate-content, build-sources, build-package]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
if: startsWith(github.ref, 'refs/tags/')
steps:
- name: Checkout Repo
@@ -319,10 +325,10 @@ jobs:
- name: Install System Packages
run: |
run: |
sudo apt update -qq
sudo apt install jq -qq
- name: Submit ESCU Package to AppInspect API
@@ -333,8 +339,8 @@ jobs:
cd bin
#Enclose in quotes in case there are any special characters in the username/password
#Better not to pass these arguments on the command line, if possible
./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
- name: Submit SAAWS Package to AppInspect API
env:
APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }}
@@ -342,20 +348,20 @@ jobs:
run: |
cd bin
./appinspect.sh ../ DA-ESS_AmazonWebServices_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
- name: Create report artifact
if: always()
run: |
#Always create this, regardless of whether success or failure above
tar -cvzf report.tar.gz report/
- name: store_artifacts
- name: store_artifacts
uses: actions/upload-artifact@v2
with:
name: appinspect_reports
path: |
report.tar.gz
#Still store the report, even if we have failed (otherwise we don't know why/how we failed)
- name: store_artifacts_on_failure
uses: actions/upload-artifact@v2
@@ -364,7 +370,7 @@ jobs:
name: appinspect_reports_failure
path: |
report.tar.gz
create-report:
runs-on: ubuntu-latest
needs: [validate-content, build-sources, build-package, run-appinspect]
@@ -375,13 +381,13 @@ jobs:
uses: actions/checkout@v2
with:
ref: 'develop'
- name: Install System Packages
run: |
run: |
sudo apt update -qq
sudo apt install jq -qq
- uses: actions/setup-python@v2
with:
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
@@ -396,12 +402,12 @@ jobs:
python3 -m pip install --upgrade pip
python3 -m pip install wheel
python3 -m pip install -q -r requirements.txt
- name: run reporting
run: |
run: |
source venv/bin/activate
python3 bin/reporting.py
#Official, Verified Amazon-AWS Github Account Provided Action
- uses: aws-actions/configure-aws-credentials@v1
with:
@@ -410,23 +416,23 @@ jobs:
# aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
- name: Upload Reporting
- name: Upload Reporting
run: |
aws s3 cp bin/reporting s3://security-content/reporting --recursive --exclude "*" --include "*.svg"
update-sources-github:
runs-on: ubuntu-latest
needs: [validate-content, build-sources, build-package, run-appinspect, create-report]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
steps:
- name: Checkout Repo
uses: actions/checkout@v2
with:
token: ${{ secrets.PROTECTED_BRANCH_PUSH_TOKEN }}
ref: 'develop'
- uses: actions/setup-python@v2
with:
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
@@ -443,6 +449,8 @@ jobs:
tar -zxf DA-ESS-ContentUpdate-latest.tar.gz -C latest-escu --strip-components=1
mkdir latest-saaws
tar -zxf DA-ESS_AmazonWebServices_Content-latest.tar.gz -C latest-saaws --strip-components=1
mkdir latest-ssa
tar -zxf SSA_Content-latest.tar.gz -C latest-saaws --strip-components=1
- name: Install Python Dependencies
run: |
#Get the virtualenv set up
@@ -452,9 +460,9 @@ jobs:
python3 -m pip install --upgrade pip
python3 -m pip install wheel
python3 -m pip install -q -r requirements.txt
- name: Get CTI Repo for Mitre context
uses: actions/checkout@v2
- name: Get CTI Repo for Mitre context
uses: actions/checkout@v2
with:
repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD
path: "cti/"
@@ -463,33 +471,30 @@ jobs:
id: vars
run: |
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
- name: Run doc-gen
run: |
source venv/bin/activate
python3 bin/doc_gen.py --path . --output docs -v
- name: Make YAMLs Pretty
- name: Run doc-gen
run: |
source venv/bin/activate
python3 bin/pretty_yaml.py --path . -v
python3 bin/doc_gen.py --path . --output docs -v
- name: Make YAMLs Pretty
run: |
source venv/bin/activate
python3 bin/pretty_yaml.py --path . -v
- name: Run generate-coverage-map
run: |
source venv/bin/activate
python3 bin/generate-coverage-map.py --projects_path . --output docs/mitre-map
- name: Update github with new docs and package bits
run: |
rm -rf dist
mkdir dist
echo "Directory layout 3"
pwd
ls -lah
mv latest-escu dist/escu
mv latest-saaws dist/saaws
mv latest-ssa dist/ssa
# configure git to prep for commit
#git config credential.helper 'cache --timeout=120'
git config user.email "research@splunk.com"
git config user.name "research bot"
git config --global push.default simple
@@ -500,7 +505,7 @@ jobs:
# Push quietly to prevent showing the token in log
#No need to provide any credentials
git push
publish-github-release:
#Github-maintained release action is in archived state: https://github.com/actions/create-release
@@ -510,7 +515,7 @@ jobs:
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
#Get the artifacts that we need
- uses: actions/download-artifact@v2
with:
@@ -520,23 +525,24 @@ jobs:
with:
name: appinspect_reports
#Rename those artifacts appropriately
- name: Set tag
id: vars
run: echo "::set-output name=tag::${GITHUB_REF#refs/*/}"
- name: Rename the content-update appropriately
- name: Rename the content-update appropriately
run: |
cp DA-ESS-ContentUpdate-latest.tar.gz DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz
cp DA-ESS_AmazonWebServices_Content-latest.tar.gz DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz
cp SSA_Content-latest.tar.gz SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz
#No checksum on the reports
cp report.tar.gz report-${{ steps.vars.outputs.tag }}.tar.gz
cp checksum.txt checksum-${{ steps.vars.outputs.tag }}.txt
#Upload all of the artifacts that we have created using the third party
#action recommended bu Github
- name: Upload Release Artifacts
@@ -545,18 +551,19 @@ jobs:
files: |
DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz
DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz
SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz
report-${{ steps.vars.outputs.tag }}.tar.gz
checksum-${{ steps.vars.outputs.tag }}.txt
attack-range-update:
runs-on: ubuntu-latest
needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
steps:
#Get the artifacts that we need
- uses: actions/download-artifact@v2
with:
@@ -569,20 +576,20 @@ jobs:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
# aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
- name: Sync latest ESCU to the Attack Range S3 bucket for apps
run: |
aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/
# make the file public since it is not by default
aws s3api put-object-acl --bucket attack-range-appbinaries --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read
master-api-update:
runs-on: ubuntu-latest
needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update]
#Only run when tagged
if: startsWith(github.ref, 'refs/tags/')
steps:
steps:
- name: Checkout Repo
uses: actions/checkout@v2
with:
@@ -607,7 +614,7 @@ jobs:
- name: Create Baseline Folder
run: |
source venv/bin/activate
python3 bin/create_baseline_folder.py
python3 bin/create_baseline_folder.py
#Official, Verified Amazon-AWS Github Account Provided Action
- uses: aws-actions/configure-aws-credentials@v1
@@ -615,7 +622,7 @@ jobs:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
# aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
- name: Update API sources
run: |
@@ -637,5 +644,3 @@ jobs:
echo "Error [Security Content API status: $API_STATUS]"
exit 1
fi
bin/generate.py
+9
View File
@@ -103,6 +103,15 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH):
for d in detections:
manifest_file = OUTPUT_PATH + '/detections/' + d['name'].lower().replace(" ", "_") + '.yml'
# remove unused fields
del d['risk']
del d['deployment']
del d['mappings']
# pretty search
d['search'] = d['search'].replace("|", "\n|")
with open(manifest_file, 'w') as file:
documents = yaml.dump(d, file, sort_keys=True)
dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml
Vendored
+10 -59
View File
@@ -1,66 +1,18 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token
attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 759a653f-cb92-40f9-94c9-ec4e47b0f709
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1055
- T1068
- T1078
- T1098
- T1134
- T1543
- T1547
- T1548
- T1554
- T1556
- T1558
nist:
- PR.AC
- PR.IP
name: Applying Stolen Credentials via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
- https://adsecurity.org/?p=1275
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 90
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Mimikatz malware is violating authentication processes by injecting
golden or silver Kerberos tickets or passing stolen authentication tokens. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
@@ -107,17 +59,16 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line,
/(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true\
\ OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line,\
\ /(?i)kerberos::silver/)=true OR match_regex(cmd_line, /(?i)misc::skeleton/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml
Vendored
+11 -62
View File
@@ -1,27 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: Stolen credentials are applied by methods such as user impersonation,
credential injection, spoofing of authentication processes or getting hold of critical
accounts. This detection indicates such activities carried out by PowerSploit exploit
@@ -30,38 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: 270b482d-2af2-448f-9923-9cf005f61be4
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1055
- T1068
- T1078
- T1098
- T1134
- T1543
- T1547
- T1548
- T1554
- T1555
- T1558
nist:
- PR.AC
- PR.IP
name: Applying Stolen Credentials via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 90
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is violating authentication by injecting stolen
credentials, manipulating authentication tokens or impersonating system or user
accounts. Operation is performed at the device $dest_device_id$, by the account
@@ -108,20 +60,17 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true
OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line,
/(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-CredentialInjection/)=true\
\ OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true OR match_regex(cmd_line,\
\ /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, /(?i)Get-System/)=true\
\ OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true )\n\n| eval start_time\
\ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\
\ \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml
Vendored
+8 -54
View File
@@ -1,60 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: This detection identifies use of DSInternals modules that verify password
strength, i.e., identify week accounts that would be easily compromised.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1078
- T1098
- T1087
- T1201
- T1552
- T1555
nist:
- PR.AC
- PR.IP
name: Assessment of Credential Strength via DSInternals modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/MichaelGrafnetter/DSInternals
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 25
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: DSInternals tool kit is assessing password strength at the device $dest_device_id$.
Account attempting this operation is $dest_user_id$ via command $cmd_line$
savedsearch_annotations:
@@ -95,17 +52,14 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Test-PasswordQuality/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-PasswordQuality/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/attempt_to_delete_services.yml
Vendored
+12 -46
View File
@@ -2,28 +2,6 @@ author: Teoderick Contreras, splunk
datamodel:
- Endpoint
date: '2021-06-18'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This analytic identifies suspicious series of attempt to kill multiple
services on a system using either `net.exe` or `sc.exe`. This technique is use by
adversaries to terminate security services or other related services to continue
@@ -34,23 +12,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
id: a0c8c292-d01a-11eb-aa18-acde48001122
known_false_positives: unknown
mappings:
cis20:
- CIS 8
- CIS 13
kill_chain_phases:
- Exploitation
mitre_attack:
- T1489
nist:
- PR.DS
- PR.IP
name: Attempt To delete Services
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
risk: []
savedsearch_annotations:
analytic_story:
- XMRig
@@ -65,18 +31,18 @@ savedsearch_annotations:
nist:
- PR.DS
- PR.IP
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\
), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\
), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\
), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%delete%\") AND process_name\
\ = \"sc.exe\" \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\
\ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\
\ \"process_path\", process_path]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- XMRig
dist/ssa/detections/attempt_to_disable_services.yml
Vendored
+14 -47
View File
@@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-18'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This analytic will identify suspicious series of command-line to disable
several services. This technique is seen where the adversary attempts to disable
security app services or other malware services to complete the objective on the
@@ -34,24 +12,12 @@ how_to_implement: To successfully implement this search, you need to be ingestin
Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
id: afb31de4-d023-11eb-98d5-acde48001122
known_false_positives: unknown
mappings:
cis20:
- CIS 9
- CIS 8
kill_chain_phases:
- Exploitation
mitre_attack:
- T1489
nist:
- PR.DS
- PR.IP
name: Attempt To Disable Services
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
risk: []
savedsearch_annotations:
analytic_story:
- XMRig
@@ -66,19 +32,20 @@ savedsearch_annotations:
nist:
- PR.DS
- PR.IP
search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
"_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%")
AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval _datamodels=ucast(map_get(input_event,\
\ \"_datamodels\"), \"collection<string>\", []), body={} \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\
), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\
), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\
), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%disabled%\") AND like(cmd_line,\
\ \"%config%\") AND process_name=\"sc.exe\" \n| eval start_time=timestamp, end_time=timestamp,\
\ entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\
\ ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)), body=create_map([\"\
event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name, \"\
parent_process_name\", parent_process_name, \"process_path\", process_path]) \n\
| into write_ssa_detected_events();"
tags:
analytic_story:
- XMRig
dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
Vendored
+15 -52
View File
@@ -1,55 +1,17 @@
author: Jose Hernandez, Splunk
datamodel: []
date: 2020-6-04
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: Monitor for execution of reg.exe with parameters specifying an export
of keys that contain hashed credentials that attackers may try to crack offline.
how_to_implement: You must be ingesting windows endpoint data that tracks process
activity, including parent-child relationships from your endpoints.
id: 14038953-e5f2-4daf-acff-5452062baf03
known_false_positives: None identified.
mappings:
cis20:
- CIS 3
- CIS 5
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1003
nist:
- DE.CM
name: Attempted Credential Dump From Registry via Reg exe
product:
- Splunk Behavioral Analytics
references:
- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 63
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Malicious actor is dumping stored credentials from the registry sections
SAM, Security, or System. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
@@ -85,20 +47,21 @@ savedsearch_annotations:
role:
- Others
type: processname
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
"process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe"
OR process_name="reg.exe" | where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true
AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line,
/(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line,
/(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time
= timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
| into write_ssa_detected_events(); '
search: " \n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)) \n| eval process_name=lower(ucast(map_get(input_event,\
\ \"process_name\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"\
process\"), \"string\", null), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where process_name=\"cmd.exe\" OR process_name=\"reg.exe\" \n| where\
\ cmd_line != null AND match_regex(cmd_line, /(?i)save\\s+/)=true AND ( match_regex(cmd_line,\
\ /(?i)HKLM\\\\Security/)=true OR match_regex(cmd_line, /(?i)HKLM\\\\SAM/)=true\
\ OR match_regex(cmd_line, /(?i)HKLM\\\\System/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\
\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\SAM/)=true\
\ OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\System/)=true ) \n| eval start_time\
\ = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),\
\ body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\
, process_name]) \n| into write_ssa_detected_events(); "
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
Vendored
+15 -53
View File
@@ -1,27 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-18'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. FGdump is
@@ -32,26 +11,10 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: 312582f2-5e91-42c1-a275-cd67f31373c8
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1003
nist:
- PR.AC
- PR.IP
name: Credential Extraction indicative of FGDump and CacheDump with s option
product:
- Splunk Behavioral Analytics
references: []
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 70
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
@@ -87,22 +50,21 @@ savedsearch_annotations:
role:
- Others
type: processname
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND process_name != null AND parent_process_name != null
AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name,
/(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true
AND match_regex(cmd_line, /(?i)\-s/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\
\ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\
\ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND process_name != null AND parent_process_name\
\ != null AND match_regex(parent_process_name, /(?i)System32\\\\services.exe/)=true\
\ AND match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND match_regex(process_path,\
\ /(?i)\\\\Temp/)=true AND match_regex(cmd_line, /(?i)\\-s/)=true\n\n| eval start_time\
\ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\
\ \"process_name\", process_name, \"parent_process_name\", parent_process_name])\
\ \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Unusual Processes
dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
Vendored
+12 -51
View File
@@ -1,27 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-18'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. FGdump is
@@ -32,26 +11,10 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1003
nist:
- PR.AC
- PR.IP
name: Credential Extraction indicative of FGDump and CacheDump with v option
product:
- Splunk Behavioral Analytics
references: []
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 63
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
@@ -87,20 +50,18 @@ savedsearch_annotations:
role:
- Others
type: processname
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name,
/(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true
AND match_regex(cmd_line, /(?i)\-v/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\
\ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\
\ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND process_name != null AND process_path !=\
\ null AND match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND match_regex(process_path,\
\ /(?i)\\\\Temp/)=true AND match_regex(cmd_line, /(?i)\\-v/)=true\n\n| eval start_time\
\ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\
\ \"process_name\", process_name]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Unusual Processes
dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml
Vendored
+8 -49
View File
@@ -1,27 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-18'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. LaZagne is
@@ -31,27 +10,10 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: 341975fa-4ad0-4f01-9acc-df4f69742db7
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1003
- T1555
nist:
- PR.IP
- PR.AC
name: Credential Extraction indicative of Lazagne command line options
product:
- Splunk Behavioral Analytics
references: []
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 63
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Lazagne malware is extracting/decoding encoded credentials. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
@@ -87,17 +49,14 @@ savedsearch_annotations:
role:
- Others
type: processname
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line,
/(?i)all\s+\-oA\s+\-output/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND match_regex(cmd_line, /(?i)all\\s+\\-oA\\\
s+\\-output/)=true\n\n| eval start_time = timestamp, end_time = timestamp, entities\
\ = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
Vendored
+17 -56
View File
@@ -1,27 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-21'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. DSInternals
@@ -30,28 +9,12 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1003
nist:
- PR.AC
- PR.IP
name: Credential Extraction indicative of use of DSInternals credential conversion
modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/MichaelGrafnetter/DSInternals
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 70
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: DSInternals tool kit is converting stolen credential material to a form
applicable to authentications. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
@@ -87,25 +50,23 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true
OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line,
/(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true
OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line,
/(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true
OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line,
/(?i)ConvertTo-UnicodePassword/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), process_name=ucast(map_get(input_event, \"process_name\"\
), \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\
\ \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\
, null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true\
\ OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line,\
\ /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true\
\ OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line,\
\ /(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true\
\ OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line,\
\ /(?i)ConvertTo-UnicodePassword/)=true )\n\n| eval start_time = timestamp, end_time\
\ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\
, process_name]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml
Vendored
+19 -58
View File
@@ -1,27 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-21'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. DSInternals
@@ -30,27 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1003
nist:
- PR.AC
- PR.IP
name: Credential Extraction indicative of use of DSInternals modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/MichaelGrafnetter/DSInternals
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 70
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: DSInternals tool kit is accessing sensitive credential material such
as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
@@ -87,27 +50,25 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true
OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,
/(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true
OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,
/(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true
OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true
OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true
OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line,
/(?i)Get-SamPasswordPolicy/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), process_name=ucast(map_get(input_event, \"process_name\"\
), \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\
\ \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\
, null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true\
\ OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,\
\ /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true\
\ OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,\
\ /(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true\
\ OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line,\
\ /(?i)Get-AzureADUserEx/)=true OR match_regex(cmd_line, /(?i)Get-BootKey/)=true\
\ OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true OR match_regex(cmd_line,\
\ /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line, /(?i)Get-SamPasswordPolicy/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line, \"process_name\", process_name]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml
Vendored
+13 -53
View File
@@ -1,27 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-21'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. Mimikatz
@@ -30,27 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: 966b635f-98e8-4aa4-9b49-47ed2cedcc85
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1003
nist:
- PR.AC
- PR.IP
name: Credential Extraction indicative of use of Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 66
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Mimikatz malware is extracting/decoding encoded credentials from stores
such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
@@ -86,22 +49,19 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true
OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true
OR match_regex(cmd_line, /(?i)lsadump::sam/)=true OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true
OR match_regex(cmd_line, /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true
OR match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true\
\ OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true OR match_regex(cmd_line, /(?i)kerberos::list/)=true\
\ OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR match_regex(cmd_line, /(?i)lsadump::sam/)=true\
\ OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true OR match_regex(cmd_line,\
\ /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true OR\
\ match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml
Vendored
+14 -54
View File
@@ -1,27 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-21'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. PowerSploit
@@ -30,27 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: 5f1186a4-e681-446e-851c-dc9574ad28eb
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1003
nist:
- PR.AC
- PR.IP
name: Credential Extraction indicative of use of PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 70
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is extracting encoded credentials or spoofing automated
logings. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
@@ -86,23 +49,20 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true
OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true
OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line,
/(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true
OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line,
/(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true\
\ OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true OR match_regex(cmd_line,\
\ /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true\
\ OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line,\
\ /(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true\
\ OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line,\
\ /(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
Vendored
+14 -52
View File
@@ -1,27 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-18'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. Native Microsoft
@@ -34,27 +13,11 @@ known_false_positives: Although unlikely, using debuggers this way may be indica
of developers analyzing crash dumps of their code. Note, even for developers this
is an unusual way of working on code - debuggers are mostly used to step through
code, not analyze its crash dumps.
mappings:
cis20:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1003
nist:
- PR.IP
- PR.AC
name: Credential Extraction native Microsoft debuggers peek into the kernel
product:
- Splunk Behavioral Analytics
references:
- https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 63
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
native debugging tools. Operation is performed at the device $dest_device_id$, by
the account $dest_user_id$ via command $cmd_line$
@@ -90,21 +53,20 @@ savedsearch_annotations:
role:
- Others
type: processname
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line != null AND parent_process_name != null AND process_name
!= null AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name,
/(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true
AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\-ForceV1/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\
\ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND parent_process_name != null AND process_name\
\ != null AND ( match_regex(parent_process_name, /(?i)ntkd\\.exe/)=true OR match_regex(parent_process_name,\
\ /(?i)livekd\\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\\.exe/)=true\
\ AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\\\
-ForceV1/)=true\n\n| eval start_time = timestamp, end_time = timestamp, entities\
\ = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line, \"process_name\", process_name, \"parent_process_name\"\
, parent_process_name]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
Vendored
+11 -50
View File
@@ -1,27 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-18'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. Native Microsoft
@@ -34,26 +13,10 @@ known_false_positives: Although unlikely, using debuggers this way may be indica
of developers analyzing crash dumps of their code. Note, even for developers this
is an unusual way of working on code - debuggers are mostly used to step through
code, not analyze its crash dumps.
mappings:
cis20:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1003
nist:
- PR.AC
- PR.IP
name: Credential Extraction native Microsoft debuggers via z command line option
product:
- Splunk Behavioral Analytics
references: []
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 63
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
native debugging tools. Operation is performed at the device $dest_device_id$, by
the account $dest_user_id$ via command $cmd_line$
@@ -89,19 +52,17 @@ savedsearch_annotations:
role:
- Others
type: processname
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line != null AND process_name != null AND ( match_regex(process_name,
/^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line,
/(?i)\-z\s+/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\
\ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND process_name != null AND ( match_regex(process_name,\
\ /^(?i)ntkd\\.exe/)=true OR match_regex(process_name, /^(?i)kd\\.exe/)=true ) AND\
\ match_regex(cmd_line, /(?i)\\-z\\s+/)=true\n\n| eval start_time = timestamp, end_time\
\ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\
, process_name]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
Vendored
+9 -48
View File
@@ -1,27 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-10-18'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. PowerSploit
@@ -31,27 +10,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: e4f126b5-e6bc-4a5c-b1a8-d07bc6c4a49f
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1003
nist:
- PR.IP
- PR.AC
name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and
DSInternals
product:
- Splunk Behavioral Analytics
references: []
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 63
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount
module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
@@ -87,17 +50,15 @@ savedsearch_annotations:
role:
- Others
type: processname
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line,
/(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\|]+/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true\
\ AND match_regex(cmd_line, /(?i)\\-dbpath[\\s;:\\.\\\n|]+/)=true\n\n| eval start_time\
\ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\
\ \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/delete_a_net_user.yml
Vendored
+13 -46
View File
@@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-21'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This analytic will detect a suspicious net.exe/net1.exe command-line
to delete a user on a system. This technique may be use by an administrator for
legitimate purposes, however this behavior has been used in the wild to impair some
@@ -37,23 +15,11 @@ how_to_implement: o successfully implement this search, you need to be ingesting
id: 8776d79c-d26e-11eb-9a56-acde48001122
known_false_positives: System administrators or scripts may delete user accounts via
this technique. Filter as needed.
mappings:
cis20:
- CIS 4
- CIS 16
kill_chain_phases:
- Exploitation
mitre_attack:
- T1489
nist:
- PR.AC
- PR.IP
name: Delete A Net User
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
risk: []
savedsearch_annotations:
analytic_story:
- XMRig
@@ -68,18 +34,19 @@ savedsearch_annotations:
nist:
- PR.AC
- PR.IP
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\
), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\
), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\
), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%/delete%\") AND (process_name=\"\
net1.exe\" OR process_name=\"net.exe\") \n| eval start_time=timestamp, end_time=timestamp,\
\ entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\
\ ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)), body=create_map([\"\
event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name, \"\
parent_process_name\", parent_process_name, \"process_path\", process_path]) \n\
| into write_ssa_detected_events();"
tags:
analytic_story:
- XMRig
dist/ssa/detections/deny_permission_using_cacls_utility.yml
Vendored
+13 -52
View File
@@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-14'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This analytic identifies a potential adversary that changes the security
permission of a specific file or directory. This technique is commonly seen in APT
tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection
@@ -35,29 +13,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
id: b76eae28-cd25-11eb-9c92-acde48001122
known_false_positives: network administrator may use this windows utility but this
is not a common practice.
mappings:
cis20:
- CIS 14
- CIS 16
kill_chain_phases:
- Exploitation
mitre_attack:
- T1222
nist:
- PR.AC
- PR.IP
name: Deny Permission using Cacls Utility
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 35
- risk_object_field: dest_user_id
risk_object_type: user
risk_score: 35
risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to deny
a permission of a file or directory in host $dest_device_id$
savedsearch_annotations:
@@ -87,18 +47,19 @@ savedsearch_annotations:
role:
- Victim
type: user
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\
\ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\
\ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true\
\ AND (process_name=\"cacls.exe\" OR process_name=\"xcacls.exe\" OR process_name=\"\
icacls.exe\") \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\
\ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\
\ \"process_path\", process_path]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- XMRig
dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml
Vendored
+10 -47
View File
@@ -1,27 +1,6 @@
author: Jose Hernandez, Splunk
datamodel: []
date: '2020-09-15'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: This search detects the memory of lsass.exe being dumped for offline
credential theft attack.
how_to_implement: You must be ingesting endpoint data that tracks process activity,
@@ -30,28 +9,11 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi
on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml).
id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
known_false_positives: None identified.
mappings:
cis20:
- CIS 8
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1003.003
- T1003
nist:
- DE.CM
name: Detect Dump LSASS Memory using comsvcs
product:
- Splunk Behavioral Analytics
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 70
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Malicious actor is dumping encoded credentials via Microsoft's native
comsvc DLL. Operation is performed at the device $dest_device_id$, by the account
$dest_user_id$ via command $cmd_line$
@@ -87,15 +49,16 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
"_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
"string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
/(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
"process_name", process_name, "process", process]) | into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval tenant=ucast(map_get(input_event,\
\ \"_tenant\"), \"string\", null), machine=ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null), process_name=lower(ucast(map_get(input_event, \"process_name\"\
), \"string\", null)), timestamp=parse_long(ucast(map_get(input_event, \"_time\"\
), \"string\", null)), process=lower(ucast(map_get(input_event, \"process\"), \"\
string\", null)), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where process_name LIKE \"%rundll32.exe%\" AND match_regex(process,\
\ /(?i)comsvcs.dll[,\\s]+MiniDump/)=true \n| eval start_time = timestamp, end_time\
\ = timestamp, entities = mvappend(machine), body=create_map([\"event_id\", event_id,\
\ \"process_name\", process_name, \"process\", process]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/detect_kerberoasting.yml
Vendored
+15 -53
View File
@@ -1,27 +1,6 @@
author: Xiao Lin, Splunk
datamodel: []
date: '2020-10-21'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Patrick Bareiss
date: '2021-01-13'
description: Example for a deployment for a specific Analytics Story
id: 52f52a7c-078f-4413-84da-388b61ccac26
name: Credential Dumping Story
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: Credential Dumping
description: This search detects a potential kerberoasting attack via service principal
name requests
how_to_implement: The test data is converted from Windows Security Event logs generated
@@ -29,28 +8,11 @@ how_to_implement: The test data is converted from Windows Security Event logs ge
id: dabdd6d7-3e10-42be-8711-4e124f7a3850
known_false_positives: Older systems that support kerberos RC4 by default NetApp may
generate false positives
mappings:
cis20:
- CIS 8
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1558.003
- T1558
nist:
- DE.CM
name: Detect Kerberoasting
product:
- Splunk Behavioral Analytics
references:
- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 14
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Kerberoasting malware is potentially applying stolen credentials. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
@@ -86,21 +48,21 @@ savedsearch_annotations:
role:
- Others
type: processname
search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"),
EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
"ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
"service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769"
AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event
input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
| eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id,
"EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions,
"TicketEncryptionType", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null))| select start_time, end_time, entities, body | into write_ssa_detected_events();'
search: " \n| from read_ssa_enriched_events() \n| eval _time=map_get(input_event,\
\ \"_time\"), EventCode=map_get(input_event, \"event_code\"), TicketOptions=map_get(input_event,\
\ \"ticket_options\"), TicketEncryptionType=map_get(input_event, \"ticket_encryption_type\"\
), ServiceName=map_get(input_event, \"service_name\"), ServiceID=map_get(input_event,\
\ \"service_id\"), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"\
string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"),\
\ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where EventCode=\"4769\" AND TicketOptions=\"0x40810000\" AND TicketEncryptionType=\"\
0x17\" \n| first_time_event input_columns=[\"EventCode\",\"TicketOptions\",\"TicketEncryptionType\"\
,\"ServiceName\",\"ServiceID\"] \n| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID\
\ \n| eval start_time=_time, end_time=_time, body=create_map([\"event_id\", event_id,\
\ \"EventCode\", EventCode, \"ServiceName\", ServiceName, \"TicketOptions\", TicketOptions,\
\ \"TicketEncryptionType\", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null))\n| select start_time, end_time, entities, body \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Credential Dumping
dist/ssa/detections/detect_pass_the_hash.yml
Vendored
+12 -58
View File
@@ -1,28 +1,6 @@
author: Xiao Lin, Splunk
datamodel: []
date: '2020-10-21'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This search looks for specific authentication events from the Windows
Security Event logs to detect potential attempts using Pass-the-Hash technique.
how_to_implement: The test data is converted from Windows Security Event logs generated
@@ -30,32 +8,11 @@ how_to_implement: The test data is converted from Windows Security Event logs ge
id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f
known_false_positives: Legitimate logon activity by authorized NTLM systems may be
detected by this search. Please investigate as appropriate.
mappings:
cis20:
- CIS 3
- CIS 5
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1550
- T1550.002
nist:
- PR.PT
- PR.AT
- PR.AC
- PR.IP
name: Detect Pass the Hash
product:
- Splunk Behavioral Analytics
references:
- Initial ESCU implementation by Bhavin Patel and Patrick Bareiss
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 16
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Potential use of the pass the hash/token attacks that spoof authentication.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
@@ -95,21 +52,18 @@ savedsearch_annotations:
role:
- Others
type: processname
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
| eval signature_id=map_get(input_event, "signature_id"), authentication_type=map_get(input_event,
"authentication_type"), authentication_method=map_get(input_event, "authentication_method"),
origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event,
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9"
AND authentication_method="seclogo")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type,
"authentication_method", authentication_method]) | into write_ssa_detected_events();'
search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)) \n| eval signature_id=map_get(input_event, \"signature_id\"\
), authentication_type=map_get(input_event, \"authentication_type\"), authentication_method=map_get(input_event,\
\ \"authentication_method\"), origin_device_domain=map_get(input_event, \"origin_device_domain\"\
), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\
\ dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null),\
\ event_id=ucast(map_get(input_event, \"event_id\"), \"string\", null)\n\n| where\
\ (authentication_type=\"3\" AND authentication_method=\"NtLmSsp\") OR (authentication_type=\"\
9\" AND authentication_method=\"seclogo\")\n\n| eval start_time=timestamp, end_time=timestamp,\
\ entities=mvappend(dest_device_id, dest_user_id), body=create_map([\"event_id\"\
, event_id, \"authentication_type\", authentication_type, \"authentication_method\"\
, authentication_method]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Lateral Movement
dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml
Vendored
+15 -56
View File
@@ -1,28 +1,6 @@
author: Ignacio Bermudez Corrales, Splunk
datamodel: []
date: 2020-7-13
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This search looks for executions of cmd.exe spawned by a process that
is often abused by attackers and that does not typically launch cmd.exe. This is
a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe`
@@ -33,26 +11,10 @@ id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
known_false_positives: There are circumstances where an application may legitimately
execute and interact with the Windows command-line interface. Investigate and modify
the lookup file, as appropriate.
mappings:
cis20:
- CIS 8
kill_chain_phases:
- Exploitation
mitre_attack:
- T1059
nist:
- PR.PT
- DE.CM
name: Detect Prohibited Applications Spawning cmd exe
product:
- Splunk Behavioral Analytics
references: []
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 56
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Potential malicious landing to the console via unexpected programs that
called cmd.exe. Operation is performed at the device $dest_device_id$, by the account
$dest_user_id$ where parent process $parent_process$ spwaned $process_name$.
@@ -91,24 +53,21 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
| eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null)
| where process_name="cmd.exe" | rex field=parent_process "(?<field0>[^\\\\]+)$"
| where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe"
OR field0="visio.exe" OR field0="mspub.exe" OR field0="acrobat.exe" OR field0="acrord32.exe"
OR field0="chrome.exe" OR field0="iexplore.exe" OR field0="opera.exe" OR field0="firefox.exe"
OR field0="java.exe" OR field0="powershell.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name,
"parent_process_name", parent_process]) | into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)) \n| eval process_name=ucast(map_get(input_event,\
\ \"process_name\"), \"string\", null), parent_process=lower(ucast(map_get(input_event,\
\ \"parent_process_name\"), \"string\", null)), dest_user_id=ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null), event_id=ucast(map_get(input_event, \"\
event_id\"), \"string\", null)\n\n| where process_name=\"cmd.exe\" \n| rex field=parent_process\
\ \"(?<field0>[^\\\\\\\\]+)$\" \n| where field0=\"winword.exe\" OR field0=\"excel.exe\"\
\ OR field0=\"outlook.exe\" OR field0=\"powerpnt.exe\" OR field0=\"visio.exe\" OR\
\ field0=\"mspub.exe\" OR field0=\"acrobat.exe\" OR field0=\"acrord32.exe\" OR field0=\"\
chrome.exe\" OR field0=\"iexplore.exe\" OR field0=\"opera.exe\" OR field0=\"firefox.exe\"\
\ OR field0=\"java.exe\" OR field0=\"powershell.exe\"\n\n| eval start_time=timestamp,\
\ end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map([\"\
event_id\", event_id, \"process_name\", process_name, \"parent_process_name\",\
\ parent_process]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Suspicious Command-Line Executions
dist/ssa/detections/disable_net_user_account.yml
Vendored
+13 -46
View File
@@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-21'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This analytic will identify a suspicious command-line that disables a
user account using the `net.exe` utility native to Windows. This technique may used
by the adversaries to interrupt availability of such users to do their malicious
@@ -36,23 +14,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
id: ba858b08-d26c-11eb-af9b-acde48001122
known_false_positives: network operator may use this approach to quickly disable an
account but not a common practice.
mappings:
cis20:
- CIS 4
- CIS 16
kill_chain_phases:
- Exploitation
mitre_attack:
- T1489
nist:
- PR.AC
- PR.IP
name: Disable Net User Account
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
risk: []
savedsearch_annotations:
analytic_story:
- XMRig
@@ -67,18 +33,19 @@ savedsearch_annotations:
nist:
- PR.AC
- PR.IP
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\
), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\
), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\
), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%/active:no%\") AND\
\ (process_name=\"net1.exe\" OR process_name=\"net.exe\") \n| eval start_time=timestamp,\
\ end_time=timestamp, entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\
, process_name, \"parent_process_name\", parent_process_name, \"process_path\",\
\ process_path]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- XMRig
dist/ssa/detections/first_time_seen_command_line_argument.yml
Vendored
+20 -61
View File
@@ -1,28 +1,6 @@
author: Ignacio Bermudez Corrales, Splunk
datamodel: []
date: 2021-2-1
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This search looks for command-line arguments that use a `/c` parameter
to execute a command that has not previously been seen. This is an implementation
on SPL2 of the rule `First time seen command line argument` by @bpatel.
@@ -33,32 +11,10 @@ known_false_positives: Legitimate programs can also use command-line arguments t
execute. Please verify the command-line arguments to check what command/program
is being executed. We recommend customizing the `first_time_seen_cmd_line_filter`
macro to exclude legitimate parent_process_name
mappings:
cis20:
- CIS 3
- CIS 8
kill_chain_phases:
- Command and Control
- Actions on Objectives
mitre_attack:
- T1059
- T1117
- T1202
nist:
- PR.PT
- DE.CM
- PR.IP
name: First time seen command line argument
product:
- Splunk Behavioral Analytics
references: []
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 30
- risk_object_field: dest_user_id
risk_object_type: user
risk_score: 30
risk_message: A cmd process $process_name$ with commandline $cmd_line$ try to execute
command has not previously seen in host $dest_device_id$
savedsearch_annotations:
@@ -92,23 +48,26 @@ savedsearch_annotations:
role:
- Victim
type: user
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
"string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line),
cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/,
"GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/,
"\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext"
*/ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
/* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm,
/\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) |
where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.*
\/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id,
dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)) \n| eval dest_user_id=ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null), process_name=ucast(map_get(input_event,\
\ \"process_name\"), \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), cmd_line_norm=lower(cmd_line), cmd_line_norm=replace(cmd_line_norm,\
\ /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/, \"\
GUID\"), cmd_line_norm=replace(cmd_line_norm, /(?<=\\s)+\\\\[^:]*(?=\\\\.*\\.\\\
w{3}(\\s\n|$)+)/, \"\\\\PATH\"), /* replaces \" \\\\Something\\\\Something\\\\command.ext\"\
\ => \"PATH\\\\command.ext\" */ cmd_line_norm=replace(cmd_line_norm, /\\w:\\\\[^:]*(?=\\\
\\.*\\.\\w{3}(\\s\n|$)+)/, \"\\\\PATH\"), /* replaces \"C:\\\\Something\\\\Something\\\
\\command.ext\" => \"PATH\\\\command.ext\" */ cmd_line_norm=replace(cmd_line_norm,\
\ /\\d+/, \"N\"), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where process_name=\"cmd.exe\" AND match_regex(ucast(cmd_line, \"string\"\
, \"\"), /.* \\/[cC] .*/)=true \n| select process_name, cmd_line, cmd_line_norm,\
\ timestamp, dest_device_id, dest_user_id \n| first_time_event input_columns=[\"\
cmd_line_norm\"] \n| where first_time_cmd_line_norm \n| eval start_time = timestamp,\
\ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map([\"\
event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name]) \n\
| into write_ssa_detected_events();"
tags:
analytic_story:
- Unusual Processes
dist/ssa/detections/grant_permission_using_cacls_utility.yml
Vendored
+13 -52
View File
@@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-14'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This analytic identifies potential adversaries that modify the security
permission of a specific file or directory. This technique is commonly seen in APT
tradecraft, ransomware and coinminer scripts to evade detections and restrict access
@@ -35,29 +13,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
id: c6da561a-cd29-11eb-ae65-acde48001122
known_false_positives: network administrator may use this windows utility but this
is not a common practice.
mappings:
cis20:
- CIS 14
- CIS 16
kill_chain_phases:
- Exploitation
mitre_attack:
- T1222
nist:
- PR.AC
- PR.IP
name: Grant Permission Using Cacls Utility
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 35
- risk_object_field: dest_user_id
risk_object_type: user
risk_score: 35
risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to grant
user a permission to a file or directory in host $dest_device_id$
savedsearch_annotations:
@@ -87,18 +47,19 @@ savedsearch_annotations:
role:
- Victim
type: user
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\
\ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\
\ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true\
\ AND (process_name=\"cacls.exe\" OR process_name=\"xcacls.exe\" OR process_name=\"\
icacls.exe\") \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\
\ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\
\ \"process_path\", process_path]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- XMRig
dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml
Vendored
+11 -56
View File
@@ -1,28 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies access to PowerSploit modules that enable illegaly
access user content, such as key logging, audio recording, screenshots, tapping
into http and RDP sessions, etc.
@@ -30,31 +8,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: 01fc7d91-eb0c-478e-8633-e4fa4904463a
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1021
- T1113
- T1123
- T1563
nist:
- PR.AC
- PR.IP
name: Illegal Access To User Content via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 85
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is tapping into user content - microphone, camera,
ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
@@ -95,20 +53,17 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR
match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true
OR match_regex(cmd_line, /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line,
/(?i)Get-WebConfig/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-HttpStatus/)=true\
\ OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true\
\ OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true OR match_regex(cmd_line,\
\ /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line, /(?i)Get-WebConfig/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Malicious PowerShell
dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml
Vendored
+8 -50
View File
@@ -1,56 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies access to PowerSploit modules that create accounts
illegaly.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 20fba62a-fa5b-46cc-b39f-473fa248fee2
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1585
nist:
- PR.AC
- PR.IP
name: Illegal Account Creation via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 80
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is creating illegal domain accounts. Operation is
performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
@@ -87,17 +48,14 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)New-DomainUser/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)New-DomainUser/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Persistence Techniques
dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml
Vendored
+9 -50
View File
@@ -1,56 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies access to PowerSploit modules that delete event
logs.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 4ddb3b0d-f95f-4ae2-b4e8-663296453a7b
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1070
nist:
- PR.AC
- PR.IP
name: Illegal Deletion of Logs via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 50
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Mimikatz malware is deleting event logs to cover tracks of malicious
activity. Operation is performed at the device $dest_device_id$, by the account
$dest_user_id$ via command $cmd_line$
@@ -87,17 +48,15 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)event::drop/)=true\
\ OR match_regex(cmd_line, /(?i)event::clear/)=true )\n\n| eval start_time = timestamp,\
\ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\
\ into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Log Manipulation
dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
Vendored
+9 -52
View File
@@ -1,57 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of DSInternals modules that enable or disable
accounts illegaly.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 3e0f9962-9989-445f-878c-939443326b63
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1078
- T1098
nist:
- PR.AC
- PR.IP
name: Illegal Enabling or Disabling of Accounts via DSInternals modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/MichaelGrafnetter/DSInternals
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 80
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: DSInternals malware is illegally enabling or disabling accounts. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
@@ -89,18 +49,15 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Disable-ADDBAccount/)=true\
\ OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true )\n\n| eval start_time\
\ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\
\ \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Persistence Techniques
dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
Vendored
+10 -54
View File
@@ -1,59 +1,18 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of DSInternals modules for illegal management
of Active Directoty elements and policies.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: a587ca9f-c138-47b4-ba51-699f319b8cc5
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1098
- T1207
- T1484
nist:
- PR.AC
- PR.IP
name: Illegal Management of Active Directory Elements and Policies via DSInternals
modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/MichaelGrafnetter/DSInternals
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 90
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: DSInternals malware is controlling infrastructure by modifying Active
Directory elements, domain controllers, and policies. Operation is performed at
the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
@@ -92,19 +51,16 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true
OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line,
/(?i)Set-LsaPolicyInformation/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Remove-ADDBObject/)=true\
\ OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true OR match_regex(cmd_line,\
\ /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, /(?i)Set-LsaPolicyInformation/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Persistence Techniques
dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
Vendored
+10 -55
View File
@@ -1,59 +1,18 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies access to PowerSploit modules that enable illegal
management of computers and Active Directory elements.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 75760c11-7d48-4968-b828-013b299e8f6d
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1098
- T1207
- T1484
nist:
- PR.AC
- PR.IP
name: Illegal Management of Computers and Active Directory Elements via PowerSploit
modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 90
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is controlling infrastructure by modifying Active
Directory elements or local Master Boot Records. Operation is performed at the device
$dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
@@ -92,20 +51,16 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR
match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line,
/(?i)Set-MasterBootRecord/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainObject/)=true\
\ OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true\
\ OR match_regex(cmd_line, /(?i)Set-MasterBootRecord/)=true )\n\n\n| eval start_time\
\ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\
\ \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Persistence Techniques
dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
Vendored
+11 -54
View File
@@ -1,28 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies access to PowerSploit modules that illegaly
elevate general privileges or ensure persistence, e.g., enable manipulation of registry,
task scheduling, persistent WMI, access to OS objects under desired identities.
@@ -30,30 +8,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: 88c10ee9-fe72-4bce-b343-5b129044b991
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1053
- T1134
- T1548
nist:
- PR.AC
- PR.IP
name: Illegal Privilege Elevation and Persistence via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 90
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is planting attack persistence elements, altering
privileges and access controls. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
@@ -95,19 +54,17 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true
OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true
OR match_regex(cmd_line, /(?i)New-UserPersistenceOption/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-DomainObjectAcl/)=true\
\ OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true\
\ OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true OR match_regex(cmd_line,\
\ /(?i)New-UserPersistenceOption/)=true )\n\n| eval start_time = timestamp, end_time\
\ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\
\ into write_ssa_detected_events();"
tags:
analytic_story:
- Malicious PowerShell
dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml
Vendored
+9 -52
View File
@@ -1,57 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of Mimikatz modules for illegal privilege
elevation.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 2f873b1f-6352-4844-b7b9-b419f09a42c7
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1134
- T1548
nist:
- PR.AC
- PR.IP
name: Illegal Privilege Elevation via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 90
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Mimikatz malware is setting highest privileges to malicious entities.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
@@ -90,18 +50,15 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)privilege::debug/)=true\
\ OR match_regex(cmd_line, /(?i)token::elevate/)=true )\n\n| eval start_time = timestamp,\
\ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\
\ into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Privilege Escalation
dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml
Vendored
+12 -55
View File
@@ -1,58 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of Mimikatz modules for illegal control
over services and processes, including the authentication service.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: aaf3adf1-73e1-4477-b4ee-3771898964f1
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1055
- T1106
- T1569
nist:
- PR.AC
- PR.IP
name: Illegal Service and Process Control via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 90
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Mimikatz malware is controlling computer's processess and services.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
@@ -91,20 +50,18 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line,
/(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line,
/(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true
OR match_regex(cmd_line, /(?i)misc::memssp/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::start/)=true\
\ OR match_regex(cmd_line, /(?i)service::\\+/)=true OR match_regex(cmd_line, /(?i)service::\\\
-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line,\
\ /(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true\
\ OR match_regex(cmd_line, /(?i)misc::memssp/)=true )\n\n| eval start_time = timestamp,\
\ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\
\ into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Service Abuse
dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml
Vendored
+17 -62
View File
@@ -1,28 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-09'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies access to PowerSploit modules that enable illegal
control of services and processes, such as installing or spoofing of malicious services,
injecting malicious code in DLLs and EXEs, invoking shell code and WMI commands,
@@ -31,30 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: 0e910e5b-309d-4bc3-8af2-0030c02aa353
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1055
- T1106
- T1569
nist:
- PR.AC
- PR.IP
name: Illegal Service and Process Control via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 90
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is controlling computer's processess and services.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
@@ -94,27 +53,23 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true
OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line,
/(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true
OR match_regex(cmd_line, /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line,
/(?i)Invoke-ReflectivePEInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true
OR match_regex(cmd_line, /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line,
/(?i)Invoke-Shellcode/)=true OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true
OR match_regex(cmd_line, /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line,
/(?i)Write-HijackDll/)=true OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Install-SSP/)=true\
\ OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true OR match_regex(cmd_line,\
\ /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Restore-ServiceBinary/)=true\
\ OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true OR match_regex(cmd_line,\
\ /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line, /(?i)Invoke-ReflectivePEInjection/)=true\
\ OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true OR match_regex(cmd_line,\
\ /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line, /(?i)Invoke-Shellcode/)=true\
\ OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true OR match_regex(cmd_line,\
\ /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line, /(?i)Write-HijackDll/)=true\
\ OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true )\n\n\n| eval start_time\
\ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\
\ \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Service Abuse
dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml
Vendored
+14 -47
View File
@@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-15'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This analytic identifies suspicious modification of ACL permission to
a files or folder to make it available to everyone or to a specific user. This technique
may be used by the adversary to evade ACLs or protected files access. This changes
@@ -37,23 +15,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
id: 9ae9a48a-cdbe-11eb-875a-acde48001122
known_false_positives: network administrator may use this windows utility. filter
is needed.
mappings:
kill_chain_phases:
- Exploitation
mitre_attack:
- T1222
name: Modify ACLs Permission Of Files Or Folders
product:
- Splunk Behavioral Analytics
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 35
- risk_object_field: dest_user_id
risk_object_type: user
risk_score: 35
risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to modify
a permission of a file or directory in host $dest_device_id$
savedsearch_annotations:
@@ -77,19 +43,20 @@ savedsearch_annotations:
role:
- Victim
type: user
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line,
/(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe"
OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\
\ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\
\ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%/G%\") AND (match_regex(cmd_line,\
\ /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name=\"\
cacls.exe\" OR process_name=\"xcacls.exe\" OR process_name=\"icacls.exe\") \n| eval\
\ start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\
\ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\
\ \"process_path\", process_path]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- XMRig
dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
Vendored
+39 -73
View File
@@ -1,28 +1,6 @@
author: Ignacio Bermudez Corrales, Splunk
datamodel: []
date: '2020-08-25'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: Attacker activity may compromise executing several LOLBAS applications
in conjunction to accomplish their objectives. We are looking for more than usual
LOLBAS applications over a window of time, by building profiles per machine.
@@ -33,28 +11,11 @@ known_false_positives: 'Some administrative tasks may involve multiple use of LO
beginning when it hasn''t collected yet enough data to construct the baseline.
'
mappings:
cis20:
- CIS 8
kill_chain_phases:
- Exploitation
mitre_attack:
- T1059
- T1053
nist:
- PR.PT
- DE.CM
name: More than usual number of LOLBAS applications in short time period
product:
- Splunk Behavioral Analytics
references:
- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 25
- threat_object_field: process_name
threat_object_type: processname
risk_message: A system process $process_name$ with commandline $cmd_line$ spawn iin
short period of time in host $dest_device_id$
savedsearch_annotations:
@@ -84,40 +45,45 @@ savedsearch_annotations:
role:
- Others
type: processname
search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event,
"process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe"
OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe"
OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe"
OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe"
OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe"
OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe"
OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe"
OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe"
OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe"
OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe"
OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe"
OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe"
OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe"
OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe"
OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe"
OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe"
OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe"
OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe"
OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe"
OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe"
OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR
process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe"
OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe"
OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe"
OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe"
OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by
device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end
as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device"
window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start,
end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter",
lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();'
search: " \n| from read_ssa_enriched_events() \n| eval device=ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null), process_name=lower(ucast(map_get(input_event,\
\ \"process_name\"), \"string\", null)), timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)) \n| where process_name==\"regsvcs.exe\" OR process_name==\"\
ftp.exe\" OR process_name==\"dfsvc.exe\" OR process_name==\"rasautou.exe\" OR process_name==\"\
schtasks.exe\" OR process_name==\"xwizard.exe\" OR process_name==\"findstr.exe\"\
\ OR process_name==\"esentutl.exe\" OR process_name==\"cscript.exe\" OR process_name==\"\
reg.exe\" OR process_name==\"csc.exe\" OR process_name==\"atbroker.exe\" OR process_name==\"\
print.exe\" OR process_name==\"pcwrun.exe\" OR process_name==\"vbc.exe\" OR process_name==\"\
rpcping.exe\" OR process_name==\"wsreset.exe\" OR process_name==\"ilasm.exe\" OR\
\ process_name==\"certutil.exe\" OR process_name==\"replace.exe\" OR process_name==\"\
mshta.exe\" OR process_name==\"bitsadmin.exe\" OR process_name==\"wscript.exe\"\
\ OR process_name==\"ieexec.exe\" OR process_name==\"cmd.exe\" OR process_name==\"\
microsoft.workflow.compiler.exe\" OR process_name==\"runscripthelper.exe\" OR process_name==\"\
makecab.exe\" OR process_name==\"forfiles.exe\" OR process_name==\"desktopimgdownldr.exe\"\
\ OR process_name==\"control.exe\" OR process_name==\"msbuild.exe\" OR process_name==\"\
register-cimprovider.exe\" OR process_name==\"tttracer.exe\" OR process_name==\"\
ie4uinit.exe\" OR process_name==\"sc.exe\" OR process_name==\"bash.exe\" OR process_name==\"\
hh.exe\" OR process_name==\"cmstp.exe\" OR process_name==\"mmc.exe\" OR process_name==\"\
jsc.exe\" OR process_name==\"scriptrunner.exe\" OR process_name==\"odbcconf.exe\"\
\ OR process_name==\"extexport.exe\" OR process_name==\"msdt.exe\" OR process_name==\"\
diskshadow.exe\" OR process_name==\"extrac32.exe\" OR process_name==\"eventvwr.exe\"\
\ OR process_name==\"mavinject.exe\" OR process_name==\"regasm.exe\" OR process_name==\"\
gpscript.exe\" OR process_name==\"rundll32.exe\" OR process_name==\"regsvr32.exe\"\
\ OR process_name==\"regedit.exe\" OR process_name==\"msiexec.exe\" OR process_name==\"\
gfxdownloadwrapper.exe\" OR process_name==\"presentationhost.exe\" OR process_name==\"\
regini.exe\" OR process_name==\"wmic.exe\" OR process_name==\"runonce.exe\" OR process_name==\"\
syncappvpublishingserver.exe\" OR process_name==\"verclsid.exe\" OR process_name==\"\
psr.exe\" OR process_name==\"infdefaultinstall.exe\" OR process_name==\"explorer.exe\"\
\ OR process_name==\"expand.exe\" OR process_name==\"installutil.exe\" OR process_name==\"\
netsh.exe\" OR process_name==\"wab.exe\" OR process_name==\"dnscmd.exe\" OR process_name==\"\
at.exe\" OR process_name==\"pcalua.exe\" OR process_name==\"cmdkey.exe\" OR process_name==\"\
msconfig.exe\" \n| stats count(process_name) as lolbas_counter by device,span(timestamp,\
\ 300s) \n| eval lolbas_counter=lolbas_counter*1.0 \n| rename window_end as timestamp\
\ \n| adaptive_threshold algorithm=\"quantile\" value=\"lolbas_counter\" entity=\"\
device\" window=2419200000L \n| where label AND quantile>0.99 \n| eval start_time\
\ = window_start, end_time = timestamp, entities = mvappend(device), body=create_map([\"\
lolbas_counter\", lolbas_counter, \"quantile\", quantile, \"device\", device]) \n\
| into write_ssa_detected_events();"
tags:
analytic_story:
- Unusual Processes
dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml
Vendored
+25 -53
View File
@@ -1,28 +1,6 @@
author: Xiao Lin, Splunk
datamodel: []
date: '2020-08-25'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: Malicious mails can conduct phishing that induces readers to open attachment,
click links or trigger third party service. This detect uses Natural Language Processing
(NLP) approach to analyze an email message's content (Sender, Subject and Body)
@@ -42,21 +20,10 @@ id: 4b237388-dfa1-41a6-91d4-4de2d598376f
known_false_positives: Because of imbalance of anomaly data in training, the model
will less likely report false positive. Instead, the model is more prone to false
negative. Current best recall score is ~85%
mappings:
cis20:
- CIS 8
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1566
nist:
- PR.PT
- DE.CM
name: Phishing Email Detection by Machine Learning Method - SSA
product:
- Splunk Behavioral Analytics
references: []
risk: []
savedsearch_annotations:
cis20:
- CIS 8
@@ -67,26 +34,31 @@ savedsearch_annotations:
nist:
- PR.PT
- DE.CM
search: '| from read_ssa_enriched_events() | eval eventLine=concat(ucast(map_get(input_event,
"From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", "
"), " ", ucast(map_get(input_event, "Content"), "string", " "), " "),
_time=map_get(input_event, "_time") | where eventLine IS NOT NULL | eval mapC={"
": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40,
")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49,
"2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58,
";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67,
"D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76,
"M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85,
"V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94,
"_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g":
103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o":
111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w":
119, "x": 120, "y": 121, "z": 122, "{": 123, "|": 124, "}": 125, "~": 126}, ml_in
= for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i,
1)), "float") ) | apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v8"
path="s3://smle-experiments/models/phishing_email" | eval probability = mvindex(ml_out,
0) | where probability > 0.5 | eval start_time=_time, end_time=_time, entities="TBD",
body="TBD" | select probability, body, entities, start_time, end_time | into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval eventLine=concat(ucast(map_get(input_event,\
\ \"From\"), \"string\", \" \"), \" \", ucast(map_get(input_event, \"Subject\"),\
\ \"string\", \" \"), \" \", ucast(map_get(input_event, \"Content\"), \"string\"\
, \" \"), \" \
\ \"), _time=map_get(input_event,\
\ \"_time\") \n| where eventLine IS NOT NULL \n| eval mapC={\" \": 32, \"!\": 33,\
\ \"\\\"\": 34, \"#\": 35, \"$\": 36, \"%\": 37, \"&\": 38, \"`\": 39, \"(\": 40,\
\ \")\": 41, \"*\": 42, \"+\": 43, \",\": 44, \"-\": 45, \".\": 46, \"/\": 47, \"\
0\": 48, \"1\": 49, \"2\": 50, \"3\": 51, \"4\": 52, \"5\": 53, \"6\": 54, \"7\"\
: 55, \"8\": 56, \"9\": 57, \":\": 58, \";\": 59, \"<\": 60, \"=\": 61, \">\": 62,\
\ \"?\": 63, \"@\": 64, \"A\": 65, \"B\": 66, \"C\": 67, \"D\": 68, \"E\": 69, \"\
F\": 70, \"G\": 71, \"H\": 72, \"I\": 73, \"J\": 74, \"K\": 75, \"L\": 76, \"M\"\
: 77, \"N\": 78, \"O\": 79, \"P\": 80, \"Q\": 81, \"R\": 82, \"S\": 83, \"T\": 84,\
\ \"U\": 85, \"V\": 86, \"W\": 87, \"X\": 88, \"Y\": 89, \"Z\": 90, \"[\": 91, \"\
\\\\\": 92, \"]\": 93, \"^\": 94, \"_\": 95, \"`\": 96, \"a\": 97, \"b\": 98, \"\
c\": 99, \"d\": 100, \"e\": 101, \"f\": 102, \"g\": 103, \"h\": 104, \"i\": 105,\
\ \"j\": 106, \"k\": 107, \"l\": 108, \"m\": 109, \"n\": 110, \"o\": 111, \"p\"\
: 112, \"q\": 113, \"r\": 114, \"s\": 115, \"t\": 116, \"u\": 117, \"v\": 118, \"\
w\": 119, \"x\": 120, \"y\": 121, \"z\": 122, \"{\": 123, \"\n|\": 124, \"}\": 125,\
\ \"~\": 126}, ml_in = for_each(iterator(mvrange(1,129), \"i\"), cast(map_get(mapC,\
\ substr(eventLine, i, 1)), \"float\") ) \n| apply_model connection_id=\"YOUR_S3_ONNX_CONNECTOR_ID\"\
\ name=\"phishing_email_v8\" path=\"s3://smle-experiments/models/phishing_email\"\
\ \n| eval probability = mvindex(ml_out, 0) \n| where probability > 0.5 \n| eval\
\ start_time=_time, end_time=_time, entities=\"TBD\", body=\"TBD\" \n| select probability,\
\ body, entities, start_time, end_time \n| into write_ssa_detected_events();"
tags:
cis20:
- CIS 8
dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
Vendored
+21 -65
View File
@@ -1,28 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2021-09-01'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies potential Pass the Token or Pass the Hash credential
exploits. We detect the main side effect of these attacks, which is a transition
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
@@ -32,26 +10,11 @@ how_to_implement: You must be ingesting Windows Security logs from endpoint devi
id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
known_false_positives: Environments in which NTLM is used extremely rarely and for
benign purposes (such as a rare use of SMB shares).
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Lateral Movement
mitre_attack:
- T1550
- T1550.002
nist:
- PR.PT
- PR.AT
- PR.AC
- PR.IP
name: Potential Pass the Token or Hash Observed at the Destination Device
product:
- Splunk Behavioral Analytics
references:
- https://attack.mitre.org/techniques/T1550/002/
risk: []
risk_message: Potential lateral movement and credential stealing via Pass the Token
or Pass the Hash techniques. Operation is performed via credentials of the account
$dest_user_id$ and observed by the destination device $dest_device_id$
@@ -87,34 +50,27 @@ savedsearch_annotations:
role:
- Other
type: Hostname
search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event,
"_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
"string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"),
"string", null)), dest_device_id= lower(ucast(map_get(input_event, "dest_device_id"),
"string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"),
"string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
"string", null))
| where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
AND dest_user_id != null AND dest_device_id != null
| eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
== "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
| stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as
startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as
endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s)
| where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
| eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime,
"long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["total_kerberos",
totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp= parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), dest_user= lower(ucast(map_get(input_event,\
\ \"dest_user_primary_artifact\"), \"string\", null)), dest_user_id= lower(ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null)), dest_device_id= lower(ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), signature_id= lower(ucast(map_get(input_event,\
\ \"signature_id\"), \"string\", null)), authentication_method= lower(ucast(map_get(input_event,\
\ \"authentication_method\"), \"string\", null))\n\n| where signature_id = \"4624\"\
\ AND (authentication_method=\"ntlmssp\" OR authentication_method=\"kerberos\")\
\ AND dest_user_id != null AND dest_device_id != null\n\n| eval isKerberos=if(authentication_method\
\ == \"kerberos\", 1, 0), isNtlm=if(authentication_method == \"ntlmssp\", 1, 0),\
\ timeNTLM=if(isNtlm > 0, timestamp, null)\n\n| stats sum(isKerberos) as totalKerberos,\
\ sum(isNtlm) as totalNtlm, min(timestamp) as startTime, min(timeNTLM) as\
\ startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as endNTLMTime by dest_user_id,\
\ dest_user, dest_device_id, span(timestamp, 86400s)\n\n| where NOT dest_user=\"\
-\" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - startTime > 1800000 AND\
\ (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND (endTime - startTime)\
\ > 3 * (endNTLMTime - startNTLMTime)\n\n| eval start_time=ucast(startNTLMTime,\
\ \"long\", null), end_time=ucast(endNTLMTime, \"long\", null), entities=mvappend(dest_user_id,\
\ dest_device_id), body=create_map([\"total_kerberos\", totalKerberos, \"total_ntlm\"\
, totalNtlm, \"analysis_start_time\", startTime, \"analysis_end_time\", endTime,\
\ \"pth_start_time\", startNTLMTime, \"pth_end_time\", endNTLMTime])\n\n| into write_ssa_detected_events();"
tags:
analytic_story:
- Lateral Movement
dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
Vendored
+21 -65
View File
@@ -1,28 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2021-09-01'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies potential Pass the Token or Pass the Hash credential
exploits. We detect the main side effect of these attacks, which is a transition
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
@@ -34,26 +12,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87
known_false_positives: Environments in which NTLM is used extremely rarely and for
benign purposes (such as a rare use of SMB shares).
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Lateral Movement
mitre_attack:
- T1550
- T1550.002
nist:
- PR.PT
- PR.AT
- PR.AC
- PR.IP
name: Potential Pass the Token or Hash Observed by an Event Collecting Device
product:
- Splunk Behavioral Analytics
references:
- https://attack.mitre.org/techniques/T1550/002/
risk: []
risk_message: Potential lateral movement and credential stealing via Pass the Token
or Pass the Hash techniques. Operation is performed via credentials of the account
$dest_user_id$ and observed by the logging device $origin_device_id$
@@ -89,34 +52,27 @@ savedsearch_annotations:
role:
- Other
type: Hostname
search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event,
"_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
"string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"),
"string", null)), origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"),
"string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"),
"string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
"string", null))
| where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
AND dest_user_id != null AND origin_device_id != null
| eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
== "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
| stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as
startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as
endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s)
| where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
| eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id,
origin_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm",
totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time",
startNTLMTime, "detection_end_time", endNTLMTime])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp= parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), dest_user= lower(ucast(map_get(input_event,\
\ \"dest_user_primary_artifact\"), \"string\", null)), dest_user_id= lower(ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null)), origin_device_id= lower(ucast(map_get(input_event,\
\ \"origin_device_id\"), \"string\", null)), signature_id= lower(ucast(map_get(input_event,\
\ \"signature_id\"), \"string\", null)), authentication_method= lower(ucast(map_get(input_event,\
\ \"authentication_method\"), \"string\", null))\n\n| where signature_id = \"4624\"\
\ AND (authentication_method=\"ntlmssp\" OR authentication_method=\"kerberos\")\
\ AND dest_user_id != null AND origin_device_id != null\n\n| eval isKerberos=if(authentication_method\
\ == \"kerberos\", 1, 0), isNtlm=if(authentication_method == \"ntlmssp\", 1, 0),\
\ timeNTLM=if(isNtlm > 0, timestamp, null)\n\n| stats sum(isKerberos) as totalKerberos,\
\ sum(isNtlm) as totalNtlm, min(timestamp) as startTime, min(timeNTLM) as\
\ startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as endNTLMTime by dest_user_id,\
\ dest_user, origin_device_id, span(timestamp, 86400s)\n\n| where NOT dest_user=\"\
-\" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - startTime > 1800000 AND\
\ (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND (endTime - startTime)\
\ > 3 * (endNTLMTime - startNTLMTime)\n\n| eval start_time=startNTLMTime, end_time=endNTLMTime,\
\ entities=mvappend(dest_user_id, origin_device_id), body=create_map([\"total_kerberos\"\
, totalKerberos, \"total_ntlm\", totalNtlm, \"analysis_start_time\", startTime,\
\ \"analysis_end_time\", endTime, \"detection_start_time\", startNTLMTime, \"detection_end_time\"\
, endNTLMTime])\n\n| into write_ssa_detected_events();"
tags:
analytic_story:
- Lateral Movement
dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml
Vendored
+10 -52
View File
@@ -1,57 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-04'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of PowerSploit modules that facilitate
access probing with admin credentials as well as probing access to system services.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: d405af5d-99f1-45af-8dfb-b8f98b764247
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1078
- T1098
nist:
- PR.AC
- PR.IP
name: Probing Access with Stolen Credentials via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 60
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is probing access with stolen credentials. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
@@ -89,18 +49,16 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true
OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-AdminAccess/)=true\
\ OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true OR match_regex(cmd_line,\
\ /(?i)Test-ServiceDaclPermission/)=true )\n\n| eval start_time = timestamp, end_time\
\ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\
| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Privilege Escalation
dist/ssa/detections/rare_parent-child_process_relationship.yml
Vendored
+46 -77
View File
@@ -1,28 +1,6 @@
author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
datamodel: []
date: '2021-05-20'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: An attacker may use LOLBAS tools spawned from vulnerable applications
not typically used by system administrators. This search leverages the Splunk Streaming
ML DSP plugin to find rare parent/child relationships. The list of application has
@@ -34,24 +12,10 @@ known_false_positives: 'Some custom tools used by admins could be used rarely to
it hasn''t collected yet enough data to construct the baseline.
'
mappings:
cis20:
- CIS 8
kill_chain_phases:
- Exploitation
mitre_attack:
- T1203
- T1059
- T1053
- T1072
nist:
- PR.PT
- DE.CM
name: Rare Parent-Child Process Relationship
product:
- Splunk Behavioral Analytics
references: []
risk: []
savedsearch_annotations:
analytic_story:
- Unusual Processes
@@ -67,47 +31,52 @@ savedsearch_annotations:
nist:
- PR.PT
- DE.CM
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event,
"parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process,
"\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event,
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where parent_process_name!=null | select parent_process_name, process_name, cmd_line,
timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name"
target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe"
OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe"
OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe"
OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe"
OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe"
OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe"
OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe"
OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe"
OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe"
OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe"
OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe"
OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe"
OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe"
OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe"
OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe"
OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe"
OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe"
OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe"
OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe"
OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe"
OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR
process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe"
OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe"
OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe"
OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")
| eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001
window=604800000L | where label AND input > mean | eval start_time = timestamp,
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body =
create_map(["process_name", process_name, "parent_process_name", parent_process_name,
"input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
cmd_line]) | into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)) \n| eval parent_process=lower(ucast(map_get(input_event,\
\ \"parent_process_name\"), \"string\", null)), parent_process_name=mvindex(split(parent_process,\
\ \"\\\\\"), -1), process_name=lower(ucast(map_get(input_event, \"process_name\"\
), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\
, null), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\",\
\ null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\", null) \n\
| where parent_process_name!=null \n| select parent_process_name, process_name,\
\ cmd_line, timestamp, dest_device_id, dest_user_id \n| conditional_anomaly conditional=\"\
parent_process_name\" target=\"process_name\" \n| where (process_name=\"powershell.exe\"\
\ OR process_name=\"regsvcs.exe\" OR process_name=\"ftp.exe\" OR process_name=\"\
dfsvc.exe\" OR process_name=\"rasautou.exe\" OR process_name=\"schtasks.exe\" OR\
\ process_name=\"xwizard.exe\" OR process_name=\"findstr.exe\" OR process_name=\"\
esentutl.exe\" OR process_name=\"cscript.exe\" OR process_name=\"reg.exe\" OR process_name=\"\
csc.exe\" OR process_name=\"atbroker.exe\" OR process_name=\"print.exe\" OR process_name=\"\
pcwrun.exe\" OR process_name=\"vbc.exe\" OR process_name=\"rpcping.exe\" OR process_name=\"\
wsreset.exe\" OR process_name=\"ilasm.exe\" OR process_name=\"certutil.exe\" OR\
\ process_name=\"replace.exe\" OR process_name=\"mshta.exe\" OR process_name=\"\
bitsadmin.exe\" OR process_name=\"wscript.exe\" OR process_name=\"ieexec.exe\" OR\
\ process_name=\"cmd.exe\" OR process_name=\"microsoft.workflow.compiler.exe\" OR\
\ process_name=\"runscripthelper.exe\" OR process_name=\"makecab.exe\" OR process_name=\"\
forfiles.exe\" OR process_name=\"desktopimgdownldr.exe\" OR process_name=\"control.exe\"\
\ OR process_name=\"msbuild.exe\" OR process_name=\"register-cimprovider.exe\" OR\
\ process_name=\"tttracer.exe\" OR process_name=\"ie4uinit.exe\" OR process_name=\"\
sc.exe\" OR process_name=\"bash.exe\" OR process_name=\"hh.exe\" OR process_name=\"\
cmstp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"jsc.exe\" OR process_name=\"\
scriptrunner.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"extexport.exe\"\
\ OR process_name=\"msdt.exe\" OR process_name=\"diskshadow.exe\" OR process_name=\"\
extrac32.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"mavinject.exe\"\
\ OR process_name=\"regasm.exe\" OR process_name=\"gpscript.exe\" OR process_name=\"\
rundll32.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"regedit.exe\"\
\ OR process_name=\"msiexec.exe\" OR process_name=\"gfxdownloadwrapper.exe\" OR\
\ process_name=\"presentationhost.exe\" OR process_name=\"regini.exe\" OR process_name=\"\
wmic.exe\" OR process_name=\"runonce.exe\" OR process_name=\"syncappvpublishingserver.exe\"\
\ OR process_name=\"verclsid.exe\" OR process_name=\"psr.exe\" OR process_name=\"\
infdefaultinstall.exe\" OR process_name=\"explorer.exe\" OR process_name=\"expand.exe\"\
\ OR process_name=\"installutil.exe\" OR process_name=\"netsh.exe\" OR process_name=\"\
wab.exe\" OR process_name=\"dnscmd.exe\" OR process_name=\"at.exe\" OR process_name=\"\
pcalua.exe\" OR process_name=\"cmdkey.exe\" OR process_name=\"msconfig.exe\") \n\
| eval input = (-1)*log(output) \n| adaptive_threshold algorithm=\"gaussian\" threshold=0.001\
\ window=604800000L \n| where label AND input > mean \n| eval start_time = timestamp,\
\ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body\
\ = create_map([\"process_name\", process_name, \"parent_process_name\", parent_process_name,\
\ \"input\", input, \"mean\", mean, \"variance\", variance, \"output\", output,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Unusual Processes
dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
Vendored
+9 -52
View File
@@ -1,58 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-05'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of Mimikatz modules for discovery of accounts
and groups and access to them.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 1bce67aa-3fc4-4886-9089-67f0bfebbef6
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1078
- T1087
- T1484
nist:
- PR.AC
- PR.IP
name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 80
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Mimikatz malware is searching for and using specific accounts and groups.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
@@ -92,17 +51,15 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::user/)=true\
\ OR match_regex(cmd_line, /(?i)net::group/)=true )\n\n| eval start_time = timestamp,\
\ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\
| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
Vendored
+30 -74
View File
@@ -1,58 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-05'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies access to PowerSploit modules that discover
accounts, groups and policies that can be accessed or taken over.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 63422f8e-766c-468f-8133-2ba6795e263b
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1078
- T1087
- T1484
nist:
- PR.AC
- PR.IP
name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 80
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is searching for and using specific accounts, groups
and policies, such as the last logged on account, a local Net group, etc. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
@@ -93,39 +52,36 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true
OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line,
/(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true
OR match_regex(cmd_line, /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line,
/(?i)Get-DomainForeignGroupMember/)=true OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true
OR match_regex(cmd_line, /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line,
/(?i)Find-ForeignUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true
OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true
OR match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line,
/(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true
OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line,
/(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true
OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true
OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line,
/(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true
OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true
OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true
OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line,
/(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true
OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line,
/(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true
OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line,
/(?i)Get-LastLoggedOn/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainLocalGroupMember/)=true\
\ OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true OR match_regex(cmd_line,\
\ /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, /(?i)Invoke-EventHunter/)=true\
\ OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true OR match_regex(cmd_line,\
\ /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line, /(?i)Get-DomainForeignGroupMember/)=true\
\ OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true OR match_regex(cmd_line,\
\ /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line, /(?i)Find-ForeignUser/)=true\
\ OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true\
\ OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true OR\
\ match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line,\
\ /(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true\
\ OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line,\
\ /(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true\
\ OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true\
\ OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line,\
\ /(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true\
\ OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true\
\ OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true\
\ OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line,\
\ /(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true\
\ OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line,\
\ /(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true\
\ OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line,\
\ /(?i)Get-LastLoggedOn/)=true )\n\n| eval start_time = timestamp, end_time = timestamp,\
\ entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\"\
, null), ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)), body=create_map([\"\
event_id\", event_id, \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
Vendored
+18 -63
View File
@@ -1,28 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies access to PowerSploit modules for reconnaissance
and access to elements of Active Directory infrastructure, such as domain identifiers,
AD sites and forests, and trust relations.
@@ -30,33 +8,12 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: db08ac40-ee14-43e9-9a75-dddd059ef812
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1199
- T1482
- T1590
- T1591
- T1595
nist:
- PR.AC
- PR.IP
name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit
modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 80
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is seaching for or accessing Active Directory objects
such as domain sites, domain trusts, AD forests, etc. Operation is performed at
the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
@@ -98,26 +55,24 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR
match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true
OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true
OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line,
/(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true
OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true
OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-NetForestDomain/)=true
OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true OR match_regex(cmd_line,
/(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line, /(?i)Get-ForestTrust/)=true
OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainSID/)=true\
\ OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR match_regex(cmd_line, /(?i)Get-NetSite/)=true\
\ OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true OR match_regex(cmd_line,\
\ /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true\
\ OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line,\
\ /(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true\
\ OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true\
\ OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line,\
\ /(?i)Get-NetForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true\
\ OR match_regex(cmd_line, /(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line,\
\ /(?i)Get-ForestTrust/)=true OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
Vendored
+13 -57
View File
@@ -1,58 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies access to PowerSploit modules that discover
computers, servers and domains that can be accessed or taken over.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: fe1c4c5a-09f3-4b43-8129-560a7f38a08b
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1592
- T1590
- T1087
nist:
- PR.AC
- PR.IP
name: Reconnaissance and Access to Computers and Domains via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 80
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is seaching for or accessing domain controllers,
computers, file servers, etc. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
@@ -92,22 +51,19 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR
match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true
OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true
OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line,
/(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ComputerDetail/)=true\
\ OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR match_regex(cmd_line, /(?i)Get-NetDomain/)=true\
\ OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true OR match_regex(cmd_line,\
\ /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true\
\ OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line,\
\ /(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
Vendored
+8 -50
View File
@@ -1,56 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of Mimikatz modules for discovery of computers
and servers and access to them.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 48664505-7d22-44ee-87d2-4c8a5bdc3d14
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1592
nist:
- PR.AC
- PR.IP
name: Reconnaissance and Access to Computers via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 50
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Mimikatz malware is collecting information about computers. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
@@ -86,17 +47,14 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)net::ServerInfo/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::ServerInfo/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
Vendored
+15 -64
View File
@@ -1,28 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies access to PowerSploit modules that discover
and access operating system elements, such as processes, services, registry locations,
security packages and files.
@@ -30,36 +8,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: c1d33ad9-1727-4f9f-a474-4adbe4fed68a
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1057
- T1083
- T1592.002
- T1046
- T1012
- T1007
- T1047
- T1592
- T1518
nist:
- PR.AC
- PR.IP
name: Reconnaissance and Access to Operating System Elements via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 80
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is searching for and tapping into ongoing processes,
mounted drives or other operating system elements. Operation is performed at the
device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
@@ -105,23 +58,21 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true
OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line,
/(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR
match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true
OR match_regex(cmd_line, /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true
OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line,
/(?i)Get-RegistryMountedDrive/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainProcess/)=true\
\ OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true OR match_regex(cmd_line,\
\ /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, /(?i)Get-WMIProcess/)=true\
\ OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true\
\ OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true OR match_regex(cmd_line,\
\ /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true\
\ OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line,\
\ /(?i)Get-RegistryMountedDrive/)=true )\n\n| eval start_time = timestamp, end_time\
\ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\
| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
Vendored
+9 -52
View File
@@ -1,58 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of Mimikatz modules for discovery and access
to services and processes.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 0243d37c-57c1-4182-bfd1-39b212255fc8
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1007
- T1046
- T1057
nist:
- PR.AC
- PR.IP
name: Reconnaissance and Access to Processes and Services via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 50
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Mimikatz malware is listing processes and services. Operation is performed
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
savedsearch_annotations:
@@ -89,17 +48,15 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::list/)=true\
\ OR match_regex(cmd_line, /(?i)service::list/)=true )\n\n| eval start_time = timestamp,\
\ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\
| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
Vendored
+8 -53
View File
@@ -1,59 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of Mimikatz modules for discovery and access
to network shares.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: c97b6eb9-1d8b-4017-bbbb-2af7fc17bc3f
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1021
- T1039
- T1135
- T1021.002
nist:
- PR.AC
- PR.IP
name: Reconnaissance and Access to Shared Resources via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 70
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Mimikatz malware is searching for and accessing network shares. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
@@ -94,17 +52,14 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)net::share/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::share/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
Vendored
+13 -57
View File
@@ -1,59 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies access to PowerSploit modules that discover
and access network and distributed file system shares.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 6b7ca431-6b1e-4b40-9589-21cb368e369e
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1021
- T1039
- T1135
- T1021.002
nist:
- PR.AC
- PR.IP
name: Reconnaissance and Access to Shared Resources via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 70
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is searching for and accessing network shares. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
@@ -94,21 +52,19 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true
OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line,
/(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true
OR match_regex(cmd_line, /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line,
/(?i)Get-DFSshare/)=true OR match_regex(cmd_line, /(?i)Get-NetShare/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainShare/)=true\
\ OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true OR match_regex(cmd_line,\
\ /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, /(?i)Invoke-FileFinder/)=true\
\ OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true OR match_regex(cmd_line,\
\ /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line, /(?i)Get-DFSshare/)=true\
\ OR match_regex(cmd_line, /(?i)Get-NetShare/)=true )\n\n| eval start_time = timestamp,\
\ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\
| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
Vendored
+18 -65
View File
@@ -1,28 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-05'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of PowerSploit modules that discover opportunities
for malicious access and persistence. Some examples include access to admin accounts,
weak access control policies, landing paths for dropping malicious software or data
@@ -32,33 +10,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: 3d8bd7f3-1061-4ac7-9225-6764cc0684d7
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1053
- T1068
- T1078
- T1543
- T1547
- T1574
nist:
- PR.AC
- PR.IP
name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 60
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is searching for an entry point into the infrastructure,
such as local admin accounts, opportunities to hijack processes, unattended install
files, or modifiable access objects. Operation is performed at the device $dest_device_id$,
@@ -100,27 +56,24 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true
OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line,
/(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true
OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line,
/(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true
OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line,
/(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true
OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line,
/(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true
OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line,
/(?i)Get-UnquotedService/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true\
\ OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line,\
\ /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true\
\ OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true OR match_regex(cmd_line,\
\ /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-ObjectAcl/)=true\
\ OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true OR match_regex(cmd_line,\
\ /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableRegistryAutoRun/)=true\
\ OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true OR match_regex(cmd_line,\
\ /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableServiceFile/)=true\
\ OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true\
\ OR match_regex(cmd_line, /(?i)Get-UnquotedService/)=true )\n\n| eval start_time\
\ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\
\ \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml
Vendored
+13 -59
View File
@@ -1,59 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-06'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies access to PowerSploit modules for reconnaissance
of connectivity.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 525d32fd-65dd-4732-9b72-3cfc7ddddbd2
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1021
- T1039
- T1135
- T1021.002
nist:
- PR.AC
- PR.IP
name: Reconnaissance of Connectivity via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 70
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is performing port scans or searching for various
connectivity details such as DNS data, proxies, or ongoing RDP connections. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
@@ -93,23 +51,19 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true
OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line,
/(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true
OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line,
/(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true
OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true
)
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainDNSRecord/)=true\
\ OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true\
\ OR match_regex(cmd_line, /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true\
\ OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line,\
\ /(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true\
\ OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
Vendored
+10 -59
View File
@@ -1,63 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies reconnaissance of credential stores and use
of CryptoAPI services by Mimikatz modules.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 5facee5b-79e4-47ab-b0e6-c625acc0554f
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1098
- T1590.001
- T1078
- T1589.001
- T1590
- T1068
- T1589
- T1590.003
nist:
- PR.AC
- PR.IP
name: Reconnaissance of Credential Stores and Services via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 80
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Mimikatz malware is searching for and accessing credential stores. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
@@ -101,19 +55,16 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line,
/(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true
OR match_regex(cmd_line, /(?i)crypto::sc/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)crypto::capi/)=true\
\ OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, /(?i)crypto::providers/)=true\
\ OR match_regex(cmd_line, /(?i)crypto::stores/)=true OR match_regex(cmd_line, /(?i)crypto::sc/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml
Vendored
+8 -53
View File
@@ -1,59 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-05'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of PowerSploit modules for assessment of
presence of defensive tools.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 24b4e659-63a2-4e7b-89ac-87dd659c7110
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1592.002
- T1595.002
- T1592
- T1595
nist:
- PR.AC
- PR.IP
name: Reconnaissance of Defensive Tools via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 40
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is looking for presence of anti virus software.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
@@ -92,17 +50,14 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Find-AVSignature/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-AVSignature/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
Vendored
+8 -52
View File
@@ -1,58 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-05'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of PowerSploit modules for assessment of
privilege escalation opportunities.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: b9b4492c-2af8-449b-beb4-b1b78d963321
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1068
- T1078
- T1098
nist:
- PR.AC
- PR.IP
name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 60
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is engaging its privilege escalation module. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
$cmd_line$
@@ -90,17 +49,14 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Invoke-PrivescAudit/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-PrivescAudit/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
Vendored
+8 -52
View File
@@ -1,28 +1,6 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-05'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies use of Mimikatz modules for discovery of process
or service hijacking opportunities via Microsoft Detours compatibility. Microsoft
Detours is an open source library for intercepting, monitoring and instrumenting
@@ -33,31 +11,12 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
including the event ID 4688 with enabled command line logging.
id: fc5c1cbd-7494-4314-aad2-458d6fd4fada
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1543
- T1055
- T1574
nist:
- PR.AC
- PR.IP
name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
- https://en.wikipedia.org/wiki/Microsoft_Detours
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 70
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Mimikatz malware is looking for and invoking Microsoft Detours package
that enables spoofing of in-memory code. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
@@ -97,17 +56,14 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)misc::detours/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::detours/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Discovery Techniques
dist/ssa/detections/resize_shadowstorage_volume.yml
Vendored
+13 -47
View File
@@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-21'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: The following analytics identifies the resizing of shadowstorage by ransomware
malware to avoid the shadow volumes being made again. this technique is an alternative
by ransomware attacker than deleting the shadowstorage which is known alert in defensive
@@ -36,24 +14,12 @@ how_to_implement: To successfully implement this search, you need to be ingestin
Sysmon TA.
id: dbc30554-d27e-11eb-9e5e-acde48001122
known_false_positives: network admin can resize the shadowstorage for valid purposes.
mappings:
cis20:
- CIS 10
- CIS 13
kill_chain_phases:
- Exploitation
mitre_attack:
- T1489
nist:
- PR.DS
- PR.IP
name: Resize Shadowstorage Volume
product:
- Splunk Behavioral Analytics
references:
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
risk: []
savedsearch_annotations:
analytic_story:
- Clop Ransomware
@@ -68,19 +34,19 @@ savedsearch_annotations:
nist:
- PR.DS
- PR.IP
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%")
AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\
), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\
), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\
), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%resize%\") AND like(cmd_line,\
\ \"%shadowstorage%\") AND like(cmd_line, \"%maxsize%\") AND process_name=\"vssadmin.exe\"\
\ \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\
\ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\
\ \"process_path\", process_path]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Clop Ransomware
dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml
Vendored
+15 -58
View File
@@ -1,58 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies illegal setting of credentials via DSInternals
modules.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: d5ef590f-9bde-49eb-9c63-2f5b62a65b9c
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1068
- T1078
- T1098
nist:
- PR.AC
- PR.IP
name: Setting Credentials via DSInternals modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/MichaelGrafnetter/DSInternals
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 80
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: DSInternals malware is accessing, using or setting Active Directory
or Azure credentials and accounts. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
@@ -92,23 +51,21 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true
OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true
OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line,
/(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true
OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), process_name=ucast(map_get(input_event, \"process_name\"\
), \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\
\ \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\
, null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true\
\ OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line,\
\ /(?i)Set-ADDBAccountPassword/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true\
\ OR match_regex(cmd_line, /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line,\
\ /(?i)Set-SamAccountPasswordHash/)=true OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Persistence Techniques
dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml
Vendored
+9 -52
View File
@@ -1,58 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies illegal setting of credentials via Mimikatz
modules.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: c8b84699-7652-4363-910f-efd1ca82f780
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1068
- T1078
- T1098
nist:
- PR.AC
- PR.IP
name: Setting Credentials via Mimikatz modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/gentilkiwi/mimikatz
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 80
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: Mimikatz malware is accessing, using or setting account credentials.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
@@ -91,17 +50,15 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::addsid/)=true\
\ OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true )\n\n| eval start_time = timestamp,\
\ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\
| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Persistence Techniques
dist/ssa/detections/setting_credentials_via_powersploit_modules.yml
Vendored
+8 -52
View File
@@ -1,58 +1,17 @@
author: Stanislav Miskovic, Splunk
datamodel: []
date: '2020-11-03'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This detection identifies illegal setting of credentials via PowerSploit
modules.
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
id: 07b2a501-f967-4ddc-9f56-2dce46dfce44
known_false_positives: None identified.
mappings:
cis20:
- CIS 16
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1068
- T1078
- T1098
nist:
- PR.AC
- PR.IP
name: Setting Credentials via PowerSploit modules
product:
- Splunk Behavioral Analytics
references:
- https://github.com/PowerShellMafia/PowerSploit
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 90
- threat_object_field: cmd_line
threat_object_type: processname
risk_message: PowerSploit malware is setting passwords on Active Directory accounts.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
@@ -91,17 +50,14 @@ savedsearch_annotations:
role:
- Others
type: processname
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
/(?i)Set-DomainUserPassword/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainUserPassword/)=true\
\ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\
\ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\
\ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Persistence Techniques
dist/ssa/detections/system_process_running_from_unexpected_location.yml
Vendored
+243 -256
View File
@@ -1,28 +1,6 @@
author: Ignacio Bermudez Corrales, Splunk
datamodel: []
date: '2020-08-25'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: An attacker tries might try to use different version of a system command
without overriding original, or they might try to avoid some detection running the
process from a different folder. This detection checks that a list of system processes
@@ -32,27 +10,10 @@ description: An attacker tries might try to use different version of a system co
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
id: 28179107-099a-464a-94d3-08301e6c055f
known_false_positives: None
mappings:
cis20:
- CIS 8
kill_chain_phases:
- Actions on Objectives
mitre_attack:
- T1036
nist:
- PR.PT
- DE.CM
name: System Process Running from Unexpected Location
product:
- Splunk Behavioral Analytics
references: []
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 56
- risk_object_field: dest_user_id
risk_object_type: user
risk_score: 56
risk_message: A system process $process_name$ with commandline $cmd_line$ spawn in
non-default folder path in host $dest_device_id$
savedsearch_annotations:
@@ -82,223 +43,249 @@ savedsearch_annotations:
role:
- Victim
type: user
search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
$cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe"
OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe"
OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe"
OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe"
OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe"
OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe"
OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe"
OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe"
OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe"
OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR
process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR
process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe"
OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR
process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe"
OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe"
OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR
process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe"
OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe"
OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe"
OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe"
OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe"
OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe"
OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe"
OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe"
OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe"
OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR
process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe"
OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe"
OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe"
OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe"
OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe"
OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe"
OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe"
OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe"
OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe"
OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe"
OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe";
$cond_2 = | from $ssa_input | where process_name="openwith.exe" OR process_name="optionalfeatures.exe"
OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe"
OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe"
OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe"
OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe"
OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR
process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe"
OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR
process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe"
OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe"
OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe"
OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe"
OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe"
OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe"
OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR
process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe"
OR process_name="settingsynchost.exe" OR process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe"
OR process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe"
OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe"
OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe"
OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe"
OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe"
OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe"
OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe"
OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe"
OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe"
OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe"
OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe"
OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe"
OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR
process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR
process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe"
OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe"
OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe"
OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe"
OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe"
OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe"
OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe"
OR process_name="windowsanytimeupgraderesults.exe";
$cond_3 = | from $ssa_input | where process_name="windowsanytimeupgradeui.exe" OR
process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe"
OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe"
OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe"
OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe"
OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe"
OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe"
OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe"
OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe"
OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe"
OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe"
OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe"
OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe"
OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe"
OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe"
OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe"
OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe"
OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe"
OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe"
OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe"
OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe"
OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe"
OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe"
OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe"
OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe"
OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe"
OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe"
OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe"
OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe"
OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe"
OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe"
OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe"
OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe"
OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe"
OR process_name="easinvoker.exe" OR process_name="efsui.exe";
$cond_4 = | from $ssa_input | where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe"
OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe"
OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe"
OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe"
OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe"
OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe"
OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe"
OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe"
OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe"
OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe"
OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe"
OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe"
OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe"
OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe"
OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe"
OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe"
OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe"
OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe"
OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe"
OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe"
OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe"
OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe"
OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe"
OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe"
OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe"
OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe"
OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe"
OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe"
OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe"
OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe"
OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe"
OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe"
OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe"
OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe";
$cond_5 = | from $ssa_input | where process_name="openfiles.exe" OR process_name="osk.exe"
OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe"
OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe"
OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe"
OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe"
OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe"
OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe"
OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe"
OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe"
OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe"
OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe"
OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe"
OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe"
OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe"
OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe"
OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe"
OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe"
OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe"
OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe"
OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe"
OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe"
OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe"
OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe"
OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe"
OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe"
OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe"
OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe"
OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe"
OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe"
OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe"
OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe"
OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe"
OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe"
OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe";
$cond_6 = | from $ssa_input | where process_name="tracerpt.exe" OR process_name="tscon.exe"
OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe"
OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe"
OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe"
OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe"
OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe"
OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe"
OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe"
OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe"
OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe"
OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe"
OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe"
OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe"
OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe"
OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe"
OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe"
OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe"
OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe"
OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe"
OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";
| from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
search: " $ssa_input = \n| from read_ssa_enriched_events() \n| eval device=ucast(map_get(input_event,\
\ \"dest_device_id\"), \"string\", null), user=ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), timestamp=parse_long(ucast(map_get(input_event, \"_time\"\
), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\
), \"string\", null)), process_path=lower(ucast(map_get(input_event, \"process_path\"\
), \"string\", null)), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null);\n$cond_1 = \n| from $ssa_input \n| where process_name=\"arp.exe\" OR process_name=\"\
adaptertroubleshooter.exe\" OR process_name=\"applicationframehost.exe\" OR process_name=\"\
atbroker.exe\" OR process_name=\"authhost.exe\" OR process_name=\"autoworkplace.exe\"\
\ OR process_name=\"axinstui.exe\" OR process_name=\"backgroundtransferhost.exe\"\
\ OR process_name=\"bdehdcfg.exe\" OR process_name=\"bdeuisrv.exe\" OR process_name=\"\
bdeunlockwizard.exe\" OR process_name=\"bitlockerdeviceencryption.exe\" OR process_name=\"\
bitlockerwizard.exe\" OR process_name=\"bitlockerwizardelev.exe\" OR process_name=\"\
bytecodegenerator.exe\" OR process_name=\"camerasettingsuihost.exe\" OR process_name=\"\
castsrv.exe\" OR process_name=\"certenrollctrl.exe\" OR process_name=\"checknetisolation.exe\"\
\ OR process_name=\"clipup.exe\" OR process_name=\"cloudexperiencehostbroker.exe\"\
\ OR process_name=\"cloudnotifications.exe\" OR process_name=\"cloudstoragewizard.exe\"\
\ OR process_name=\"compmgmtlauncher.exe\" OR process_name=\"compattelrunner.exe\"\
\ OR process_name=\"computerdefaults.exe\" OR process_name=\"credentialuibroker.exe\"\
\ OR process_name=\"dfdwiz.exe\" OR process_name=\"dwwin.exe\" OR process_name=\"\
dataexchangehost.exe\" OR process_name=\"defrag.exe\" OR process_name=\"devicedisplayobjectprovider.exe\"\
\ OR process_name=\"deviceeject.exe\" OR process_name=\"deviceenroller.exe\" OR\
\ process_name=\"devicepairingwizard.exe\" OR process_name=\"deviceproperties.exe\"\
\ OR process_name=\"disksnapshot.exe\" OR process_name=\"dism.exe\" OR process_name=\"\
displayswitch.exe\" OR process_name=\"dmnotificationbroker.exe\" OR process_name=\"\
dmomacpmo.exe\" OR process_name=\"dpiscaling.exe\" OR process_name=\"dsmusertask.exe\"\
\ OR process_name=\"dxpserver.exe\" OR process_name=\"edpcleanup.exe\" OR process_name=\"\
eosnotify.exe\" OR process_name=\"eap3host.exe\" OR process_name=\"easpoliciesbrokerhost.exe\"\
\ OR process_name=\"easeofaccessdialog.exe\" OR process_name=\"ehstorauthn.exe\"\
\ OR process_name=\"fxscover.exe\" OR process_name=\"fxssvc.exe\" OR process_name=\"\
fxsunatd.exe\" OR process_name=\"filehistory.exe\" OR process_name=\"fondue.exe\"\
\ OR process_name=\"gamepanel.exe\" OR process_name=\"genvalobj.exe\" OR process_name=\"\
gettingstarted.exe\" OR process_name=\"hostname.exe\" OR process_name=\"icsentitlementhost.exe\"\
\ OR process_name=\"infdefaultinstall.exe\" OR process_name=\"installagent.exe\"\
\ OR process_name=\"languagecomponentsinstallercomhandler.exe\" OR process_name=\"\
launchtm.exe\" OR process_name=\"launchwinapp.exe\" OR process_name=\"legacynetuxhost.exe\"\
\ OR process_name=\"licensemanagershellext.exe\" OR process_name=\"licensingui.exe\"\
\ OR process_name=\"locationnotificationwindows.exe\" OR process_name=\"locationnotifications.exe\"\
\ OR process_name=\"locator.exe\" OR process_name=\"lockapphost.exe\" OR process_name=\"\
lockscreencontentserver.exe\" OR process_name=\"logonui.exe\" OR process_name=\"\
lsaiso.exe\" OR process_name=\"mdeserver.exe\" OR process_name=\"mdmagent.exe\"\
\ OR process_name=\"mdmappinstaller.exe\" OR process_name=\"mrinfo.exe\" OR process_name=\"\
mrt.exe\" OR process_name=\"mschedexe.exe\" OR process_name=\"magnify.exe\" OR process_name=\"\
mbaeparsertask.exe\" OR process_name=\"mdres.exe\" OR process_name=\"mdsched.exe\"\
\ OR process_name=\"migautoplay.exe\" OR process_name=\"mpsigstub.exe\" OR process_name=\"\
msspellcheckinghost.exe\" OR process_name=\"muiunattend.exe\" OR process_name=\"\
multidigimon.exe\" OR process_name=\"musnotification.exe\" OR process_name=\"musnotificationux.exe\"\
\ OR process_name=\"napstat.exe\" OR process_name=\"netstat.exe\" OR process_name=\"\
narrator.exe\" OR process_name=\"netcfgnotifyobjecthost.exe\" OR process_name=\"\
netevtfwdr.exe\" OR process_name=\"netproj.exe\" OR process_name=\"netplwiz.exe\"\
\ OR process_name=\"networkuxbroker.exe\";\n$cond_2 = \n| from $ssa_input \n| where\
\ process_name=\"openwith.exe\" OR process_name=\"optionalfeatures.exe\" OR process_name=\"\
pathping.exe\" OR process_name=\"ping.exe\" OR process_name=\"passwordonwakesettingflyout.exe\"\
\ OR process_name=\"pickerhost.exe\" OR process_name=\"pkgmgr.exe\" OR process_name=\"\
pnpunattend.exe\" OR process_name=\"pnputil.exe\" OR process_name=\"presentationhost.exe\"\
\ OR process_name=\"presentationsettings.exe\" OR process_name=\"printbrmui.exe\"\
\ OR process_name=\"printdialoghost.exe\" OR process_name=\"printdialoghost3d.exe\"\
\ OR process_name=\"printisolationhost.exe\" OR process_name=\"proximityuxhost.exe\"\
\ OR process_name=\"rdspnf.exe\" OR process_name=\"rmactivate.exe\" OR process_name=\"\
rmactivate_isv.exe\" OR process_name=\"rmactivate_ssp.exe\" OR process_name=\"rmactivate_ssp_isv.exe\"\
\ OR process_name=\"route.exe\" OR process_name=\"rdpsa.exe\" OR process_name=\"\
rdpsaproxy.exe\" OR process_name=\"rdpsauachelper.exe\" OR process_name=\"reagentc.exe\"\
\ OR process_name=\"recoverydrive.exe\" OR process_name=\"register-cimprovider.exe\"\
\ OR process_name=\"registeriepkeys.exe\" OR process_name=\"relpost.exe\" OR process_name=\"\
remoteposworker.exe\" OR process_name=\"rmclient.exe\" OR process_name=\"robocopy.exe\"\
\ OR process_name=\"rpcping.exe\" OR process_name=\"runlegacycplelevated.exe\" OR\
\ process_name=\"runtimebroker.exe\" OR process_name=\"sihclient.exe\" OR process_name=\"\
searchfilterhost.exe\" OR process_name=\"searchindexer.exe\" OR process_name=\"\
searchprotocolhost.exe\" OR process_name=\"secedit.exe\" OR process_name=\"sensordataservice.exe\"\
\ OR process_name=\"setieinstalleddate.exe\" OR process_name=\"settingsynchost.exe\"\
\ OR process_name=\"slidetoshutdown.exe\" OR process_name=\"smartscreensettings.exe\"\
\ OR process_name=\"sndvol.exe\" OR process_name=\"snippingtool.exe\" OR process_name=\"\
soundrecorder.exe\" OR process_name=\"spaceagent.exe\" OR process_name=\"sppextcomobj.exe\"\
\ OR process_name=\"srtasks.exe\" OR process_name=\"stikynot.exe\" OR process_name=\"\
synchost.exe\" OR process_name=\"sysreseterr.exe\" OR process_name=\"systempropertiesadvanced.exe\"\
\ OR process_name=\"systempropertiescomputername.exe\" OR process_name=\"systempropertiesdataexecutionprevention.exe\"\
\ OR process_name=\"systempropertieshardware.exe\" OR process_name=\"systempropertiesperformance.exe\"\
\ OR process_name=\"systempropertiesprotection.exe\" OR process_name=\"systempropertiesremote.exe\"\
\ OR process_name=\"systemsettingsadminflows.exe\" OR process_name=\"systemsettingsbroker.exe\"\
\ OR process_name=\"systemsettingsremovedevice.exe\" OR process_name=\"tcpsvcs.exe\"\
\ OR process_name=\"tracert.exe\" OR process_name=\"tstheme.exe\" OR process_name=\"\
tswbprxy.exe\" OR process_name=\"tapiunattend.exe\" OR process_name=\"taskmgr.exe\"\
\ OR process_name=\"thumbnailextractionhost.exe\" OR process_name=\"tokenbrokercookies.exe\"\
\ OR process_name=\"tpminit.exe\" OR process_name=\"tswpfwrp.exe\" OR process_name=\"\
ui0detect.exe\" OR process_name=\"upgraderesultsui.exe\" OR process_name=\"useraccountbroker.exe\"\
\ OR process_name=\"useraccountcontrolsettings.exe\" OR process_name=\"usoclient.exe\"\
\ OR process_name=\"utilman.exe\" OR process_name=\"vssvc.exe\" OR process_name=\"\
vaultcmd.exe\" OR process_name=\"vaultsysui.exe\" OR process_name=\"wfs.exe\" OR\
\ process_name=\"wmpdmc.exe\" OR process_name=\"wpdshextautoplay.exe\" OR process_name=\"\
wscollect.exe\" OR process_name=\"wsmanhttpconfig.exe\" OR process_name=\"wsreset.exe\"\
\ OR process_name=\"wudfhost.exe\" OR process_name=\"wwahost.exe\" OR process_name=\"\
wallpaperhost.exe\" OR process_name=\"webcache.exe\" OR process_name=\"werfault.exe\"\
\ OR process_name=\"werfaultsecure.exe\" OR process_name=\"winsat.exe\" OR process_name=\"\
windows.media.backgroundplayback.exe\" OR process_name=\"windowsactiondialog.exe\"\
\ OR process_name=\"windowsanytimeupgrade.exe\" OR process_name=\"windowsanytimeupgraderesults.exe\"\
;\n$cond_3 = \n| from $ssa_input \n| where process_name=\"windowsanytimeupgradeui.exe\"\
\ OR process_name=\"windowsupdateelevatedinstaller.exe\" OR process_name=\"workfolders.exe\"\
\ OR process_name=\"wpcmon.exe\" OR process_name=\"acu.exe\" OR process_name=\"\
aitagent.exe\" OR process_name=\"aitstatic.exe\" OR process_name=\"alg.exe\" OR\
\ process_name=\"appidcertstorecheck.exe\" OR process_name=\"appidpolicyconverter.exe\"\
\ OR process_name=\"at.exe\" OR process_name=\"attrib.exe\" OR process_name=\"audiodg.exe\"\
\ OR process_name=\"auditpol.exe\" OR process_name=\"autochk.exe\" OR process_name=\"\
autoconv.exe\" OR process_name=\"autofmt.exe\" OR process_name=\"baaupdate.exe\"\
\ OR process_name=\"backgroundtaskhost.exe\" OR process_name=\"bcastdvr.exe\" OR\
\ process_name=\"bcdboot.exe\" OR process_name=\"bcdedit.exe\" OR process_name=\"\
bdechangepin.exe\" OR process_name=\"bdeunlock.exe\" OR process_name=\"bitsadmin.exe\"\
\ OR process_name=\"bootcfg.exe\" OR process_name=\"bootim.exe\" OR process_name=\"\
bootsect.exe\" OR process_name=\"bridgeunattend.exe\" OR process_name=\"browser_broker.exe\"\
\ OR process_name=\"bthudtask.exe\" OR process_name=\"cacls.exe\" OR process_name=\"\
calc.exe\" OR process_name=\"cdpreference.exe\" OR process_name=\"certreq.exe\"\
\ OR process_name=\"certutil.exe\" OR process_name=\"change.exe\" OR process_name=\"\
changepk.exe\" OR process_name=\"charmap.exe\" OR process_name=\"chglogon.exe\"\
\ OR process_name=\"chgport.exe\" OR process_name=\"chgusr.exe\" OR process_name=\"\
chkdsk.exe\" OR process_name=\"chkntfs.exe\" OR process_name=\"choice.exe\" OR process_name=\"\
cipher.exe\" OR process_name=\"cleanmgr.exe\" OR process_name=\"cliconfg.exe\" OR\
\ process_name=\"clip.exe\" OR process_name=\"cmd.exe\" OR process_name=\"cmdkey.exe\"\
\ OR process_name=\"cmdl32.exe\" OR process_name=\"cmmon32.exe\" OR process_name=\"\
cmstp.exe\" OR process_name=\"cofire.exe\" OR process_name=\"colorcpl.exe\" OR process_name=\"\
comp.exe\" OR process_name=\"compact.exe\" OR process_name=\"conhost.exe\" OR process_name=\"\
consent.exe\" OR process_name=\"control.exe\" OR process_name=\"convert.exe\" OR\
\ process_name=\"credwiz.exe\" OR process_name=\"cscript.exe\" OR process_name=\"\
csrss.exe\" OR process_name=\"ctfmon.exe\" OR process_name=\"cttune.exe\" OR process_name=\"\
cttunesvr.exe\" OR process_name=\"dashost.exe\" OR process_name=\"dccw.exe\" OR\
\ process_name=\"dcomcnfg.exe\" OR process_name=\"ddodiag.exe\" OR process_name=\"\
dfrgui.exe\" OR process_name=\"dialer.exe\" OR process_name=\"diantz.exe\" OR process_name=\"\
dinotify.exe\" OR process_name=\"diskpart.exe\" OR process_name=\"diskperf.exe\"\
\ OR process_name=\"diskraid.exe\" OR process_name=\"dispdiag.exe\" OR process_name=\"\
djoin.exe\" OR process_name=\"dllhost.exe\" OR process_name=\"dllhst3g.exe\" OR\
\ process_name=\"dmcertinst.exe\" OR process_name=\"dmcfghost.exe\" OR process_name=\"\
dmclient.exe\" OR process_name=\"dnscacheugc.exe\" OR process_name=\"doskey.exe\"\
\ OR process_name=\"dpapimig.exe\" OR process_name=\"dpnsvr.exe\" OR process_name=\"\
driverquery.exe\" OR process_name=\"drvcfg.exe\" OR process_name=\"drvinst.exe\"\
\ OR process_name=\"dsregcmd.exe\" OR process_name=\"dstokenclean.exe\" OR process_name=\"\
dvdplay.exe\" OR process_name=\"dvdupgrd.exe\" OR process_name=\"dwm.exe\" OR process_name=\"\
dxdiag.exe\" OR process_name=\"easinvoker.exe\" OR process_name=\"efsui.exe\";\n\
$cond_4 = \n| from $ssa_input \n| where process_name=\"embeddedapplauncher.exe\"\
\ OR process_name=\"esentutl.exe\" OR process_name=\"eudcedit.exe\" OR process_name=\"\
eventcreate.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"expand.exe\"\
\ OR process_name=\"extrac32.exe\" OR process_name=\"fc.exe\" OR process_name=\"\
fhmanagew.exe\" OR process_name=\"find.exe\" OR process_name=\"findstr.exe\" OR\
\ process_name=\"finger.exe\" OR process_name=\"fixmapi.exe\" OR process_name=\"\
fltmc.exe\" OR process_name=\"fodhelper.exe\" OR process_name=\"fontdrvhost.exe\"\
\ OR process_name=\"fontview.exe\" OR process_name=\"forfiles.exe\" OR process_name=\"\
fsavailux.exe\" OR process_name=\"fsquirt.exe\" OR process_name=\"fsutil.exe\" OR\
\ process_name=\"ftp.exe\" OR process_name=\"fvenotify.exe\" OR process_name=\"\
fveprompt.exe\" OR process_name=\"getmac.exe\" OR process_name=\"gpresult.exe\"\
\ OR process_name=\"gpscript.exe\" OR process_name=\"gpupdate.exe\" OR process_name=\"\
grpconv.exe\" OR process_name=\"hdwwiz.exe\" OR process_name=\"help.exe\" OR process_name=\"\
hwrcomp.exe\" OR process_name=\"hwrreg.exe\" OR process_name=\"icacls.exe\" OR process_name=\"\
icardagt.exe\" OR process_name=\"icsunattend.exe\" OR process_name=\"ie4uinit.exe\"\
\ OR process_name=\"ieunatt.exe\" OR process_name=\"ieetwcollector.exe\" OR process_name=\"\
iexpress.exe\" OR process_name=\"immersivetpmvscmgrsvr.exe\" OR process_name=\"\
ipconfig.exe\" OR process_name=\"irftp.exe\" OR process_name=\"iscsicli.exe\" OR\
\ process_name=\"iscsicpl.exe\" OR process_name=\"isoburn.exe\" OR process_name=\"\
klist.exe\" OR process_name=\"ksetup.exe\" OR process_name=\"ktmutil.exe\" OR process_name=\"\
label.exe\" OR process_name=\"licensingdiag.exe\" OR process_name=\"lodctr.exe\"\
\ OR process_name=\"logagent.exe\" OR process_name=\"logman.exe\" OR process_name=\"\
logoff.exe\" OR process_name=\"lpkinstall.exe\" OR process_name=\"lpksetup.exe\"\
\ OR process_name=\"lpremove.exe\" OR process_name=\"lsass.exe\" OR process_name=\"\
lsm.exe\" OR process_name=\"makecab.exe\" OR process_name=\"manage-bde.exe\" OR\
\ process_name=\"mblctr.exe\" OR process_name=\"mcbuilder.exe\" OR process_name=\"\
mctadmin.exe\" OR process_name=\"mfpmp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"\
mobsync.exe\" OR process_name=\"mountvol.exe\" OR process_name=\"mpnotify.exe\"\
\ OR process_name=\"msconfig.exe\" OR process_name=\"msdt.exe\" OR process_name=\"\
msdtc.exe\" OR process_name=\"msfeedssync.exe\" OR process_name=\"msg.exe\" OR process_name=\"\
mshta.exe\" OR process_name=\"msiexec.exe\" OR process_name=\"msinfo32.exe\" OR\
\ process_name=\"mspaint.exe\" OR process_name=\"msra.exe\" OR process_name=\"mstsc.exe\"\
\ OR process_name=\"mtstocom.exe\" OR process_name=\"nbtstat.exe\" OR process_name=\"\
ndadmin.exe\" OR process_name=\"net.exe\" OR process_name=\"net1.exe\" OR process_name=\"\
netbtugc.exe\" OR process_name=\"netcfg.exe\" OR process_name=\"netiougc.exe\" OR\
\ process_name=\"netsh.exe\" OR process_name=\"newdev.exe\" OR process_name=\"nltest.exe\"\
\ OR process_name=\"notepad.exe\" OR process_name=\"nslookup.exe\" OR process_name=\"\
ntoskrnl.exe\" OR process_name=\"ntprint.exe\" OR process_name=\"ocsetup.exe\" OR\
\ process_name=\"odbcad32.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"\
omadmclient.exe\" OR process_name=\"omadmprc.exe\";\n$cond_5 = \n| from $ssa_input\
\ \n| where process_name=\"openfiles.exe\" OR process_name=\"osk.exe\" OR process_name=\"\
p2phost.exe\" OR process_name=\"pcalua.exe\" OR process_name=\"pcaui.exe\" OR process_name=\"\
pcawrk.exe\" OR process_name=\"pcwrun.exe\" OR process_name=\"perfmon.exe\" OR process_name=\"\
phoneactivate.exe\" OR process_name=\"plasrv.exe\" OR process_name=\"poqexec.exe\"\
\ OR process_name=\"powercfg.exe\" OR process_name=\"prevhost.exe\" OR process_name=\"\
print.exe\" OR process_name=\"printfilterpipelinesvc.exe\" OR process_name=\"printui.exe\"\
\ OR process_name=\"proquota.exe\" OR process_name=\"provtool.exe\" OR process_name=\"\
psr.exe\" OR process_name=\"pwlauncher.exe\" OR process_name=\"qappsrv.exe\" OR\
\ process_name=\"qprocess.exe\" OR process_name=\"query.exe\" OR process_name=\"\
quser.exe\" OR process_name=\"qwinsta.exe\" OR process_name=\"rasautou.exe\" OR\
\ process_name=\"rasdial.exe\" OR process_name=\"raserver.exe\" OR process_name=\"\
rasphone.exe\" OR process_name=\"rdpclip.exe\" OR process_name=\"rdpinput.exe\"\
\ OR process_name=\"rdrleakdiag.exe\" OR process_name=\"recdisc.exe\" OR process_name=\"\
recover.exe\" OR process_name=\"reg.exe\" OR process_name=\"regedt32.exe\" OR process_name=\"\
regini.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"rekeywiz.exe\" OR\
\ process_name=\"relog.exe\" OR process_name=\"repair-bde.exe\" OR process_name=\"\
replace.exe\" OR process_name=\"reset.exe\" OR process_name=\"resmon.exe\" OR process_name=\"\
rmttpmvscmgrsvr.exe\" OR process_name=\"rrinstaller.exe\" OR process_name=\"rstrui.exe\"\
\ OR process_name=\"runas.exe\" OR process_name=\"rundll32.exe\" OR process_name=\"\
runonce.exe\" OR process_name=\"rwinsta.exe\" OR process_name=\"sbunattend.exe\"\
\ OR process_name=\"sc.exe\" OR process_name=\"schtasks.exe\" OR process_name=\"\
sdbinst.exe\" OR process_name=\"sdchange.exe\" OR process_name=\"sdclt.exe\" OR\
\ process_name=\"sdiagnhost.exe\" OR process_name=\"secinit.exe\" OR process_name=\"\
services.exe\" OR process_name=\"sessionmsg.exe\" OR process_name=\"sethc.exe\"\
\ OR process_name=\"setspn.exe\" OR process_name=\"setupcl.exe\" OR process_name=\"\
setupugc.exe\" OR process_name=\"setx.exe\" OR process_name=\"sfc.exe\" OR process_name=\"\
shadow.exe\" OR process_name=\"shrpubw.exe\" OR process_name=\"shutdown.exe\" OR\
\ process_name=\"sigverif.exe\" OR process_name=\"sihost.exe\" OR process_name=\"\
slui.exe\" OR process_name=\"smss.exe\" OR process_name=\"snmptrap.exe\" OR process_name=\"\
sort.exe\" OR process_name=\"spinstall.exe\" OR process_name=\"spoolsv.exe\" OR\
\ process_name=\"sppsvc.exe\" OR process_name=\"spreview.exe\" OR process_name=\"\
srdelayed.exe\" OR process_name=\"subst.exe\" OR process_name=\"svchost.exe\" OR\
\ process_name=\"sxstrace.exe\" OR process_name=\"syskey.exe\" OR process_name=\"\
systeminfo.exe\" OR process_name=\"systemreset.exe\" OR process_name=\"systray.exe\"\
\ OR process_name=\"tabcal.exe\" OR process_name=\"takeown.exe\" OR process_name=\"\
taskeng.exe\" OR process_name=\"taskhost.exe\" OR process_name=\"taskhostw.exe\"\
\ OR process_name=\"taskkill.exe\" OR process_name=\"tasklist.exe\" OR process_name=\"\
taskmgr.exe\" OR process_name=\"tcmsetup.exe\" OR process_name=\"timeout.exe\" OR\
\ process_name=\"tpmvscmgr.exe\" OR process_name=\"tpmvscmgrsvr.exe\";\n$cond_6\
\ = \n| from $ssa_input \n| where process_name=\"tracerpt.exe\" OR process_name=\"\
tscon.exe\" OR process_name=\"tsdiscon.exe\" OR process_name=\"tskill.exe\" OR process_name=\"\
typeperf.exe\" OR process_name=\"tzsync.exe\" OR process_name=\"tzutil.exe\" OR\
\ process_name=\"ucsvc.exe\" OR process_name=\"unlodctr.exe\" OR process_name=\"\
unregmp2.exe\" OR process_name=\"upnpcont.exe\" OR process_name=\"userinit.exe\"\
\ OR process_name=\"vds.exe\" OR process_name=\"vdsldr.exe\" OR process_name=\"\
verclsid.exe\" OR process_name=\"verifier.exe\" OR process_name=\"verifiergui.exe\"\
\ OR process_name=\"vmicsvc.exe\" OR process_name=\"vssadmin.exe\" OR process_name=\"\
w32tm.exe\" OR process_name=\"waitfor.exe\" OR process_name=\"wbadmin.exe\" OR process_name=\"\
wbengine.exe\" OR process_name=\"wecutil.exe\" OR process_name=\"wermgr.exe\" OR\
\ process_name=\"wevtutil.exe\" OR process_name=\"wextract.exe\" OR process_name=\"\
where.exe\" OR process_name=\"whoami.exe\" OR process_name=\"wiaacmgr.exe\" OR process_name=\"\
wiawow64.exe\" OR process_name=\"wifitask.exe\" OR process_name=\"wimserv.exe\"\
\ OR process_name=\"wininit.exe\" OR process_name=\"winload.exe\" OR process_name=\"\
winlogon.exe\" OR process_name=\"winresume.exe\" OR process_name=\"winrs.exe\" OR\
\ process_name=\"winrshost.exe\" OR process_name=\"winver.exe\" OR process_name=\"\
wisptis.exe\" OR process_name=\"wkspbroker.exe\" OR process_name=\"wksprt.exe\"\
\ OR process_name=\"wlanext.exe\" OR process_name=\"wlrmdr.exe\" OR process_name=\"\
wowreg32.exe\" OR process_name=\"wpnpinst.exe\" OR process_name=\"wpr.exe\" OR process_name=\"\
write.exe\" OR process_name=\"wscript.exe\" OR process_name=\"wsmprovhost.exe\"\
\ OR process_name=\"wsqmcons.exe\" OR process_name=\"wuapihost.exe\" OR process_name=\"\
wuapp.exe\" OR process_name=\"wuauclt.exe\" OR process_name=\"wusa.exe\" OR process_name=\"\
xcopy.exe\" OR process_name=\"xpsrchvw.exe\" OR process_name=\"xwizard.exe\";\n\n\
| from $cond_1 \n| union $cond_2 \n| union $cond_3 \n| union $cond_4 \n| union $cond_5\
\ \n| union $cond_6 \n| where match_regex(process_path, /(?i)\\\\windows\\\\system32/)=false\
\ AND match_regex(process_path, /(?i)\\\\windows\\\\syswow64/)=false \n| eval start_time=timestamp,\
\ end_time=timestamp, entities=mvappend(device, user), body=create_map([\"event_id\"\
, event_id, \"process_path\", process_path, \"process_name\", process_name]) \n\
| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Defense Evasion Tactics
dist/ssa/detections/unusually_long_command_line.yml
Vendored
+17 -51
View File
@@ -1,28 +1,6 @@
author: Ignacio Bermudez Corrales, Splunk
datamodel: []
date: '2020-10-06'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: Command lines that are extremely long may be indicative of malicious
activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin
to help identify command lines with lengths that are unusual for a given user. This
@@ -36,25 +14,10 @@ known_false_positives: This detection may flag suspiciously long command lines w
for the tracked process. Also, some legitimate applications may use long command
lines. Such is the case of Ansible, that encodes Powershell scripts using long base64.
Attackers may use this technique to obfuscate their payloads.
mappings:
cis20:
- CIS 8
kill_chain_phases:
- Actions on Objectives
nist:
- PR.PT
- DE.CM
name: Unusually Long Command Line
product:
- Splunk Behavioral Analytics
references: []
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 12
- risk_object_field: dest_user_id
risk_object_type: user
risk_score: 12
risk_message: A process $process_name$ with a long commandline $cmd_line$ executed
in host $dest_device_id$
savedsearch_annotations:
@@ -81,20 +44,23 @@ savedsearch_annotations:
role:
- Victim
type: user
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval
cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm,
/\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm,
""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line,
input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
| where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
"cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id",
event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
search: " \n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)) \n| eval cmd_line=ucast(map_get(input_event, \"\
process\"), \"string\", null), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\
\ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line!=null and dest_user_id!=null \n| eval cmd_line_norm=replace(cast(cmd_line,\
\ \"string\"), /\\s(--?\\w+)\n|(\\/\\w+)/, \" ARG\"), cmd_line_norm=replace(cmd_line_norm,\
\ /\\w:\\\\[^\\s]+/, \"PATH\"), cmd_line_norm=replace(cmd_line_norm, /\\d+/, \"\
N\"), input=parse_double(len(coalesce(cmd_line_norm, \"\"))) \n| select timestamp,\
\ process_name, dest_device_id, dest_user_id, cmd_line, input \n| adaptive_threshold\
\ algorithm=\"quantile\" entity=\"process_name\" window=60480000 \n| where label\
\ AND quantile>0.99 \n| first_time_event input_columns=[\"dest_device_id\", \"cmd_line\"\
] \n| where first_time_dest_device_id_cmd_line \n| eval start_time = timestamp,\
\ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map([\"\
event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name]) \n\
| into write_ssa_detected_events();"
tags:
analytic_story:
- Unusual Processes
dist/ssa/detections/wevtutil_usage_to_clear_logs.yml
Vendored
+15 -55
View File
@@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-15'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: The wevtutil.exe application is the windows event log utility. This searches
for wevtutil.exe with parameters for clearing the application, security, setup,
powershell, sysmon, or system event logs.
@@ -35,30 +13,11 @@ how_to_implement: You must be ingesting data that records process activity from
id: 5438113c-cdd9-11eb-93b8-acde48001122
known_false_positives: The wevtutil.exe application is a legitimate Windows event
log utility. Administrators may use it to manage Windows event logs.
mappings:
cis20:
- CIS 8
- CIS 13
kill_chain_phases:
- Exploitation
mitre_attack:
- T1070
- T1070.001
nist:
- PR.DS
- PR.IP
name: WevtUtil Usage To Clear Logs
product:
- Splunk Behavioral Analytics
references:
- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 63
- risk_object_field: dest_user_id
risk_object_type: user
risk_score: 63
risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear
event logs in host $dest_device_id$
savedsearch_annotations:
@@ -91,20 +50,21 @@ savedsearch_annotations:
role:
- Victim
type: user
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line,
/(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,
/(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,
/(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\
\ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\
\ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"% cl %\") AND (match_regex(cmd_line,\
\ /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,\
\ /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,\
\ /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name=\"\
wevtutil.exe\" \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\
\ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\
), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\
\ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\
\ \"process_path\", process_path]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Log Manipulation
dist/ssa/detections/wevtutil_usage_to_disable_logs.yml
Vendored
+13 -52
View File
@@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk
datamodel:
- Endpoint
date: '2021-06-15'
deployment:
alert_action:
notable:
nes_fields:
- user
- dest
- src
rule_description: '%description%'
rule_title: '%name%'
author: Bhavin Patel
date: '2020-04-27'
description: This configuration file applies to all correlation searches that are
used for detection
id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
name: Enterprise Security deployment configuration
scheduling:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
schedule_window: auto
tags:
analytic_story: all
description: This search is to detect execution of wevtutil.exe to disable logs. This
technique was seen in several ransomware to disable the event logs to evade alerts
and detections in compromised host.
@@ -35,30 +13,11 @@ how_to_implement: You must be ingesting data that records process activity from
id: a4bdc944-cdd9-11eb-ac97-acde48001122
known_false_positives: network operator may disable audit event logs for debugging
purposes.
mappings:
cis20:
- CIS 8
- CIS 13
kill_chain_phases:
- Exploitation
mitre_attack:
- T1070
- T1070.001
nist:
- PR.DS
- PR.IP
name: Wevtutil Usage To Disable Logs
product:
- Splunk Behavioral Analytics
references:
- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
risk:
- risk_object_field: dest_device_id
risk_object_type: system
risk_score: 63
- risk_object_field: dest_user_id
risk_object_type: user
risk_score: 63
risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable
event logs in host $dest_device_id$
savedsearch_annotations:
@@ -90,17 +49,19 @@ savedsearch_annotations:
role:
- Victim
type: user
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line,
"%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\
\ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\
), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\
\ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\
\ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\
), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\
, null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"% sl %\") AND like(cmd_line,\
\ \"%/e:false%\") AND process_name=\"wevtutil.exe\" \n| eval start_time=timestamp,\
\ end_time=timestamp, entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"\
), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\
, null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\
, process_name, \"parent_process_name\", parent_process_name, \"process_path\",\
\ process_path]) \n| into write_ssa_detected_events();"
tags:
analytic_story:
- Windows Log Manipulation