From bc3209042ba4ea2fc6fc1fbc1b106ab2b19bf16d Mon Sep 17 00:00:00 2001 From: d1vious Date: Mon, 1 Nov 2021 18:55:23 -0400 Subject: [PATCH] pretty print search yaml, update ci --- .github/workflows/build-and-validate.yml | 185 +++---- bin/generate.py | 9 + ...tolen_credentials_via_mimikatz_modules.yml | 69 +-- ...en_credentials_via_powersploit_modules.yml | 73 +-- ...ntial_strength_via_dsinternals_modules.yml | 62 +-- .../detections/attempt_to_delete_services.yml | 58 +- .../attempt_to_disable_services.yml | 61 +-- ...dential_dump_from_registry_via_reg_exe.yml | 67 +-- ..._of_fgdump_and_cachedump_with_s_option.yml | 68 +-- ..._of_fgdump_and_cachedump_with_v_option.yml | 63 +-- ...cative_of_lazagne_command_line_options.yml | 57 +- ...nternals_credential_conversion_modules.yml | 73 +-- ...dicative_of_use_of_dsinternals_modules.yml | 77 +-- ..._indicative_of_use_of_mimikatz_modules.yml | 66 +-- ...dicative_of_use_of_powersploit_modules.yml | 68 +-- ...crosoft_debuggers_peek_into_the_kernel.yml | 66 +-- ...ft_debuggers_via_z_command_line_option.yml | 61 +-- ...present_in_powersploit_and_dsinternals.yml | 57 +- dist/ssa/detections/delete_a_net_user.yml | 59 +-- .../deny_permission_using_cacls_utility.yml | 65 +-- ...detect_dump_lsass_memory_using_comsvcs.yml | 57 +- dist/ssa/detections/detect_kerberoasting.yml | 68 +-- dist/ssa/detections/detect_pass_the_hash.yml | 70 +-- ...ohibited_applications_spawning_cmd_exe.yml | 71 +-- .../detections/disable_net_user_account.yml | 59 +-- .../first_time_seen_command_line_argument.yml | 81 +-- .../grant_permission_using_cacls_utility.yml | 65 +-- ...o_user_content_via_powersploit_modules.yml | 67 +-- ...count_creation_via_powersploit_modules.yml | 58 +- ..._deletion_of_logs_via_mimikatz_modules.yml | 59 +-- ...ng_of_accounts_via_dsinternals_modules.yml | 61 +-- ...s_and_policies_via_dsinternals_modules.yml | 64 +-- ...ctory_elements_via_powersploit_modules.yml | 65 +-- ...nd_persistence_via_powersploit_modules.yml | 65 +-- ...ivilege_elevation_via_mimikatz_modules.yml | 61 +-- ...d_process_control_via_mimikatz_modules.yml | 67 +-- ...rocess_control_via_powersploit_modules.yml | 79 +-- ...fy_acls_permission_of_files_or_folders.yml | 61 +-- ...lbas_applications_in_short_time_period.yml | 112 ++-- ...ction_by_machine_learning_method_-_ssa.yml | 78 +-- ...ash_observed_at_the_destination_device.yml | 86 +-- ...observed_by_an_event_collecting_device.yml | 86 +-- ...en_credentials_via_powersploit_modules.yml | 62 +-- ...rare_parent-child_process_relationship.yml | 123 ++--- ...counts_and_groups_via_mimikatz_modules.yml | 61 +-- ...s_and_policies_via_powersploit_modules.yml | 104 ++-- ...infrastructure_via_powersploit_modules.yml | 81 +-- ...rs_and_domains_via_powersploit_modules.yml | 70 +-- ...cess_to_computers_via_mimikatz_modules.yml | 58 +- ...ystem_elements_via_powersploit_modules.yml | 79 +-- ...sses_and_services_via_mimikatz_modules.yml | 61 +-- ..._shared_resources_via_mimikatz_modules.yml | 61 +-- ...ared_resources_via_powersploit_modules.yml | 70 +-- ..._opportunities_via_powersploit_modules.yml | 83 +-- ...f_connectivity_via_powersploit_modules.yml | 72 +-- ...ores_and_services_via_mimikatz_modules.yml | 69 +-- ...efensive_tools_via_powersploit_modules.yml | 61 +-- ..._opportunities_via_powersploit_modules.yml | 60 +-- ...ing_opportunities_via_mimikatz_modules.yml | 60 +-- .../resize_shadowstorage_volume.yml | 60 +-- ...ng_credentials_via_dsinternals_modules.yml | 73 +-- ...tting_credentials_via_mimikatz_modules.yml | 61 +-- ...ng_credentials_via_powersploit_modules.yml | 60 +-- ...ocess_running_from_unexpected_location.yml | 499 +++++++++--------- .../unusually_long_command_line.yml | 68 +-- .../wevtutil_usage_to_clear_logs.yml | 70 +-- .../wevtutil_usage_to_disable_logs.yml | 65 +-- 67 files changed, 1233 insertions(+), 3862 deletions(-) diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml index 8bde3c2b45..9062ef3a8c 100644 --- a/.github/workflows/build-and-validate.yml +++ b/.github/workflows/build-and-validate.yml @@ -23,7 +23,7 @@ jobs: steps: - name: TAGGED, Validate that the tag is in the correct format - + run: | echo "The GITHUB_REF: $GITHUB_REF" #First check to see if the release is a tag @@ -32,7 +32,7 @@ jobs: #is in the correct format (like v1.10.20) if [[ $GITHUB_REF =~ refs/tags/v[0-9]+.[0-9]+.[0-9]+ ]]; then echo "PASS: Tagged release with good format" - exit 0 + exit 0 else echo "FAIL: Tagged release with bad format" exit 1 @@ -49,14 +49,14 @@ jobs: runs-on: ubuntu-latest needs: [validate-tag-if-present] steps: - #Previous config chose which branch/tag to operate on. + #Previous config chose which branch/tag to operate on. #I think Github is smart enough to choose based on whether it's a pull request or push + other info? - - name: Check out the repository code + - name: Check out the repository code uses: actions/checkout@v2 #with: # repository: splunk/security-content #check out https://github.com/mitre/cti.git, defaults to HEAD # path: "security-content" - + - uses: actions/setup-python@v2 with: @@ -66,14 +66,14 @@ jobs: #TODO: CircleCI restore_cache equivalent - #don't need to install python3 or python3-dev since it was handled by the action above? + #don't need to install python3 or python3-dev since it was handled by the action above? #Also, no support for YAML anchors/aliases in Github Actions... - name: Install System Packages - run: | + run: | sudo apt update -qq - sudo apt install jq -qq - #TODO: CircleCI save_cache equivalent - + sudo apt install jq -qq + #TODO: CircleCI save_cache equivalent + - name: Install Python Dependencies run: | #Get the virtualenv set up @@ -83,19 +83,19 @@ jobs: python3 -m pip install --upgrade pip python3 -m pip install wheel python3 -m pip install -q -r requirements.txt - - - name: run validate - run: | + + - name: run validate + run: | source venv/bin/activate python3 contentctl.py --path . --verbose validate - - name: Get CTI Repo for Mitre context - uses: actions/checkout@v2 + - name: Get CTI Repo for Mitre context + uses: actions/checkout@v2 with: repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD path: "cti/" - + #Now generate the documentation (uses Node) - uses: actions/setup-node@v2 @@ -108,18 +108,18 @@ jobs: #Enter the virtualenv and run the docgen source venv/bin/activate python3 bin/doc_gen.py --path . --output docs -v - + #Now generate the spec docs npm install -g @adobe/jsonschema2md jsonschema2md -d spec -o docs/spec -f yaml -e spec.json -x - #Clean up extra properties on docs rm -rf docs/spec/*-*.md - + echo "****** BRANCH INFORMATION ******" git branch git branch --show-current - + build-sources: runs-on: ubuntu-latest needs: validate-content @@ -128,10 +128,10 @@ jobs: uses: actions/checkout@v2 - name: Install System Packages - run: | + run: | sudo apt update -qq - sudo apt install jq -qq - + sudo apt install jq -qq + - name: Install Python Dependencies run: | #Get the virtualenv set up @@ -143,18 +143,15 @@ jobs: python3 -m pip install -q -r requirements.txt - name: Run Generate - run: | + run: | source venv/bin/activate python3 contentctl.py --path . --verbose generate --product ESCU --output dist/escu python3 contentctl.py --path . --verbose generate --product SAAWS --output dist/saaws python3 contentctl.py --path . --verbose generate --product DevSecOps --output dist/devsecops - # make a copy of use_case_lib in order to have ES work :-( - # cp dist/escu/default/use_case_library.conf dist/escu/default/analyticstories.conf - # cp dist/saaws/default/use_case_library.conf dist/saaws/default/analyticstories.conf - # cp dist/devsecops/default/use_case_library.conf dist/devsecops/default/analyticstories.conf + python3 contentctl.py --path . --verbose generate --product SSA --output dist/ssa - name: Copy lookups .csv files - run: | + run: | # clean up current lookups rm -rf dist/escu/lookups rm -rf dist/saaws/lookups @@ -167,7 +164,7 @@ jobs: cp -rv *.csv ../dist/escu/lookups cp -rv *.csv ../dist/saaws/lookups cp -rv *.csv ../dist/devsecops/lookups - + #Tag is '' for non-tagged push and the tag name for a tagged release - name: Set tag id: vars @@ -198,7 +195,7 @@ jobs: sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/escu/app.manifest sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/content-version.conf tar -czf content-pack-build-escu.tar.gz dist/escu/* - + # update build number and version for saaws sed -i "s/build = .*$/build = ${{ github.run_number }}/g" dist/saaws/default/app.conf sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/app.conf @@ -209,6 +206,9 @@ jobs: # update build number and version for devsecops tar -czf content-pack-build-devsecops.tar.gz dist/devsecops/* + # update build number and version for ssa + tar -czf content-pack-build-ssa.tar.gz dist/ssa/* + - name: Persist to Workspace uses: actions/upload-artifact@v2 with: @@ -217,12 +217,13 @@ jobs: content-pack-build-escu.tar.gz content-pack-build-saaws.tar.gz content-pack-build-devsecops.tar.gz - + content-pack-build-ssa.tar.gz + build-package: runs-on: ubuntu-latest needs: [validate-content, build-sources] - + steps: - uses: actions/download-artifact@v2 with: @@ -234,12 +235,12 @@ jobs: with: python-version: '2.7' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified - + - name: Get virtualenv for Python 2.7 run: | - sudo apt install virtualenv + sudo apt install virtualenv - - name: Grab Splunk Packaging Toolkit + - name: Grab Splunk Packaging Toolkit run : | curl -Ls https://download.splunk.com/misc/packaging-toolkit/splunk-packaging-toolkit-0.9.0.tar.gz -o splunk-packaging-toolkit-latest.tar.gz mkdir slim-latest @@ -264,6 +265,7 @@ jobs: mv dist/escu DA-ESS-ContentUpdate mv dist/saaws DA-ESS_AmazonWebServices_Content mv dist/devsecops dev_sec_ops_analytics + slim package -o upload DA-ESS-ContentUpdate slim package -o upload DA-ESS_AmazonWebServices_Content slim package -o upload dev_sec_ops_analytics @@ -276,6 +278,9 @@ jobs: cp upload/dev_sec_ops_analytics-*tar.gz dev_sec_ops_analytics-latest.tar.gz + cp content-pack-build-ssa.tar.gz upload/SSA_Content-latest.tar.gz + sha256sum upload/SSA_Content-latest.tar.gz >> checksum.txt + touch tag-canary.txt - name: store_artifacts @@ -292,8 +297,9 @@ jobs: build/DA-ESS-ContentUpdate-latest.tar.gz build/DA-ESS_AmazonWebServices_Content-latest.tar.gz build/dev_sec_ops_analytics-latest.tar.gz + build/SSA_Content-latest.tar.gz build/checksum.txt - + #Everything below this line should ONLY run on a tag and nothing else #We still want all of the above checks to run and pass before running these @@ -301,7 +307,7 @@ jobs: runs-on: ubuntu-latest needs: [validate-content, build-sources, build-package] #Only run when tagged - if: startsWith(github.ref, 'refs/tags/') + if: startsWith(github.ref, 'refs/tags/') steps: - name: Checkout Repo @@ -319,10 +325,10 @@ jobs: - name: Install System Packages - run: | + run: | sudo apt update -qq sudo apt install jq -qq - + - name: Submit ESCU Package to AppInspect API @@ -333,8 +339,8 @@ jobs: cd bin #Enclose in quotes in case there are any special characters in the username/password #Better not to pass these arguments on the command line, if possible - ./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" - + ./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" + - name: Submit SAAWS Package to AppInspect API env: APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }} @@ -342,20 +348,20 @@ jobs: run: | cd bin ./appinspect.sh ../ DA-ESS_AmazonWebServices_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" - + - name: Create report artifact if: always() run: | #Always create this, regardless of whether success or failure above tar -cvzf report.tar.gz report/ - - name: store_artifacts + - name: store_artifacts uses: actions/upload-artifact@v2 with: name: appinspect_reports path: | report.tar.gz - + #Still store the report, even if we have failed (otherwise we don't know why/how we failed) - name: store_artifacts_on_failure uses: actions/upload-artifact@v2 @@ -364,7 +370,7 @@ jobs: name: appinspect_reports_failure path: | report.tar.gz - + create-report: runs-on: ubuntu-latest needs: [validate-content, build-sources, build-package, run-appinspect] @@ -375,13 +381,13 @@ jobs: uses: actions/checkout@v2 with: ref: 'develop' - - + + - name: Install System Packages - run: | + run: | sudo apt update -qq sudo apt install jq -qq - + - uses: actions/setup-python@v2 with: python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy @@ -396,12 +402,12 @@ jobs: python3 -m pip install --upgrade pip python3 -m pip install wheel python3 -m pip install -q -r requirements.txt - + - name: run reporting - run: | + run: | source venv/bin/activate python3 bin/reporting.py - + #Official, Verified Amazon-AWS Github Account Provided Action - uses: aws-actions/configure-aws-credentials@v1 with: @@ -410,23 +416,23 @@ jobs: # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it aws-region: us-west-1 #assume we will always use this, could make this an environment variable... - - name: Upload Reporting + - name: Upload Reporting run: | aws s3 cp bin/reporting s3://security-content/reporting --recursive --exclude "*" --include "*.svg" - + update-sources-github: runs-on: ubuntu-latest needs: [validate-content, build-sources, build-package, run-appinspect, create-report] #Only run when tagged if: startsWith(github.ref, 'refs/tags/') - steps: + steps: - name: Checkout Repo uses: actions/checkout@v2 with: token: ${{ secrets.PROTECTED_BRANCH_PUSH_TOKEN }} ref: 'develop' - + - uses: actions/setup-python@v2 with: python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy @@ -443,6 +449,8 @@ jobs: tar -zxf DA-ESS-ContentUpdate-latest.tar.gz -C latest-escu --strip-components=1 mkdir latest-saaws tar -zxf DA-ESS_AmazonWebServices_Content-latest.tar.gz -C latest-saaws --strip-components=1 + mkdir latest-ssa + tar -zxf SSA_Content-latest.tar.gz -C latest-saaws --strip-components=1 - name: Install Python Dependencies run: | #Get the virtualenv set up @@ -452,9 +460,9 @@ jobs: python3 -m pip install --upgrade pip python3 -m pip install wheel python3 -m pip install -q -r requirements.txt - - - name: Get CTI Repo for Mitre context - uses: actions/checkout@v2 + + - name: Get CTI Repo for Mitre context + uses: actions/checkout@v2 with: repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD path: "cti/" @@ -463,33 +471,30 @@ jobs: id: vars run: | echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" - - - name: Run doc-gen - run: | - source venv/bin/activate - python3 bin/doc_gen.py --path . --output docs -v - - - name: Make YAMLs Pretty + + - name: Run doc-gen run: | source venv/bin/activate - python3 bin/pretty_yaml.py --path . -v + python3 bin/doc_gen.py --path . --output docs -v + + - name: Make YAMLs Pretty + run: | + source venv/bin/activate + python3 bin/pretty_yaml.py --path . -v - name: Run generate-coverage-map run: | source venv/bin/activate python3 bin/generate-coverage-map.py --projects_path . --output docs/mitre-map - + - name: Update github with new docs and package bits run: | rm -rf dist mkdir dist - echo "Directory layout 3" - pwd - ls -lah mv latest-escu dist/escu mv latest-saaws dist/saaws + mv latest-ssa dist/ssa # configure git to prep for commit - #git config credential.helper 'cache --timeout=120' git config user.email "research@splunk.com" git config user.name "research bot" git config --global push.default simple @@ -500,7 +505,7 @@ jobs: # Push quietly to prevent showing the token in log #No need to provide any credentials git push - + publish-github-release: #Github-maintained release action is in archived state: https://github.com/actions/create-release @@ -510,7 +515,7 @@ jobs: #Only run when tagged if: startsWith(github.ref, 'refs/tags/') steps: - + #Get the artifacts that we need - uses: actions/download-artifact@v2 with: @@ -520,23 +525,24 @@ jobs: with: name: appinspect_reports - - + + #Rename those artifacts appropriately - name: Set tag id: vars run: echo "::set-output name=tag::${GITHUB_REF#refs/*/}" - - name: Rename the content-update appropriately + - name: Rename the content-update appropriately run: | cp DA-ESS-ContentUpdate-latest.tar.gz DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz cp DA-ESS_AmazonWebServices_Content-latest.tar.gz DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz - + cp SSA_Content-latest.tar.gz SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz + #No checksum on the reports cp report.tar.gz report-${{ steps.vars.outputs.tag }}.tar.gz - + cp checksum.txt checksum-${{ steps.vars.outputs.tag }}.txt - + #Upload all of the artifacts that we have created using the third party #action recommended bu Github - name: Upload Release Artifacts @@ -545,18 +551,19 @@ jobs: files: | DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz + SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz report-${{ steps.vars.outputs.tag }}.tar.gz checksum-${{ steps.vars.outputs.tag }}.txt - + attack-range-update: runs-on: ubuntu-latest needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release] #Only run when tagged if: startsWith(github.ref, 'refs/tags/') - steps: - + steps: + #Get the artifacts that we need - uses: actions/download-artifact@v2 with: @@ -569,20 +576,20 @@ jobs: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it - aws-region: us-west-1 #assume we will always use this, could make this an environment variable... + aws-region: us-west-1 #assume we will always use this, could make this an environment variable... - name: Sync latest ESCU to the Attack Range S3 bucket for apps run: | aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/ # make the file public since it is not by default aws s3api put-object-acl --bucket attack-range-appbinaries --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read - + master-api-update: runs-on: ubuntu-latest needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update] #Only run when tagged if: startsWith(github.ref, 'refs/tags/') - steps: + steps: - name: Checkout Repo uses: actions/checkout@v2 with: @@ -607,7 +614,7 @@ jobs: - name: Create Baseline Folder run: | source venv/bin/activate - python3 bin/create_baseline_folder.py + python3 bin/create_baseline_folder.py #Official, Verified Amazon-AWS Github Account Provided Action - uses: aws-actions/configure-aws-credentials@v1 @@ -615,7 +622,7 @@ jobs: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it - aws-region: us-west-1 #assume we will always use this, could make this an environment variable... + aws-region: us-west-1 #assume we will always use this, could make this an environment variable... - name: Update API sources run: | @@ -637,5 +644,3 @@ jobs: echo "Error [Security Content API status: $API_STATUS]" exit 1 fi - - diff --git a/bin/generate.py b/bin/generate.py index 3d6d11d9ec..f9f3b2b394 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -103,6 +103,15 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH): for d in detections: manifest_file = OUTPUT_PATH + '/detections/' + d['name'].lower().replace(" ", "_") + '.yml' + + # remove unused fields + del d['risk'] + del d['deployment'] + del d['mappings'] + + # pretty search + d['search'] = d['search'].replace("|", "\n|") + with open(manifest_file, 'w') as file: documents = yaml.dump(d, file, sort_keys=True) diff --git a/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml index cc45d35518..87488976d4 100644 --- a/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml +++ b/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml @@ -1,66 +1,18 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token attack, Golden or Silver kerberos ticket attack, and Skeleton key attack. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 759a653f-cb92-40f9-94c9-ec4e47b0f709 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1055 - - T1068 - - T1078 - - T1098 - - T1134 - - T1543 - - T1547 - - T1548 - - T1554 - - T1556 - - T1558 - nist: - - PR.AC - - PR.IP name: Applying Stolen Credentials via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz - https://adsecurity.org/?p=1275 -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is violating authentication processes by injecting golden or silver Kerberos tickets or passing stolen authentication tokens. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command @@ -107,17 +59,16 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line, - /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true - OR match_regex(cmd_line, /(?i)misc::skeleton/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true\ + \ OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line,\ + \ /(?i)kerberos::silver/)=true OR match_regex(cmd_line, /(?i)misc::skeleton/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml index 64b347ee77..413b8ec165 100644 --- a/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml +++ b/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Stolen credentials are applied by methods such as user impersonation, credential injection, spoofing of authentication processes or getting hold of critical accounts. This detection indicates such activities carried out by PowerSploit exploit @@ -30,38 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 270b482d-2af2-448f-9923-9cf005f61be4 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1055 - - T1068 - - T1078 - - T1098 - - T1134 - - T1543 - - T1547 - - T1548 - - T1554 - - T1555 - - T1558 - nist: - - PR.AC - - PR.IP name: Applying Stolen Credentials via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is violating authentication by injecting stolen credentials, manipulating authentication tokens or impersonating system or user accounts. Operation is performed at the device $dest_device_id$, by the account @@ -108,20 +60,17 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true - OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, - /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-CredentialInjection/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true OR match_regex(cmd_line,\ + \ /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, /(?i)Get-System/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true )\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml b/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml index c419b6a6ce..c01d8defe4 100644 --- a/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml +++ b/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml @@ -1,60 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: This detection identifies use of DSInternals modules that verify password strength, i.e., identify week accounts that would be easily compromised. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1098 - - T1087 - - T1201 - - T1552 - - T1555 - nist: - - PR.AC - - PR.IP name: Assessment of Credential Strength via DSInternals modules product: - Splunk Behavioral Analytics references: - https://github.com/MichaelGrafnetter/DSInternals -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 25 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: DSInternals tool kit is assessing password strength at the device $dest_device_id$. Account attempting this operation is $dest_user_id$ via command $cmd_line$ savedsearch_annotations: @@ -95,17 +52,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Test-PasswordQuality/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-PasswordQuality/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/attempt_to_delete_services.yml b/dist/ssa/detections/attempt_to_delete_services.yml index 8cb68ebd61..54233c7680 100644 --- a/dist/ssa/detections/attempt_to_delete_services.yml +++ b/dist/ssa/detections/attempt_to_delete_services.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, splunk datamodel: - Endpoint date: '2021-06-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic identifies suspicious series of attempt to kill multiple services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue @@ -34,23 +12,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. id: a0c8c292-d01a-11eb-aa18-acde48001122 known_false_positives: unknown -mappings: - cis20: - - CIS 8 - - CIS 13 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.DS - - PR.IP name: Attempt To delete Services product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -risk: [] savedsearch_annotations: analytic_story: - XMRig @@ -65,18 +31,18 @@ savedsearch_annotations: nist: - PR.DS - PR.IP -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%delete%\") AND process_name\ + \ = \"sc.exe\" \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/attempt_to_disable_services.yml b/dist/ssa/detections/attempt_to_disable_services.yml index 7c2bd3edc6..f66428dfeb 100644 --- a/dist/ssa/detections/attempt_to_disable_services.yml +++ b/dist/ssa/detections/attempt_to_disable_services.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic will identify suspicious series of command-line to disable several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the @@ -34,24 +12,12 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. id: afb31de4-d023-11eb-98d5-acde48001122 known_false_positives: unknown -mappings: - cis20: - - CIS 9 - - CIS 8 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.DS - - PR.IP name: Attempt To Disable Services product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -risk: [] savedsearch_annotations: analytic_story: - XMRig @@ -66,19 +32,20 @@ savedsearch_annotations: nist: - PR.DS - PR.IP -search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event, - "_datamodels"), "collection", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") - AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval _datamodels=ucast(map_get(input_event,\ + \ \"_datamodels\"), \"collection\", []), body={} \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%disabled%\") AND like(cmd_line,\ + \ \"%config%\") AND process_name=\"sc.exe\" \n| eval start_time=timestamp, end_time=timestamp,\ + \ entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\ + \ ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)), body=create_map([\"\ + event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name, \"\ + parent_process_name\", parent_process_name, \"process_path\", process_path]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml index 8fc72d65c7..5eff79d0aa 100644 --- a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,55 +1,17 @@ author: Jose Hernandez, Splunk datamodel: [] date: 2020-6-04 -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. how_to_implement: You must be ingesting windows endpoint data that tracks process activity, including parent-child relationships from your endpoints. id: 14038953-e5f2-4daf-acff-5452062baf03 known_false_positives: None identified. -mappings: - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - DE.CM name: Attempted Credential Dump From Registry via Reg exe product: - Splunk Behavioral Analytics references: - https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Malicious actor is dumping stored credentials from the registry sections SAM, Security, or System. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -85,20 +47,21 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event, - "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), - "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), - event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe" - OR process_name="reg.exe" | where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true - AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line, - /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true - OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time - = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), - body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) - | into write_ssa_detected_events(); ' +search: " \n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| eval process_name=lower(ucast(map_get(input_event,\ + \ \"process_name\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"\ + process\"), \"string\", null), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where process_name=\"cmd.exe\" OR process_name=\"reg.exe\" \n| where\ + \ cmd_line != null AND match_regex(cmd_line, /(?i)save\\s+/)=true AND ( match_regex(cmd_line,\ + \ /(?i)HKLM\\\\Security/)=true OR match_regex(cmd_line, /(?i)HKLM\\\\SAM/)=true\ + \ OR match_regex(cmd_line, /(?i)HKLM\\\\System/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\ + \\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\SAM/)=true\ + \ OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\System/)=true ) \n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),\ + \ body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ + , process_name]) \n| into write_ssa_detected_events(); " tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml index 20eee0916c..eb5b8fc535 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. FGdump is @@ -32,26 +11,10 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 312582f2-5e91-42c1-a275-cd67f31373c8 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction indicative of FGDump and CacheDump with s option product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,22 +50,21 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, - "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), - "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line != null AND process_name != null AND parent_process_name != null - AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name, - /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true - AND match_regex(cmd_line, /(?i)\-s/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND process_name != null AND parent_process_name\ + \ != null AND match_regex(parent_process_name, /(?i)System32\\\\services.exe/)=true\ + \ AND match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND match_regex(process_path,\ + \ /(?i)\\\\Temp/)=true AND match_regex(cmd_line, /(?i)\\-s/)=true\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml index b44bd8d721..3b8c7ac1c0 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. FGdump is @@ -32,26 +11,10 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction indicative of FGDump and CacheDump with v option product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,20 +50,18 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, - "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name, - /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true - AND match_regex(cmd_line, /(?i)\-v/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND process_name != null AND process_path !=\ + \ null AND match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND match_regex(process_path,\ + \ /(?i)\\\\Temp/)=true AND match_regex(cmd_line, /(?i)\\-v/)=true\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name]) \n| into write_ssa_detected_events();" tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml b/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml index 5e6d61ccf0..b885fd281a 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. LaZagne is @@ -31,27 +10,10 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 341975fa-4ad0-4f01-9acc-df4f69742db7 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - - T1555 - nist: - - PR.IP - - PR.AC name: Credential Extraction indicative of Lazagne command line options product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Lazagne malware is extracting/decoding encoded credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,17 +49,14 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line, - /(?i)all\s+\-oA\s+\-output/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND match_regex(cmd_line, /(?i)all\\s+\\-oA\\\ + s+\\-output/)=true\n\n| eval start_time = timestamp, end_time = timestamp, entities\ + \ = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml index 0f1da47b83..1389bb382b 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. DSInternals @@ -30,28 +9,12 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction indicative of use of DSInternals credential conversion modules product: - Splunk Behavioral Analytics references: - https://github.com/MichaelGrafnetter/DSInternals -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: DSInternals tool kit is converting stolen credential material to a form applicable to authentications. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,25 +50,23 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, - "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), - "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true - OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line, - /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true - OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line, - /(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true - OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line, - /(?i)ConvertTo-UnicodePassword/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), process_name=ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\ + , null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true\ + \ OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line,\ + \ /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true\ + \ OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line,\ + \ /(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true\ + \ OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line,\ + \ /(?i)ConvertTo-UnicodePassword/)=true )\n\n| eval start_time = timestamp, end_time\ + \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ + , process_name]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml index 5df5b95af6..639980240f 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. DSInternals @@ -30,27 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction indicative of use of DSInternals modules product: - Splunk Behavioral Analytics references: - https://github.com/MichaelGrafnetter/DSInternals -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: DSInternals tool kit is accessing sensitive credential material such as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ @@ -87,27 +50,25 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, - "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), - "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true - OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line, - /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true - OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line, - /(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true - OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true - OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true - OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line, - /(?i)Get-SamPasswordPolicy/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), process_name=ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\ + , null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-AzureADUserEx/)=true OR match_regex(cmd_line, /(?i)Get-BootKey/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line, /(?i)Get-SamPasswordPolicy/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line, \"process_name\", process_name]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml index 9886257714..a8a9c5bb55 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Mimikatz @@ -30,27 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 966b635f-98e8-4aa4-9b49-47ed2cedcc85 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction indicative of use of Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 66 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is extracting/decoding encoded credentials from stores such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -86,22 +49,19 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true - OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true - OR match_regex(cmd_line, /(?i)lsadump::sam/)=true OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true - OR match_regex(cmd_line, /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true - OR match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true\ + \ OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true OR match_regex(cmd_line, /(?i)kerberos::list/)=true\ + \ OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR match_regex(cmd_line, /(?i)lsadump::sam/)=true\ + \ OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true OR match_regex(cmd_line,\ + \ /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true OR\ + \ match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml index ee6f7d13a5..18b90a5d75 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. PowerSploit @@ -30,27 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 5f1186a4-e681-446e-851c-dc9574ad28eb known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction indicative of use of PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is extracting encoded credentials or spoofing automated logings. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -86,23 +49,20 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true - OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true - OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line, - /(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true - OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line, - /(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true\ + \ OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml index a93b2f8aef..82a0286bde 100644 --- a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml +++ b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Native Microsoft @@ -34,27 +13,11 @@ known_false_positives: Although unlikely, using debuggers this way may be indica of developers analyzing crash dumps of their code. Note, even for developers this is an unusual way of working on code - debuggers are mostly used to step through code, not analyze its crash dumps. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.IP - - PR.AC name: Credential Extraction native Microsoft debuggers peek into the kernel product: - Splunk Behavioral Analytics references: - https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29 -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's native debugging tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -90,21 +53,20 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, - "process_name"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line != null AND parent_process_name != null AND process_name - != null AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name, - /(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true - AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\-ForceV1/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND parent_process_name != null AND process_name\ + \ != null AND ( match_regex(parent_process_name, /(?i)ntkd\\.exe/)=true OR match_regex(parent_process_name,\ + \ /(?i)livekd\\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\\.exe/)=true\ + \ AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\\\ + -ForceV1/)=true\n\n| eval start_time = timestamp, end_time = timestamp, entities\ + \ = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line, \"process_name\", process_name, \"parent_process_name\"\ + , parent_process_name]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml index 350a3310d2..bc0f5ddf5d 100644 --- a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml +++ b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Native Microsoft @@ -34,26 +13,10 @@ known_false_positives: Although unlikely, using debuggers this way may be indica of developers analyzing crash dumps of their code. Note, even for developers this is an unusual way of working on code - debuggers are mostly used to step through code, not analyze its crash dumps. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction native Microsoft debuggers via z command line option product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's native debugging tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -89,19 +52,17 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, - "process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line != null AND process_name != null AND ( match_regex(process_name, - /^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, - /(?i)\-z\s+/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND process_name != null AND ( match_regex(process_name,\ + \ /^(?i)ntkd\\.exe/)=true OR match_regex(process_name, /^(?i)kd\\.exe/)=true ) AND\ + \ match_regex(cmd_line, /(?i)\\-z\\s+/)=true\n\n| eval start_time = timestamp, end_time\ + \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ + , process_name]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml b/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml index 20e91c8368..c357c97f08 100644 --- a/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml +++ b/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. PowerSploit @@ -31,27 +10,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: e4f126b5-e6bc-4a5c-b1a8-d07bc6c4a49f known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.IP - - PR.AC name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,17 +50,15 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line, - /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\|]+/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true\ + \ AND match_regex(cmd_line, /(?i)\\-dbpath[\\s;:\\.\\\n|]+/)=true\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/delete_a_net_user.yml b/dist/ssa/detections/delete_a_net_user.yml index bf0da7f982..d0e32cc584 100644 --- a/dist/ssa/detections/delete_a_net_user.yml +++ b/dist/ssa/detections/delete_a_net_user.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some @@ -37,23 +15,11 @@ how_to_implement: o successfully implement this search, you need to be ingesting id: 8776d79c-d26e-11eb-9a56-acde48001122 known_false_positives: System administrators or scripts may delete user accounts via this technique. Filter as needed. -mappings: - cis20: - - CIS 4 - - CIS 16 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.AC - - PR.IP name: Delete A Net User product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -risk: [] savedsearch_annotations: analytic_story: - XMRig @@ -68,18 +34,19 @@ savedsearch_annotations: nist: - PR.AC - PR.IP -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" - OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%/delete%\") AND (process_name=\"\ + net1.exe\" OR process_name=\"net.exe\") \n| eval start_time=timestamp, end_time=timestamp,\ + \ entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\ + \ ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)), body=create_map([\"\ + event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name, \"\ + parent_process_name\", parent_process_name, \"process_path\", process_path]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/deny_permission_using_cacls_utility.yml b/dist/ssa/detections/deny_permission_using_cacls_utility.yml index b1d897652a..e4f680dc49 100644 --- a/dist/ssa/detections/deny_permission_using_cacls_utility.yml +++ b/dist/ssa/detections/deny_permission_using_cacls_utility.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-14' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection @@ -35,29 +13,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin id: b76eae28-cd25-11eb-9c92-acde48001122 known_false_positives: network administrator may use this windows utility but this is not a common practice. -mappings: - cis20: - - CIS 14 - - CIS 16 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1222 - nist: - - PR.AC - - PR.IP name: Deny Permission using Cacls Utility product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 35 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 35 risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to deny a permission of a file or directory in host $dest_device_id$ savedsearch_annotations: @@ -87,18 +47,19 @@ savedsearch_annotations: role: - Victim type: user -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true - AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true\ + \ AND (process_name=\"cacls.exe\" OR process_name=\"xcacls.exe\" OR process_name=\"\ + icacls.exe\") \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml b/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml index 707f596534..e7291f5901 100644 --- a/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml +++ b/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml @@ -1,27 +1,6 @@ author: Jose Hernandez, Splunk datamodel: [] date: '2020-09-15' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: This search detects the memory of lsass.exe being dumped for offline credential theft attack. how_to_implement: You must be ingesting endpoint data that tracks process activity, @@ -30,28 +9,11 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml). id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e known_false_positives: None identified. -mappings: - cis20: - - CIS 8 - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003.003 - - T1003 - nist: - - DE.CM name: Detect Dump LSASS Memory using comsvcs product: - Splunk Behavioral Analytics references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,15 +49,16 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event, - "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), - "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", - null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, - /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = - timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id, - "process_name", process_name, "process", process]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval tenant=ucast(map_get(input_event,\ + \ \"_tenant\"), \"string\", null), machine=ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), timestamp=parse_long(ucast(map_get(input_event, \"_time\"\ + ), \"string\", null)), process=lower(ucast(map_get(input_event, \"process\"), \"\ + string\", null)), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where process_name LIKE \"%rundll32.exe%\" AND match_regex(process,\ + \ /(?i)comsvcs.dll[,\\s]+MiniDump/)=true \n| eval start_time = timestamp, end_time\ + \ = timestamp, entities = mvappend(machine), body=create_map([\"event_id\", event_id,\ + \ \"process_name\", process_name, \"process\", process]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/detect_kerberoasting.yml b/dist/ssa/detections/detect_kerberoasting.yml index ef38ab913b..1db7da3626 100644 --- a/dist/ssa/detections/detect_kerberoasting.yml +++ b/dist/ssa/detections/detect_kerberoasting.yml @@ -1,27 +1,6 @@ author: Xiao Lin, Splunk datamodel: [] date: '2020-10-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: This search detects a potential kerberoasting attack via service principal name requests how_to_implement: The test data is converted from Windows Security Event logs generated @@ -29,28 +8,11 @@ how_to_implement: The test data is converted from Windows Security Event logs ge id: dabdd6d7-3e10-42be-8711-4e124f7a3850 known_false_positives: Older systems that support kerberos RC4 by default NetApp may generate false positives -mappings: - cis20: - - CIS 8 - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1558.003 - - T1558 - nist: - - DE.CM name: Detect Kerberoasting product: - Splunk Behavioral Analytics references: - Initial ESCU implementation by Jose Hernandez and Patrick Bareiss -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 14 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Kerberoasting malware is potentially applying stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -86,21 +48,21 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"), - EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, - "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), - ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, - "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), - event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769" - AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event - input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] - | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID - | eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id, - "EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, - "TicketEncryptionType", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null))| select start_time, end_time, entities, body | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events() \n| eval _time=map_get(input_event,\ + \ \"_time\"), EventCode=map_get(input_event, \"event_code\"), TicketOptions=map_get(input_event,\ + \ \"ticket_options\"), TicketEncryptionType=map_get(input_event, \"ticket_encryption_type\"\ + ), ServiceName=map_get(input_event, \"service_name\"), ServiceID=map_get(input_event,\ + \ \"service_id\"), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"\ + string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"),\ + \ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where EventCode=\"4769\" AND TicketOptions=\"0x40810000\" AND TicketEncryptionType=\"\ + 0x17\" \n| first_time_event input_columns=[\"EventCode\",\"TicketOptions\",\"TicketEncryptionType\"\ + ,\"ServiceName\",\"ServiceID\"] \n| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID\ + \ \n| eval start_time=_time, end_time=_time, body=create_map([\"event_id\", event_id,\ + \ \"EventCode\", EventCode, \"ServiceName\", ServiceName, \"TicketOptions\", TicketOptions,\ + \ \"TicketEncryptionType\", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null))\n| select start_time, end_time, entities, body \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/detect_pass_the_hash.yml b/dist/ssa/detections/detect_pass_the_hash.yml index 197806c9e7..ab5fdfc434 100644 --- a/dist/ssa/detections/detect_pass_the_hash.yml +++ b/dist/ssa/detections/detect_pass_the_hash.yml @@ -1,28 +1,6 @@ author: Xiao Lin, Splunk datamodel: [] date: '2020-10-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts using Pass-the-Hash technique. how_to_implement: The test data is converted from Windows Security Event logs generated @@ -30,32 +8,11 @@ how_to_implement: The test data is converted from Windows Security Event logs ge id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f known_false_positives: Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate. -mappings: - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1550 - - T1550.002 - nist: - - PR.PT - - PR.AT - - PR.AC - - PR.IP name: Detect Pass the Hash product: - Splunk Behavioral Analytics references: - Initial ESCU implementation by Bhavin Patel and Patrick Bareiss -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 16 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Potential use of the pass the hash/token attacks that spoof authentication. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -95,21 +52,18 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) - | eval signature_id=map_get(input_event, "signature_id"), authentication_type=map_get(input_event, - "authentication_type"), authentication_method=map_get(input_event, "authentication_method"), - origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event, - "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - - | where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9" - AND authentication_method="seclogo") - - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type, - "authentication_method", authentication_method]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| eval signature_id=map_get(input_event, \"signature_id\"\ + ), authentication_type=map_get(input_event, \"authentication_type\"), authentication_method=map_get(input_event,\ + \ \"authentication_method\"), origin_device_domain=map_get(input_event, \"origin_device_domain\"\ + ), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\ + \ dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null),\ + \ event_id=ucast(map_get(input_event, \"event_id\"), \"string\", null)\n\n| where\ + \ (authentication_type=\"3\" AND authentication_method=\"NtLmSsp\") OR (authentication_type=\"\ + 9\" AND authentication_method=\"seclogo\")\n\n| eval start_time=timestamp, end_time=timestamp,\ + \ entities=mvappend(dest_device_id, dest_user_id), body=create_map([\"event_id\"\ + , event_id, \"authentication_type\", authentication_type, \"authentication_method\"\ + , authentication_method]) \n| into write_ssa_detected_events();" tags: analytic_story: - Lateral Movement diff --git a/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml index 426de847da..d83661a6e9 100644 --- a/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml @@ -1,28 +1,6 @@ author: Ignacio Bermudez Corrales, Splunk datamodel: [] date: 2020-7-13 -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe` @@ -33,26 +11,10 @@ id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 known_false_positives: There are circumstances where an application may legitimately execute and interact with the Windows command-line interface. Investigate and modify the lookup file, as appropriate. -mappings: - cis20: - - CIS 8 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1059 - nist: - - PR.PT - - DE.CM name: Detect Prohibited Applications Spawning cmd exe product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 56 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Potential malicious landing to the console via unexpected programs that called cmd.exe. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$. @@ -91,24 +53,21 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) - | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), - parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", - null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), - dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) - - | where process_name="cmd.exe" | rex field=parent_process "(?[^\\\\]+)$" - | where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe" - OR field0="visio.exe" OR field0="mspub.exe" OR field0="acrobat.exe" OR field0="acrord32.exe" - OR field0="chrome.exe" OR field0="iexplore.exe" OR field0="opera.exe" OR field0="firefox.exe" - OR field0="java.exe" OR field0="powershell.exe" - - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, - "parent_process_name", parent_process]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| eval process_name=ucast(map_get(input_event,\ + \ \"process_name\"), \"string\", null), parent_process=lower(ucast(map_get(input_event,\ + \ \"parent_process_name\"), \"string\", null)), dest_user_id=ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null), event_id=ucast(map_get(input_event, \"\ + event_id\"), \"string\", null)\n\n| where process_name=\"cmd.exe\" \n| rex field=parent_process\ + \ \"(?[^\\\\\\\\]+)$\" \n| where field0=\"winword.exe\" OR field0=\"excel.exe\"\ + \ OR field0=\"outlook.exe\" OR field0=\"powerpnt.exe\" OR field0=\"visio.exe\" OR\ + \ field0=\"mspub.exe\" OR field0=\"acrobat.exe\" OR field0=\"acrord32.exe\" OR field0=\"\ + chrome.exe\" OR field0=\"iexplore.exe\" OR field0=\"opera.exe\" OR field0=\"firefox.exe\"\ + \ OR field0=\"java.exe\" OR field0=\"powershell.exe\"\n\n| eval start_time=timestamp,\ + \ end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map([\"\ + event_id\", event_id, \"process_name\", process_name, \"parent_process_name\",\ + \ parent_process]) \n| into write_ssa_detected_events();" tags: analytic_story: - Suspicious Command-Line Executions diff --git a/dist/ssa/detections/disable_net_user_account.yml b/dist/ssa/detections/disable_net_user_account.yml index 75d483d560..81aba69c14 100644 --- a/dist/ssa/detections/disable_net_user_account.yml +++ b/dist/ssa/detections/disable_net_user_account.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious @@ -36,23 +14,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin id: ba858b08-d26c-11eb-af9b-acde48001122 known_false_positives: network operator may use this approach to quickly disable an account but not a common practice. -mappings: - cis20: - - CIS 4 - - CIS 16 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.AC - - PR.IP name: Disable Net User Account product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -risk: [] savedsearch_annotations: analytic_story: - XMRig @@ -67,18 +33,19 @@ savedsearch_annotations: nist: - PR.AC - PR.IP -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" - OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%/active:no%\") AND\ + \ (process_name=\"net1.exe\" OR process_name=\"net.exe\") \n| eval start_time=timestamp,\ + \ end_time=timestamp, entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ + , process_name, \"parent_process_name\", parent_process_name, \"process_path\",\ + \ process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/first_time_seen_command_line_argument.yml b/dist/ssa/detections/first_time_seen_command_line_argument.yml index b667e6a13c..06db177fa6 100644 --- a/dist/ssa/detections/first_time_seen_command_line_argument.yml +++ b/dist/ssa/detections/first_time_seen_command_line_argument.yml @@ -1,28 +1,6 @@ author: Ignacio Bermudez Corrales, Splunk datamodel: [] date: 2021-2-1 -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. This is an implementation on SPL2 of the rule `First time seen command line argument` by @bpatel. @@ -33,32 +11,10 @@ known_false_positives: Legitimate programs can also use command-line arguments t execute. Please verify the command-line arguments to check what command/program is being executed. We recommend customizing the `first_time_seen_cmd_line_filter` macro to exclude legitimate parent_process_name -mappings: - cis20: - - CIS 3 - - CIS 8 - kill_chain_phases: - - Command and Control - - Actions on Objectives - mitre_attack: - - T1059 - - T1117 - - T1202 - nist: - - PR.PT - - DE.CM - - PR.IP name: First time seen command line argument product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 30 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 30 risk_message: A cmd process $process_name$ with commandline $cmd_line$ try to execute command has not previously seen in host $dest_device_id$ savedsearch_annotations: @@ -92,23 +48,26 @@ savedsearch_annotations: role: - Victim type: user -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"), - "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line), - cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/, - "GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, - "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext" - */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"), - /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, - /\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) | - where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* - \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id, - dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm - | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, - dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| eval dest_user_id=ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null), process_name=ucast(map_get(input_event,\ + \ \"process_name\"), \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), cmd_line_norm=lower(cmd_line), cmd_line_norm=replace(cmd_line_norm,\ + \ /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/, \"\ + GUID\"), cmd_line_norm=replace(cmd_line_norm, /(?<=\\s)+\\\\[^:]*(?=\\\\.*\\.\\\ + w{3}(\\s\n|$)+)/, \"\\\\PATH\"), /* replaces \" \\\\Something\\\\Something\\\\command.ext\"\ + \ => \"PATH\\\\command.ext\" */ cmd_line_norm=replace(cmd_line_norm, /\\w:\\\\[^:]*(?=\\\ + \\.*\\.\\w{3}(\\s\n|$)+)/, \"\\\\PATH\"), /* replaces \"C:\\\\Something\\\\Something\\\ + \\command.ext\" => \"PATH\\\\command.ext\" */ cmd_line_norm=replace(cmd_line_norm,\ + \ /\\d+/, \"N\"), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where process_name=\"cmd.exe\" AND match_regex(ucast(cmd_line, \"string\"\ + , \"\"), /.* \\/[cC] .*/)=true \n| select process_name, cmd_line, cmd_line_norm,\ + \ timestamp, dest_device_id, dest_user_id \n| first_time_event input_columns=[\"\ + cmd_line_norm\"] \n| where first_time_cmd_line_norm \n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map([\"\ + event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/grant_permission_using_cacls_utility.yml b/dist/ssa/detections/grant_permission_using_cacls_utility.yml index 79b30217aa..4aa278c41b 100644 --- a/dist/ssa/detections/grant_permission_using_cacls_utility.yml +++ b/dist/ssa/detections/grant_permission_using_cacls_utility.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-14' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft, ransomware and coinminer scripts to evade detections and restrict access @@ -35,29 +13,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin id: c6da561a-cd29-11eb-ae65-acde48001122 known_false_positives: network administrator may use this windows utility but this is not a common practice. -mappings: - cis20: - - CIS 14 - - CIS 16 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1222 - nist: - - PR.AC - - PR.IP name: Grant Permission Using Cacls Utility product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 35 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 35 risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to grant user a permission to a file or directory in host $dest_device_id$ savedsearch_annotations: @@ -87,18 +47,19 @@ savedsearch_annotations: role: - Victim type: user -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true - AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true\ + \ AND (process_name=\"cacls.exe\" OR process_name=\"xcacls.exe\" OR process_name=\"\ + icacls.exe\") \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml b/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml index f710887623..1d178e6b0e 100644 --- a/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that enable illegaly access user content, such as key logging, audio recording, screenshots, tapping into http and RDP sessions, etc. @@ -30,31 +8,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 01fc7d91-eb0c-478e-8633-e4fa4904463a known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1021 - - T1113 - - T1123 - - T1563 - nist: - - PR.AC - - PR.IP name: Illegal Access To User Content via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 85 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is tapping into user content - microphone, camera, ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -95,20 +53,17 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR - match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true - OR match_regex(cmd_line, /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line, - /(?i)Get-WebConfig/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-HttpStatus/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line, /(?i)Get-WebConfig/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Malicious PowerShell diff --git a/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml b/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml index f0cba48987..07b31c86e2 100644 --- a/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml @@ -1,56 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that create accounts illegaly. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 20fba62a-fa5b-46cc-b39f-473fa248fee2 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1585 - nist: - - PR.AC - - PR.IP name: Illegal Account Creation via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is creating illegal domain accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,17 +48,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)New-DomainUser/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)New-DomainUser/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml index 0e0886d920..a9603449f8 100644 --- a/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml +++ b/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml @@ -1,56 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that delete event logs. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 4ddb3b0d-f95f-4ae2-b4e8-663296453a7b known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1070 - nist: - - PR.AC - - PR.IP name: Illegal Deletion of Logs via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 50 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is deleting event logs to cover tracks of malicious activity. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,17 +48,15 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)event::drop/)=true\ + \ OR match_regex(cmd_line, /(?i)event::clear/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\ + \ into write_ssa_detected_events();" tags: analytic_story: - Windows Log Manipulation diff --git a/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml b/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml index 951cb37e77..2efd3130f9 100644 --- a/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml +++ b/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml @@ -1,57 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of DSInternals modules that enable or disable accounts illegaly. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 3e0f9962-9989-445f-878c-939443326b63 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP name: Illegal Enabling or Disabling of Accounts via DSInternals modules product: - Splunk Behavioral Analytics references: - https://github.com/MichaelGrafnetter/DSInternals -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: DSInternals malware is illegally enabling or disabling accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -89,18 +49,15 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Disable-ADDBAccount/)=true\ + \ OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true )\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml b/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml index 399bc29caa..37d5050d0d 100644 --- a/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml +++ b/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml @@ -1,59 +1,18 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of DSInternals modules for illegal management of Active Directoty elements and policies. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: a587ca9f-c138-47b4-ba51-699f319b8cc5 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1098 - - T1207 - - T1484 - nist: - - PR.AC - - PR.IP name: Illegal Management of Active Directory Elements and Policies via DSInternals modules product: - Splunk Behavioral Analytics references: - https://github.com/MichaelGrafnetter/DSInternals -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: DSInternals malware is controlling infrastructure by modifying Active Directory elements, domain controllers, and policies. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -92,19 +51,16 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true - OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, - /(?i)Set-LsaPolicyInformation/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Remove-ADDBObject/)=true\ + \ OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true OR match_regex(cmd_line,\ + \ /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, /(?i)Set-LsaPolicyInformation/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml b/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml index 949a8f9c79..ecba1f0562 100644 --- a/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml @@ -1,59 +1,18 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that enable illegal management of computers and Active Directory elements. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 75760c11-7d48-4968-b828-013b299e8f6d known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1098 - - T1207 - - T1484 - nist: - - PR.AC - - PR.IP name: Illegal Management of Computers and Active Directory Elements via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is controlling infrastructure by modifying Active Directory elements or local Master Boot Records. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -92,20 +51,16 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR - match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line, - /(?i)Set-MasterBootRecord/)=true ) - - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainObject/)=true\ + \ OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true\ + \ OR match_regex(cmd_line, /(?i)Set-MasterBootRecord/)=true )\n\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index 96a76208ab..fd38b58f4c 100644 --- a/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that illegaly elevate general privileges or ensure persistence, e.g., enable manipulation of registry, task scheduling, persistent WMI, access to OS objects under desired identities. @@ -30,30 +8,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 88c10ee9-fe72-4bce-b343-5b129044b991 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1053 - - T1134 - - T1548 - nist: - - PR.AC - - PR.IP name: Illegal Privilege Elevation and Persistence via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is planting attack persistence elements, altering privileges and access controls. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -95,19 +54,17 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true - OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true - OR match_regex(cmd_line, /(?i)New-UserPersistenceOption/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-DomainObjectAcl/)=true\ + \ OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true\ + \ OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true OR match_regex(cmd_line,\ + \ /(?i)New-UserPersistenceOption/)=true )\n\n| eval start_time = timestamp, end_time\ + \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\ + \ into write_ssa_detected_events();" tags: analytic_story: - Malicious PowerShell diff --git a/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml index 04a239f103..1292ab88eb 100644 --- a/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml @@ -1,57 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for illegal privilege elevation. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 2f873b1f-6352-4844-b7b9-b419f09a42c7 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1134 - - T1548 - nist: - - PR.AC - - PR.IP name: Illegal Privilege Elevation via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is setting highest privileges to malicious entities. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -90,18 +50,15 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)privilege::debug/)=true\ + \ OR match_regex(cmd_line, /(?i)token::elevate/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\ + \ into write_ssa_detected_events();" tags: analytic_story: - Windows Privilege Escalation diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml index 5e2fe5e498..77f4173183 100644 --- a/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for illegal control over services and processes, including the authentication service. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: aaf3adf1-73e1-4477-b4ee-3771898964f1 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1055 - - T1106 - - T1569 - nist: - - PR.AC - - PR.IP name: Illegal Service and Process Control via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is controlling computer's processess and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -91,20 +50,18 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line, - /(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line, - /(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true - OR match_regex(cmd_line, /(?i)misc::memssp/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::start/)=true\ + \ OR match_regex(cmd_line, /(?i)service::\\+/)=true OR match_regex(cmd_line, /(?i)service::\\\ + -/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line,\ + \ /(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true\ + \ OR match_regex(cmd_line, /(?i)misc::memssp/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\ + \ into write_ssa_detected_events();" tags: analytic_story: - Windows Service Abuse diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml b/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml index 477c3ba9b4..a66a0928bb 100644 --- a/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that enable illegal control of services and processes, such as installing or spoofing of malicious services, injecting malicious code in DLLs and EXEs, invoking shell code and WMI commands, @@ -31,30 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 0e910e5b-309d-4bc3-8af2-0030c02aa353 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1055 - - T1106 - - T1569 - nist: - - PR.AC - - PR.IP name: Illegal Service and Process Control via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is controlling computer's processess and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -94,27 +53,23 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true - OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, - /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true - OR match_regex(cmd_line, /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line, - /(?i)Invoke-ReflectivePEInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true - OR match_regex(cmd_line, /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line, - /(?i)Invoke-Shellcode/)=true OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true - OR match_regex(cmd_line, /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line, - /(?i)Write-HijackDll/)=true OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true - ) - - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Install-SSP/)=true\ + \ OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true OR match_regex(cmd_line,\ + \ /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Restore-ServiceBinary/)=true\ + \ OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true OR match_regex(cmd_line,\ + \ /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line, /(?i)Invoke-ReflectivePEInjection/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true OR match_regex(cmd_line,\ + \ /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line, /(?i)Invoke-Shellcode/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true OR match_regex(cmd_line,\ + \ /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line, /(?i)Write-HijackDll/)=true\ + \ OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true )\n\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Service Abuse diff --git a/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml b/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml index 4ed844eb1a..611f9ca6af 100644 --- a/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-15' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone or to a specific user. This technique may be used by the adversary to evade ACLs or protected files access. This changes @@ -37,23 +15,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin id: 9ae9a48a-cdbe-11eb-875a-acde48001122 known_false_positives: network administrator may use this windows utility. filter is needed. -mappings: - kill_chain_phases: - - Exploitation - mitre_attack: - - T1222 name: Modify ACLs Permission Of Files Or Folders product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 35 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 35 risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to modify a permission of a file or directory in host $dest_device_id$ savedsearch_annotations: @@ -77,19 +43,20 @@ savedsearch_annotations: role: - Victim type: user -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, - /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" - OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, - end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), - "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, - "parent_process_name", parent_process_name, "process_path", process_path]) | into - write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%/G%\") AND (match_regex(cmd_line,\ + \ /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name=\"\ + cacls.exe\" OR process_name=\"xcacls.exe\" OR process_name=\"icacls.exe\") \n| eval\ + \ start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml b/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml index 79e77dfec0..979043c45f 100644 --- a/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml +++ b/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml @@ -1,28 +1,6 @@ author: Ignacio Bermudez Corrales, Splunk datamodel: [] date: '2020-08-25' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: Attacker activity may compromise executing several LOLBAS applications in conjunction to accomplish their objectives. We are looking for more than usual LOLBAS applications over a window of time, by building profiles per machine. @@ -33,28 +11,11 @@ known_false_positives: 'Some administrative tasks may involve multiple use of LO beginning when it hasn''t collected yet enough data to construct the baseline. ' -mappings: - cis20: - - CIS 8 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1059 - - T1053 - nist: - - PR.PT - - DE.CM name: More than usual number of LOLBAS applications in short time period product: - Splunk Behavioral Analytics references: - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 25 -- threat_object_field: process_name - threat_object_type: processname risk_message: A system process $process_name$ with commandline $cmd_line$ spawn iin short period of time in host $dest_device_id$ savedsearch_annotations: @@ -84,40 +45,45 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, - "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, - "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe" - OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe" - OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe" - OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe" - OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe" - OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe" - OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe" - OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe" - OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe" - OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe" - OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe" - OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe" - OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe" - OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe" - OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe" - OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe" - OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe" - OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe" - OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe" - OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe" - OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR - process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe" - OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe" - OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe" - OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe" - OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by - device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end - as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" - window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start, - end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter", - lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events() \n| eval device=ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null), process_name=lower(ucast(map_get(input_event,\ + \ \"process_name\"), \"string\", null)), timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| where process_name==\"regsvcs.exe\" OR process_name==\"\ + ftp.exe\" OR process_name==\"dfsvc.exe\" OR process_name==\"rasautou.exe\" OR process_name==\"\ + schtasks.exe\" OR process_name==\"xwizard.exe\" OR process_name==\"findstr.exe\"\ + \ OR process_name==\"esentutl.exe\" OR process_name==\"cscript.exe\" OR process_name==\"\ + reg.exe\" OR process_name==\"csc.exe\" OR process_name==\"atbroker.exe\" OR process_name==\"\ + print.exe\" OR process_name==\"pcwrun.exe\" OR process_name==\"vbc.exe\" OR process_name==\"\ + rpcping.exe\" OR process_name==\"wsreset.exe\" OR process_name==\"ilasm.exe\" OR\ + \ process_name==\"certutil.exe\" OR process_name==\"replace.exe\" OR process_name==\"\ + mshta.exe\" OR process_name==\"bitsadmin.exe\" OR process_name==\"wscript.exe\"\ + \ OR process_name==\"ieexec.exe\" OR process_name==\"cmd.exe\" OR process_name==\"\ + microsoft.workflow.compiler.exe\" OR process_name==\"runscripthelper.exe\" OR process_name==\"\ + makecab.exe\" OR process_name==\"forfiles.exe\" OR process_name==\"desktopimgdownldr.exe\"\ + \ OR process_name==\"control.exe\" OR process_name==\"msbuild.exe\" OR process_name==\"\ + register-cimprovider.exe\" OR process_name==\"tttracer.exe\" OR process_name==\"\ + ie4uinit.exe\" OR process_name==\"sc.exe\" OR process_name==\"bash.exe\" OR process_name==\"\ + hh.exe\" OR process_name==\"cmstp.exe\" OR process_name==\"mmc.exe\" OR process_name==\"\ + jsc.exe\" OR process_name==\"scriptrunner.exe\" OR process_name==\"odbcconf.exe\"\ + \ OR process_name==\"extexport.exe\" OR process_name==\"msdt.exe\" OR process_name==\"\ + diskshadow.exe\" OR process_name==\"extrac32.exe\" OR process_name==\"eventvwr.exe\"\ + \ OR process_name==\"mavinject.exe\" OR process_name==\"regasm.exe\" OR process_name==\"\ + gpscript.exe\" OR process_name==\"rundll32.exe\" OR process_name==\"regsvr32.exe\"\ + \ OR process_name==\"regedit.exe\" OR process_name==\"msiexec.exe\" OR process_name==\"\ + gfxdownloadwrapper.exe\" OR process_name==\"presentationhost.exe\" OR process_name==\"\ + regini.exe\" OR process_name==\"wmic.exe\" OR process_name==\"runonce.exe\" OR process_name==\"\ + syncappvpublishingserver.exe\" OR process_name==\"verclsid.exe\" OR process_name==\"\ + psr.exe\" OR process_name==\"infdefaultinstall.exe\" OR process_name==\"explorer.exe\"\ + \ OR process_name==\"expand.exe\" OR process_name==\"installutil.exe\" OR process_name==\"\ + netsh.exe\" OR process_name==\"wab.exe\" OR process_name==\"dnscmd.exe\" OR process_name==\"\ + at.exe\" OR process_name==\"pcalua.exe\" OR process_name==\"cmdkey.exe\" OR process_name==\"\ + msconfig.exe\" \n| stats count(process_name) as lolbas_counter by device,span(timestamp,\ + \ 300s) \n| eval lolbas_counter=lolbas_counter*1.0 \n| rename window_end as timestamp\ + \ \n| adaptive_threshold algorithm=\"quantile\" value=\"lolbas_counter\" entity=\"\ + device\" window=2419200000L \n| where label AND quantile>0.99 \n| eval start_time\ + \ = window_start, end_time = timestamp, entities = mvappend(device), body=create_map([\"\ + lolbas_counter\", lolbas_counter, \"quantile\", quantile, \"device\", device]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml b/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml index db7700693f..f39d42227a 100644 --- a/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml +++ b/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml @@ -1,28 +1,6 @@ author: Xiao Lin, Splunk datamodel: [] date: '2020-08-25' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: Malicious mails can conduct phishing that induces readers to open attachment, click links or trigger third party service. This detect uses Natural Language Processing (NLP) approach to analyze an email message's content (Sender, Subject and Body) @@ -42,21 +20,10 @@ id: 4b237388-dfa1-41a6-91d4-4de2d598376f known_false_positives: Because of imbalance of anomaly data in training, the model will less likely report false positive. Instead, the model is more prone to false negative. Current best recall score is ~85% -mappings: - cis20: - - CIS 8 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1566 - nist: - - PR.PT - - DE.CM name: Phishing Email Detection by Machine Learning Method - SSA product: - Splunk Behavioral Analytics references: [] -risk: [] savedsearch_annotations: cis20: - CIS 8 @@ -67,26 +34,31 @@ savedsearch_annotations: nist: - PR.PT - DE.CM -search: '| from read_ssa_enriched_events() | eval eventLine=concat(ucast(map_get(input_event, - "From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", " - "), " ", ucast(map_get(input_event, "Content"), "string", " "), " "), - _time=map_get(input_event, "_time") | where eventLine IS NOT NULL | eval mapC={" - ": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40, - ")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49, - "2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58, - ";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67, - "D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76, - "M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85, - "V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94, - "_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g": - 103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o": - 111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w": - 119, "x": 120, "y": 121, "z": 122, "{": 123, "|": 124, "}": 125, "~": 126}, ml_in - = for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i, - 1)), "float") ) | apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v8" - path="s3://smle-experiments/models/phishing_email" | eval probability = mvindex(ml_out, - 0) | where probability > 0.5 | eval start_time=_time, end_time=_time, entities="TBD", - body="TBD" | select probability, body, entities, start_time, end_time | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval eventLine=concat(ucast(map_get(input_event,\ + \ \"From\"), \"string\", \" \"), \" \", ucast(map_get(input_event, \"Subject\"),\ + \ \"string\", \" \"), \" \", ucast(map_get(input_event, \"Content\"), \"string\"\ + , \" \"), \" \ + \ \"), _time=map_get(input_event,\ + \ \"_time\") \n| where eventLine IS NOT NULL \n| eval mapC={\" \": 32, \"!\": 33,\ + \ \"\\\"\": 34, \"#\": 35, \"$\": 36, \"%\": 37, \"&\": 38, \"`\": 39, \"(\": 40,\ + \ \")\": 41, \"*\": 42, \"+\": 43, \",\": 44, \"-\": 45, \".\": 46, \"/\": 47, \"\ + 0\": 48, \"1\": 49, \"2\": 50, \"3\": 51, \"4\": 52, \"5\": 53, \"6\": 54, \"7\"\ + : 55, \"8\": 56, \"9\": 57, \":\": 58, \";\": 59, \"<\": 60, \"=\": 61, \">\": 62,\ + \ \"?\": 63, \"@\": 64, \"A\": 65, \"B\": 66, \"C\": 67, \"D\": 68, \"E\": 69, \"\ + F\": 70, \"G\": 71, \"H\": 72, \"I\": 73, \"J\": 74, \"K\": 75, \"L\": 76, \"M\"\ + : 77, \"N\": 78, \"O\": 79, \"P\": 80, \"Q\": 81, \"R\": 82, \"S\": 83, \"T\": 84,\ + \ \"U\": 85, \"V\": 86, \"W\": 87, \"X\": 88, \"Y\": 89, \"Z\": 90, \"[\": 91, \"\ + \\\\\": 92, \"]\": 93, \"^\": 94, \"_\": 95, \"`\": 96, \"a\": 97, \"b\": 98, \"\ + c\": 99, \"d\": 100, \"e\": 101, \"f\": 102, \"g\": 103, \"h\": 104, \"i\": 105,\ + \ \"j\": 106, \"k\": 107, \"l\": 108, \"m\": 109, \"n\": 110, \"o\": 111, \"p\"\ + : 112, \"q\": 113, \"r\": 114, \"s\": 115, \"t\": 116, \"u\": 117, \"v\": 118, \"\ + w\": 119, \"x\": 120, \"y\": 121, \"z\": 122, \"{\": 123, \"\n|\": 124, \"}\": 125,\ + \ \"~\": 126}, ml_in = for_each(iterator(mvrange(1,129), \"i\"), cast(map_get(mapC,\ + \ substr(eventLine, i, 1)), \"float\") ) \n| apply_model connection_id=\"YOUR_S3_ONNX_CONNECTOR_ID\"\ + \ name=\"phishing_email_v8\" path=\"s3://smle-experiments/models/phishing_email\"\ + \ \n| eval probability = mvindex(ml_out, 0) \n| where probability > 0.5 \n| eval\ + \ start_time=_time, end_time=_time, entities=\"TBD\", body=\"TBD\" \n| select probability,\ + \ body, entities, start_time, end_time \n| into write_ssa_detected_events();" tags: cis20: - CIS 8 diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml index 19defdc846..c5908a22a5 100644 --- a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml +++ b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2021-09-01' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported @@ -32,26 +10,11 @@ how_to_implement: You must be ingesting Windows Security logs from endpoint devi id: 82e76b80-5cdb-4899-9b43-85dbe777b36d known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Lateral Movement - mitre_attack: - - T1550 - - T1550.002 - nist: - - PR.PT - - PR.AT - - PR.AC - - PR.IP name: Potential Pass the Token or Hash Observed at the Destination Device product: - Splunk Behavioral Analytics references: - https://attack.mitre.org/techniques/T1550/002/ -risk: [] risk_message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is performed via credentials of the account $dest_user_id$ and observed by the destination device $dest_device_id$ @@ -87,34 +50,27 @@ savedsearch_annotations: role: - Other type: Hostname -search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, - "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), - "string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), - "string", null)), dest_device_id= lower(ucast(map_get(input_event, "dest_device_id"), - "string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"), - "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), - "string", null)) - - | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") - AND dest_user_id != null AND dest_device_id != null - - | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method - == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) - - | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as - startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as - endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s) - - | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - - startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND - (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) - - | eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime, - "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["total_kerberos", - totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time", - endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime]) - - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp= parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), dest_user= lower(ucast(map_get(input_event,\ + \ \"dest_user_primary_artifact\"), \"string\", null)), dest_user_id= lower(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null)), dest_device_id= lower(ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), signature_id= lower(ucast(map_get(input_event,\ + \ \"signature_id\"), \"string\", null)), authentication_method= lower(ucast(map_get(input_event,\ + \ \"authentication_method\"), \"string\", null))\n\n| where signature_id = \"4624\"\ + \ AND (authentication_method=\"ntlmssp\" OR authentication_method=\"kerberos\")\ + \ AND dest_user_id != null AND dest_device_id != null\n\n| eval isKerberos=if(authentication_method\ + \ == \"kerberos\", 1, 0), isNtlm=if(authentication_method == \"ntlmssp\", 1, 0),\ + \ timeNTLM=if(isNtlm > 0, timestamp, null)\n\n| stats sum(isKerberos) as totalKerberos,\ + \ sum(isNtlm) as totalNtlm, min(timestamp) as startTime, min(timeNTLM) as\ + \ startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as endNTLMTime by dest_user_id,\ + \ dest_user, dest_device_id, span(timestamp, 86400s)\n\n| where NOT dest_user=\"\ + -\" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - startTime > 1800000 AND\ + \ (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND (endTime - startTime)\ + \ > 3 * (endNTLMTime - startNTLMTime)\n\n| eval start_time=ucast(startNTLMTime,\ + \ \"long\", null), end_time=ucast(endNTLMTime, \"long\", null), entities=mvappend(dest_user_id,\ + \ dest_device_id), body=create_map([\"total_kerberos\", totalKerberos, \"total_ntlm\"\ + , totalNtlm, \"analysis_start_time\", startTime, \"analysis_end_time\", endTime,\ + \ \"pth_start_time\", startNTLMTime, \"pth_end_time\", endNTLMTime])\n\n| into write_ssa_detected_events();" tags: analytic_story: - Lateral Movement diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml index 366ec7fda1..2c2f92b9e0 100644 --- a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml +++ b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2021-09-01' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported @@ -34,26 +12,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87 known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Lateral Movement - mitre_attack: - - T1550 - - T1550.002 - nist: - - PR.PT - - PR.AT - - PR.AC - - PR.IP name: Potential Pass the Token or Hash Observed by an Event Collecting Device product: - Splunk Behavioral Analytics references: - https://attack.mitre.org/techniques/T1550/002/ -risk: [] risk_message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is performed via credentials of the account $dest_user_id$ and observed by the logging device $origin_device_id$ @@ -89,34 +52,27 @@ savedsearch_annotations: role: - Other type: Hostname -search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, - "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), - "string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), - "string", null)), origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"), - "string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"), - "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), - "string", null)) - - | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") - AND dest_user_id != null AND origin_device_id != null - - | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method - == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) - - | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as - startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as - endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s) - - | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - - startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND - (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) - - | eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id, - origin_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm", - totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time", - startNTLMTime, "detection_end_time", endNTLMTime]) - - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp= parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), dest_user= lower(ucast(map_get(input_event,\ + \ \"dest_user_primary_artifact\"), \"string\", null)), dest_user_id= lower(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null)), origin_device_id= lower(ucast(map_get(input_event,\ + \ \"origin_device_id\"), \"string\", null)), signature_id= lower(ucast(map_get(input_event,\ + \ \"signature_id\"), \"string\", null)), authentication_method= lower(ucast(map_get(input_event,\ + \ \"authentication_method\"), \"string\", null))\n\n| where signature_id = \"4624\"\ + \ AND (authentication_method=\"ntlmssp\" OR authentication_method=\"kerberos\")\ + \ AND dest_user_id != null AND origin_device_id != null\n\n| eval isKerberos=if(authentication_method\ + \ == \"kerberos\", 1, 0), isNtlm=if(authentication_method == \"ntlmssp\", 1, 0),\ + \ timeNTLM=if(isNtlm > 0, timestamp, null)\n\n| stats sum(isKerberos) as totalKerberos,\ + \ sum(isNtlm) as totalNtlm, min(timestamp) as startTime, min(timeNTLM) as\ + \ startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as endNTLMTime by dest_user_id,\ + \ dest_user, origin_device_id, span(timestamp, 86400s)\n\n| where NOT dest_user=\"\ + -\" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - startTime > 1800000 AND\ + \ (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND (endTime - startTime)\ + \ > 3 * (endNTLMTime - startNTLMTime)\n\n| eval start_time=startNTLMTime, end_time=endNTLMTime,\ + \ entities=mvappend(dest_user_id, origin_device_id), body=create_map([\"total_kerberos\"\ + , totalKerberos, \"total_ntlm\", totalNtlm, \"analysis_start_time\", startTime,\ + \ \"analysis_end_time\", endTime, \"detection_start_time\", startNTLMTime, \"detection_end_time\"\ + , endNTLMTime])\n\n| into write_ssa_detected_events();" tags: analytic_story: - Lateral Movement diff --git a/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml index 17c05fc1f4..83a838da56 100644 --- a/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -1,57 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-04' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of PowerSploit modules that facilitate access probing with admin credentials as well as probing access to system services. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: d405af5d-99f1-45af-8dfb-b8f98b764247 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP name: Probing Access with Stolen Credentials via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 60 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is probing access with stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -89,18 +49,16 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true - OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-AdminAccess/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true OR match_regex(cmd_line,\ + \ /(?i)Test-ServiceDaclPermission/)=true )\n\n| eval start_time = timestamp, end_time\ + \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Privilege Escalation diff --git a/dist/ssa/detections/rare_parent-child_process_relationship.yml b/dist/ssa/detections/rare_parent-child_process_relationship.yml index c9abcfe4e0..4cc2eaa5e4 100644 --- a/dist/ssa/detections/rare_parent-child_process_relationship.yml +++ b/dist/ssa/detections/rare_parent-child_process_relationship.yml @@ -1,28 +1,6 @@ author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk datamodel: [] date: '2021-05-20' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has @@ -34,24 +12,10 @@ known_false_positives: 'Some custom tools used by admins could be used rarely to it hasn''t collected yet enough data to construct the baseline. ' -mappings: - cis20: - - CIS 8 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1203 - - T1059 - - T1053 - - T1072 - nist: - - PR.PT - - DE.CM name: Rare Parent-Child Process Relationship product: - Splunk Behavioral Analytics references: [] -risk: [] savedsearch_annotations: analytic_story: - Unusual Processes @@ -67,47 +31,52 @@ savedsearch_annotations: nist: - PR.PT - DE.CM -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event, - "parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process, - "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string", - null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, - "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where parent_process_name!=null | select parent_process_name, process_name, cmd_line, - timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name" - target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe" - OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe" - OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe" - OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe" - OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe" - OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe" - OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe" - OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe" - OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe" - OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe" - OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe" - OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe" - OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe" - OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe" - OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe" - OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe" - OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe" - OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe" - OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe" - OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe" - OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe" - OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR - process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe" - OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe" - OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe" - OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe") - | eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001 - window=604800000L | where label AND input > mean | eval start_time = timestamp, - end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = - create_map(["process_name", process_name, "parent_process_name", parent_process_name, - "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line", - cmd_line]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| eval parent_process=lower(ucast(map_get(input_event,\ + \ \"parent_process_name\"), \"string\", null)), parent_process_name=mvindex(split(parent_process,\ + \ \"\\\\\"), -1), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\ + , null), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\",\ + \ null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\", null) \n\ + | where parent_process_name!=null \n| select parent_process_name, process_name,\ + \ cmd_line, timestamp, dest_device_id, dest_user_id \n| conditional_anomaly conditional=\"\ + parent_process_name\" target=\"process_name\" \n| where (process_name=\"powershell.exe\"\ + \ OR process_name=\"regsvcs.exe\" OR process_name=\"ftp.exe\" OR process_name=\"\ + dfsvc.exe\" OR process_name=\"rasautou.exe\" OR process_name=\"schtasks.exe\" OR\ + \ process_name=\"xwizard.exe\" OR process_name=\"findstr.exe\" OR process_name=\"\ + esentutl.exe\" OR process_name=\"cscript.exe\" OR process_name=\"reg.exe\" OR process_name=\"\ + csc.exe\" OR process_name=\"atbroker.exe\" OR process_name=\"print.exe\" OR process_name=\"\ + pcwrun.exe\" OR process_name=\"vbc.exe\" OR process_name=\"rpcping.exe\" OR process_name=\"\ + wsreset.exe\" OR process_name=\"ilasm.exe\" OR process_name=\"certutil.exe\" OR\ + \ process_name=\"replace.exe\" OR process_name=\"mshta.exe\" OR process_name=\"\ + bitsadmin.exe\" OR process_name=\"wscript.exe\" OR process_name=\"ieexec.exe\" OR\ + \ process_name=\"cmd.exe\" OR process_name=\"microsoft.workflow.compiler.exe\" OR\ + \ process_name=\"runscripthelper.exe\" OR process_name=\"makecab.exe\" OR process_name=\"\ + forfiles.exe\" OR process_name=\"desktopimgdownldr.exe\" OR process_name=\"control.exe\"\ + \ OR process_name=\"msbuild.exe\" OR process_name=\"register-cimprovider.exe\" OR\ + \ process_name=\"tttracer.exe\" OR process_name=\"ie4uinit.exe\" OR process_name=\"\ + sc.exe\" OR process_name=\"bash.exe\" OR process_name=\"hh.exe\" OR process_name=\"\ + cmstp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"jsc.exe\" OR process_name=\"\ + scriptrunner.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"extexport.exe\"\ + \ OR process_name=\"msdt.exe\" OR process_name=\"diskshadow.exe\" OR process_name=\"\ + extrac32.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"mavinject.exe\"\ + \ OR process_name=\"regasm.exe\" OR process_name=\"gpscript.exe\" OR process_name=\"\ + rundll32.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"regedit.exe\"\ + \ OR process_name=\"msiexec.exe\" OR process_name=\"gfxdownloadwrapper.exe\" OR\ + \ process_name=\"presentationhost.exe\" OR process_name=\"regini.exe\" OR process_name=\"\ + wmic.exe\" OR process_name=\"runonce.exe\" OR process_name=\"syncappvpublishingserver.exe\"\ + \ OR process_name=\"verclsid.exe\" OR process_name=\"psr.exe\" OR process_name=\"\ + infdefaultinstall.exe\" OR process_name=\"explorer.exe\" OR process_name=\"expand.exe\"\ + \ OR process_name=\"installutil.exe\" OR process_name=\"netsh.exe\" OR process_name=\"\ + wab.exe\" OR process_name=\"dnscmd.exe\" OR process_name=\"at.exe\" OR process_name=\"\ + pcalua.exe\" OR process_name=\"cmdkey.exe\" OR process_name=\"msconfig.exe\") \n\ + | eval input = (-1)*log(output) \n| adaptive_threshold algorithm=\"gaussian\" threshold=0.001\ + \ window=604800000L \n| where label AND input > mean \n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body\ + \ = create_map([\"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"input\", input, \"mean\", mean, \"variance\", variance, \"output\", output,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml index 2ff6c7f862..a0cd27b5dc 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-05' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for discovery of accounts and groups and access to them. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 1bce67aa-3fc4-4886-9089-67f0bfebbef6 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1087 - - T1484 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is searching for and using specific accounts and groups. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -92,17 +51,15 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::user/)=true\ + \ OR match_regex(cmd_line, /(?i)net::group/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml index 820d6be3cd..ee09af5fc7 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-05' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that discover accounts, groups and policies that can be accessed or taken over. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 63422f8e-766c-468f-8133-2ba6795e263b known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1087 - - T1484 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is searching for and using specific accounts, groups and policies, such as the last logged on account, a local Net group, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command @@ -93,39 +52,36 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true - OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, - /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true - OR match_regex(cmd_line, /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line, - /(?i)Get-DomainForeignGroupMember/)=true OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true - OR match_regex(cmd_line, /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line, - /(?i)Find-ForeignUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true - OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true - OR match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line, - /(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true - OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line, - /(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true - OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true - OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line, - /(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true - OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true - OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true - OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line, - /(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true - OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line, - /(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true - OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line, - /(?i)Get-LastLoggedOn/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainLocalGroupMember/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true OR match_regex(cmd_line,\ + \ /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, /(?i)Invoke-EventHunter/)=true\ + \ OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true OR match_regex(cmd_line,\ + \ /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line, /(?i)Get-DomainForeignGroupMember/)=true\ + \ OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line, /(?i)Find-ForeignUser/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true OR\ + \ match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line,\ + \ /(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-LastLoggedOn/)=true )\n\n| eval start_time = timestamp, end_time = timestamp,\ + \ entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\"\ + , null), ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)), body=create_map([\"\ + event_id\", event_id, \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml index b6f27005e6..fe51886cbe 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules for reconnaissance and access to elements of Active Directory infrastructure, such as domain identifiers, AD sites and forests, and trust relations. @@ -30,33 +8,12 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: db08ac40-ee14-43e9-9a75-dddd059ef812 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1199 - - T1482 - - T1590 - - T1591 - - T1595 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is seaching for or accessing Active Directory objects such as domain sites, domain trusts, AD forests, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -98,26 +55,24 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR - match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true - OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true - OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line, - /(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true - OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true - OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-NetForestDomain/)=true - OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true OR match_regex(cmd_line, - /(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line, /(?i)Get-ForestTrust/)=true - OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainSID/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR match_regex(cmd_line, /(?i)Get-NetSite/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-NetForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-ForestTrust/)=true OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml index 45ef344b62..e019910150 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that discover computers, servers and domains that can be accessed or taken over. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: fe1c4c5a-09f3-4b43-8129-560a7f38a08b known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1592 - - T1590 - - T1087 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Computers and Domains via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is seaching for or accessing domain controllers, computers, file servers, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -92,22 +51,19 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR - match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true - OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true - OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line, - /(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ComputerDetail/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR match_regex(cmd_line, /(?i)Get-NetDomain/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml index 7c4ed009d8..2de8b461e3 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml @@ -1,56 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for discovery of computers and servers and access to them. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 48664505-7d22-44ee-87d2-4c8a5bdc3d14 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1592 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Computers via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 50 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is collecting information about computers. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -86,17 +47,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)net::ServerInfo/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::ServerInfo/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml index 5126b89eb0..b6ecc600ca 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that discover and access operating system elements, such as processes, services, registry locations, security packages and files. @@ -30,36 +8,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: c1d33ad9-1727-4f9f-a474-4adbe4fed68a known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1057 - - T1083 - - T1592.002 - - T1046 - - T1012 - - T1007 - - T1047 - - T1592 - - T1518 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Operating System Elements via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is searching for and tapping into ongoing processes, mounted drives or other operating system elements. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -105,23 +58,21 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true - OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, - /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR - match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true - OR match_regex(cmd_line, /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true - OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line, - /(?i)Get-RegistryMountedDrive/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainProcess/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, /(?i)Get-WMIProcess/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true\ + \ OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-RegistryMountedDrive/)=true )\n\n| eval start_time = timestamp, end_time\ + \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml index ee99f06077..f13647e4fb 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for discovery and access to services and processes. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 0243d37c-57c1-4182-bfd1-39b212255fc8 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1007 - - T1046 - - T1057 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Processes and Services via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 50 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is listing processes and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ savedsearch_annotations: @@ -89,17 +48,15 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::list/)=true\ + \ OR match_regex(cmd_line, /(?i)service::list/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml index 52748df622..e59fd16b33 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml @@ -1,59 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for discovery and access to network shares. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: c97b6eb9-1d8b-4017-bbbb-2af7fc17bc3f known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1021 - - T1039 - - T1135 - - T1021.002 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Shared Resources via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is searching for and accessing network shares. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -94,17 +52,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)net::share/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::share/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml index ace88f6825..f72b3cbcf8 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml @@ -1,59 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that discover and access network and distributed file system shares. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 6b7ca431-6b1e-4b40-9589-21cb368e369e known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1021 - - T1039 - - T1135 - - T1021.002 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Shared Resources via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is searching for and accessing network shares. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -94,21 +52,19 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true - OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, - /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true - OR match_regex(cmd_line, /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line, - /(?i)Get-DFSshare/)=true OR match_regex(cmd_line, /(?i)Get-NetShare/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainShare/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true OR match_regex(cmd_line,\ + \ /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, /(?i)Invoke-FileFinder/)=true\ + \ OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line, /(?i)Get-DFSshare/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetShare/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml index 4dd8815e53..b10528e22f 100644 --- a/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-05' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of PowerSploit modules that discover opportunities for malicious access and persistence. Some examples include access to admin accounts, weak access control policies, landing paths for dropping malicious software or data @@ -32,33 +10,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 3d8bd7f3-1061-4ac7-9225-6764cc0684d7 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1053 - - T1068 - - T1078 - - T1543 - - T1547 - - T1574 - nist: - - PR.AC - - PR.IP name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 60 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is searching for an entry point into the infrastructure, such as local admin accounts, opportunities to hijack processes, unattended install files, or modifiable access objects. Operation is performed at the device $dest_device_id$, @@ -100,27 +56,24 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true - OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, - /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true - OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line, - /(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true - OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line, - /(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true - OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line, - /(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true - OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line, - /(?i)Get-UnquotedService/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true\ + \ OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line,\ + \ /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true\ + \ OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-ObjectAcl/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableRegistryAutoRun/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableServiceFile/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-UnquotedService/)=true )\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml index 4ee8fedbf5..c448efee2b 100644 --- a/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml @@ -1,59 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules for reconnaissance of connectivity. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 525d32fd-65dd-4732-9b72-3cfc7ddddbd2 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1021 - - T1039 - - T1135 - - T1021.002 - nist: - - PR.AC - - PR.IP name: Reconnaissance of Connectivity via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is performing port scans or searching for various connectivity details such as DNS data, proxies, or ongoing RDP connections. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command @@ -93,23 +51,19 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true - OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line, - /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true - OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line, - /(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true - OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainDNSRecord/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml index b8cd08eaa9..5b6ec5f7ea 100644 --- a/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml @@ -1,63 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies reconnaissance of credential stores and use of CryptoAPI services by Mimikatz modules. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 5facee5b-79e4-47ab-b0e6-c625acc0554f known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1098 - - T1590.001 - - T1078 - - T1589.001 - - T1590 - - T1068 - - T1589 - - T1590.003 - nist: - - PR.AC - - PR.IP name: Reconnaissance of Credential Stores and Services via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is searching for and accessing credential stores. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -101,19 +55,16 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, - /(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true - OR match_regex(cmd_line, /(?i)crypto::sc/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)crypto::capi/)=true\ + \ OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, /(?i)crypto::providers/)=true\ + \ OR match_regex(cmd_line, /(?i)crypto::stores/)=true OR match_regex(cmd_line, /(?i)crypto::sc/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml index 946bc254a4..9193687816 100644 --- a/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml @@ -1,59 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-05' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of PowerSploit modules for assessment of presence of defensive tools. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 24b4e659-63a2-4e7b-89ac-87dd659c7110 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1592.002 - - T1595.002 - - T1592 - - T1595 - nist: - - PR.AC - - PR.IP name: Reconnaissance of Defensive Tools via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 40 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is looking for presence of anti virus software. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -92,17 +50,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Find-AVSignature/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-AVSignature/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml index 0c9dcb0a02..fc3e4e0788 100644 --- a/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-05' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of PowerSploit modules for assessment of privilege escalation opportunities. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: b9b4492c-2af8-449b-beb4-b1b78d963321 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 60 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is engaging its privilege escalation module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -90,17 +49,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Invoke-PrivescAudit/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-PrivescAudit/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml index 1c935ced80..2d3cbadadf 100644 --- a/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-05' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for discovery of process or service hijacking opportunities via Microsoft Detours compatibility. Microsoft Detours is an open source library for intercepting, monitoring and instrumenting @@ -33,31 +11,12 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: fc5c1cbd-7494-4314-aad2-458d6fd4fada known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1543 - - T1055 - - T1574 - nist: - - PR.AC - - PR.IP name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz - https://en.wikipedia.org/wiki/Microsoft_Detours -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is looking for and invoking Microsoft Detours package that enables spoofing of in-memory code. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -97,17 +56,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)misc::detours/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::detours/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/resize_shadowstorage_volume.yml b/dist/ssa/detections/resize_shadowstorage_volume.yml index 57ffdafbaf..b7a6a1f554 100644 --- a/dist/ssa/detections/resize_shadowstorage_volume.yml +++ b/dist/ssa/detections/resize_shadowstorage_volume.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive @@ -36,24 +14,12 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. id: dbc30554-d27e-11eb-9e5e-acde48001122 known_false_positives: network admin can resize the shadowstorage for valid purposes. -mappings: - cis20: - - CIS 10 - - CIS 13 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.DS - - PR.IP name: Resize Shadowstorage Volume product: - Splunk Behavioral Analytics references: - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html -risk: [] savedsearch_annotations: analytic_story: - Clop Ransomware @@ -68,19 +34,19 @@ savedsearch_annotations: nist: - PR.DS - PR.IP -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%") - AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp, - end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), - "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, - "parent_process_name", parent_process_name, "process_path", process_path]) | into - write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%resize%\") AND like(cmd_line,\ + \ \"%shadowstorage%\") AND like(cmd_line, \"%maxsize%\") AND process_name=\"vssadmin.exe\"\ + \ \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - Clop Ransomware diff --git a/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml b/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml index 6f0b603b48..c8cfc0871e 100644 --- a/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml +++ b/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies illegal setting of credentials via DSInternals modules. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: d5ef590f-9bde-49eb-9c63-2f5b62a65b9c known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP name: Setting Credentials via DSInternals modules product: - Splunk Behavioral Analytics references: - https://github.com/MichaelGrafnetter/DSInternals -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: DSInternals malware is accessing, using or setting Active Directory or Azure credentials and accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -92,23 +51,21 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, - "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), - "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true - OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true - OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line, - /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true - OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), process_name=ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\ + , null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true\ + \ OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line,\ + \ /(?i)Set-ADDBAccountPassword/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true\ + \ OR match_regex(cmd_line, /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line,\ + \ /(?i)Set-SamAccountPasswordHash/)=true OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml index df0157fb77..8f8f8ee2b2 100644 --- a/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml +++ b/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies illegal setting of credentials via Mimikatz modules. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: c8b84699-7652-4363-910f-efd1ca82f780 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP name: Setting Credentials via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is accessing, using or setting account credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -91,17 +50,15 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::addsid/)=true\ + \ OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml b/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml index 7c9d4b0d78..4cf8dda9da 100644 --- a/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml +++ b/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies illegal setting of credentials via PowerSploit modules. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 07b2a501-f967-4ddc-9f56-2dce46dfce44 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP name: Setting Credentials via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is setting passwords on Active Directory accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -91,17 +50,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Set-DomainUserPassword/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainUserPassword/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/system_process_running_from_unexpected_location.yml b/dist/ssa/detections/system_process_running_from_unexpected_location.yml index 7722e2d723..66246da68e 100644 --- a/dist/ssa/detections/system_process_running_from_unexpected_location.yml +++ b/dist/ssa/detections/system_process_running_from_unexpected_location.yml @@ -1,28 +1,6 @@ author: Ignacio Bermudez Corrales, Splunk datamodel: [] date: '2020-08-25' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: An attacker tries might try to use different version of a system command without overriding original, or they might try to avoid some detection running the process from a different folder. This detection checks that a list of system processes @@ -32,27 +10,10 @@ description: An attacker tries might try to use different version of a system co how_to_implement: Collect endpoint data such as sysmon or 4688 events. id: 28179107-099a-464a-94d3-08301e6c055f known_false_positives: None -mappings: - cis20: - - CIS 8 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1036 - nist: - - PR.PT - - DE.CM name: System Process Running from Unexpected Location product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 56 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 56 risk_message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default folder path in host $dest_device_id$ savedsearch_annotations: @@ -82,223 +43,249 @@ savedsearch_annotations: role: - Victim type: user -search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, - "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), - "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", - null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", - null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", - null)), event_id=ucast(map_get(input_event, "event_id"), "string", null); - - $cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe" - OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe" - OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe" - OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe" - OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe" - OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe" - OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe" - OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe" - OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe" - OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR - process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR - process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe" - OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR - process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe" - OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe" - OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR - process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe" - OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe" - OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe" - OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe" - OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe" - OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe" - OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe" - OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe" - OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe" - OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR - process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe" - OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe" - OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe" - OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe" - OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe" - OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe" - OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe" - OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe" - OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe" - OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe" - OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe"; - - $cond_2 = | from $ssa_input | where process_name="openwith.exe" OR process_name="optionalfeatures.exe" - OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe" - OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe" - OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe" - OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe" - OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR - process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe" - OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR - process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe" - OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe" - OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe" - OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe" - OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe" - OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe" - OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR - process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe" - OR process_name="settingsynchost.exe" OR process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe" - OR process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe" - OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe" - OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe" - OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe" - OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe" - OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe" - OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe" - OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe" - OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe" - OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe" - OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe" - OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe" - OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR - process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR - process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe" - OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe" - OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe" - OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe" - OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe" - OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe" - OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe" - OR process_name="windowsanytimeupgraderesults.exe"; - - $cond_3 = | from $ssa_input | where process_name="windowsanytimeupgradeui.exe" OR - process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe" - OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe" - OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe" - OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe" - OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe" - OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe" - OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe" - OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe" - OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe" - OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe" - OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe" - OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" - OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe" - OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe" - OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe" - OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe" - OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe" - OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe" - OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe" - OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe" - OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe" - OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe" - OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe" - OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe" - OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe" - OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe" - OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe" - OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe" - OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe" - OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe" - OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe" - OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe" - OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe" - OR process_name="easinvoker.exe" OR process_name="efsui.exe"; - - $cond_4 = | from $ssa_input | where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe" - OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe" - OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe" - OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe" - OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe" - OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe" - OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe" - OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe" - OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe" - OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe" - OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe" - OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe" - OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe" - OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe" - OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe" - OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe" - OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe" - OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe" - OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe" - OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe" - OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe" - OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe" - OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe" - OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe" - OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe" - OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe" - OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe" - OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe" - OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe" - OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe" - OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe" - OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe" - OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe" - OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe"; - - $cond_5 = | from $ssa_input | where process_name="openfiles.exe" OR process_name="osk.exe" - OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe" - OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe" - OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe" - OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe" - OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe" - OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe" - OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe" - OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe" - OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe" - OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe" - OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe" - OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe" - OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe" - OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe" - OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe" - OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" - OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe" - OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe" - OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe" - OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe" - OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe" - OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe" - OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe" - OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe" - OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe" - OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe" - OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe" - OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe" - OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe" - OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe" - OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe" - OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe" - OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe"; - - $cond_6 = | from $ssa_input | where process_name="tracerpt.exe" OR process_name="tscon.exe" - OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe" - OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe" - OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe" - OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe" - OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe" - OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe" - OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe" - OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe" - OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe" - OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe" - OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe" - OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe" - OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe" - OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe" - OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe" - OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe" - OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe" - OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe" - OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe"; - - | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 | - union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false - AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp, - end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", - event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' +search: " $ssa_input = \n| from read_ssa_enriched_events() \n| eval device=ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null), user=ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), timestamp=parse_long(ucast(map_get(input_event, \"_time\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=lower(ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null)), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null);\n$cond_1 = \n| from $ssa_input \n| where process_name=\"arp.exe\" OR process_name=\"\ + adaptertroubleshooter.exe\" OR process_name=\"applicationframehost.exe\" OR process_name=\"\ + atbroker.exe\" OR process_name=\"authhost.exe\" OR process_name=\"autoworkplace.exe\"\ + \ OR process_name=\"axinstui.exe\" OR process_name=\"backgroundtransferhost.exe\"\ + \ OR process_name=\"bdehdcfg.exe\" OR process_name=\"bdeuisrv.exe\" OR process_name=\"\ + bdeunlockwizard.exe\" OR process_name=\"bitlockerdeviceencryption.exe\" OR process_name=\"\ + bitlockerwizard.exe\" OR process_name=\"bitlockerwizardelev.exe\" OR process_name=\"\ + bytecodegenerator.exe\" OR process_name=\"camerasettingsuihost.exe\" OR process_name=\"\ + castsrv.exe\" OR process_name=\"certenrollctrl.exe\" OR process_name=\"checknetisolation.exe\"\ + \ OR process_name=\"clipup.exe\" OR process_name=\"cloudexperiencehostbroker.exe\"\ + \ OR process_name=\"cloudnotifications.exe\" OR process_name=\"cloudstoragewizard.exe\"\ + \ OR process_name=\"compmgmtlauncher.exe\" OR process_name=\"compattelrunner.exe\"\ + \ OR process_name=\"computerdefaults.exe\" OR process_name=\"credentialuibroker.exe\"\ + \ OR process_name=\"dfdwiz.exe\" OR process_name=\"dwwin.exe\" OR process_name=\"\ + dataexchangehost.exe\" OR process_name=\"defrag.exe\" OR process_name=\"devicedisplayobjectprovider.exe\"\ + \ OR process_name=\"deviceeject.exe\" OR process_name=\"deviceenroller.exe\" OR\ + \ process_name=\"devicepairingwizard.exe\" OR process_name=\"deviceproperties.exe\"\ + \ OR process_name=\"disksnapshot.exe\" OR process_name=\"dism.exe\" OR process_name=\"\ + displayswitch.exe\" OR process_name=\"dmnotificationbroker.exe\" OR process_name=\"\ + dmomacpmo.exe\" OR process_name=\"dpiscaling.exe\" OR process_name=\"dsmusertask.exe\"\ + \ OR process_name=\"dxpserver.exe\" OR process_name=\"edpcleanup.exe\" OR process_name=\"\ + eosnotify.exe\" OR process_name=\"eap3host.exe\" OR process_name=\"easpoliciesbrokerhost.exe\"\ + \ OR process_name=\"easeofaccessdialog.exe\" OR process_name=\"ehstorauthn.exe\"\ + \ OR process_name=\"fxscover.exe\" OR process_name=\"fxssvc.exe\" OR process_name=\"\ + fxsunatd.exe\" OR process_name=\"filehistory.exe\" OR process_name=\"fondue.exe\"\ + \ OR process_name=\"gamepanel.exe\" OR process_name=\"genvalobj.exe\" OR process_name=\"\ + gettingstarted.exe\" OR process_name=\"hostname.exe\" OR process_name=\"icsentitlementhost.exe\"\ + \ OR process_name=\"infdefaultinstall.exe\" OR process_name=\"installagent.exe\"\ + \ OR process_name=\"languagecomponentsinstallercomhandler.exe\" OR process_name=\"\ + launchtm.exe\" OR process_name=\"launchwinapp.exe\" OR process_name=\"legacynetuxhost.exe\"\ + \ OR process_name=\"licensemanagershellext.exe\" OR process_name=\"licensingui.exe\"\ + \ OR process_name=\"locationnotificationwindows.exe\" OR process_name=\"locationnotifications.exe\"\ + \ OR process_name=\"locator.exe\" OR process_name=\"lockapphost.exe\" OR process_name=\"\ + lockscreencontentserver.exe\" OR process_name=\"logonui.exe\" OR process_name=\"\ + lsaiso.exe\" OR process_name=\"mdeserver.exe\" OR process_name=\"mdmagent.exe\"\ + \ OR process_name=\"mdmappinstaller.exe\" OR process_name=\"mrinfo.exe\" OR process_name=\"\ + mrt.exe\" OR process_name=\"mschedexe.exe\" OR process_name=\"magnify.exe\" OR process_name=\"\ + mbaeparsertask.exe\" OR process_name=\"mdres.exe\" OR process_name=\"mdsched.exe\"\ + \ OR process_name=\"migautoplay.exe\" OR process_name=\"mpsigstub.exe\" OR process_name=\"\ + msspellcheckinghost.exe\" OR process_name=\"muiunattend.exe\" OR process_name=\"\ + multidigimon.exe\" OR process_name=\"musnotification.exe\" OR process_name=\"musnotificationux.exe\"\ + \ OR process_name=\"napstat.exe\" OR process_name=\"netstat.exe\" OR process_name=\"\ + narrator.exe\" OR process_name=\"netcfgnotifyobjecthost.exe\" OR process_name=\"\ + netevtfwdr.exe\" OR process_name=\"netproj.exe\" OR process_name=\"netplwiz.exe\"\ + \ OR process_name=\"networkuxbroker.exe\";\n$cond_2 = \n| from $ssa_input \n| where\ + \ process_name=\"openwith.exe\" OR process_name=\"optionalfeatures.exe\" OR process_name=\"\ + pathping.exe\" OR process_name=\"ping.exe\" OR process_name=\"passwordonwakesettingflyout.exe\"\ + \ OR process_name=\"pickerhost.exe\" OR process_name=\"pkgmgr.exe\" OR process_name=\"\ + pnpunattend.exe\" OR process_name=\"pnputil.exe\" OR process_name=\"presentationhost.exe\"\ + \ OR process_name=\"presentationsettings.exe\" OR process_name=\"printbrmui.exe\"\ + \ OR process_name=\"printdialoghost.exe\" OR process_name=\"printdialoghost3d.exe\"\ + \ OR process_name=\"printisolationhost.exe\" OR process_name=\"proximityuxhost.exe\"\ + \ OR process_name=\"rdspnf.exe\" OR process_name=\"rmactivate.exe\" OR process_name=\"\ + rmactivate_isv.exe\" OR process_name=\"rmactivate_ssp.exe\" OR process_name=\"rmactivate_ssp_isv.exe\"\ + \ OR process_name=\"route.exe\" OR process_name=\"rdpsa.exe\" OR process_name=\"\ + rdpsaproxy.exe\" OR process_name=\"rdpsauachelper.exe\" OR process_name=\"reagentc.exe\"\ + \ OR process_name=\"recoverydrive.exe\" OR process_name=\"register-cimprovider.exe\"\ + \ OR process_name=\"registeriepkeys.exe\" OR process_name=\"relpost.exe\" OR process_name=\"\ + remoteposworker.exe\" OR process_name=\"rmclient.exe\" OR process_name=\"robocopy.exe\"\ + \ OR process_name=\"rpcping.exe\" OR process_name=\"runlegacycplelevated.exe\" OR\ + \ process_name=\"runtimebroker.exe\" OR process_name=\"sihclient.exe\" OR process_name=\"\ + searchfilterhost.exe\" OR process_name=\"searchindexer.exe\" OR process_name=\"\ + searchprotocolhost.exe\" OR process_name=\"secedit.exe\" OR process_name=\"sensordataservice.exe\"\ + \ OR process_name=\"setieinstalleddate.exe\" OR process_name=\"settingsynchost.exe\"\ + \ OR process_name=\"slidetoshutdown.exe\" OR process_name=\"smartscreensettings.exe\"\ + \ OR process_name=\"sndvol.exe\" OR process_name=\"snippingtool.exe\" OR process_name=\"\ + soundrecorder.exe\" OR process_name=\"spaceagent.exe\" OR process_name=\"sppextcomobj.exe\"\ + \ OR process_name=\"srtasks.exe\" OR process_name=\"stikynot.exe\" OR process_name=\"\ + synchost.exe\" OR process_name=\"sysreseterr.exe\" OR process_name=\"systempropertiesadvanced.exe\"\ + \ OR process_name=\"systempropertiescomputername.exe\" OR process_name=\"systempropertiesdataexecutionprevention.exe\"\ + \ OR process_name=\"systempropertieshardware.exe\" OR process_name=\"systempropertiesperformance.exe\"\ + \ OR process_name=\"systempropertiesprotection.exe\" OR process_name=\"systempropertiesremote.exe\"\ + \ OR process_name=\"systemsettingsadminflows.exe\" OR process_name=\"systemsettingsbroker.exe\"\ + \ OR process_name=\"systemsettingsremovedevice.exe\" OR process_name=\"tcpsvcs.exe\"\ + \ OR process_name=\"tracert.exe\" OR process_name=\"tstheme.exe\" OR process_name=\"\ + tswbprxy.exe\" OR process_name=\"tapiunattend.exe\" OR process_name=\"taskmgr.exe\"\ + \ OR process_name=\"thumbnailextractionhost.exe\" OR process_name=\"tokenbrokercookies.exe\"\ + \ OR process_name=\"tpminit.exe\" OR process_name=\"tswpfwrp.exe\" OR process_name=\"\ + ui0detect.exe\" OR process_name=\"upgraderesultsui.exe\" OR process_name=\"useraccountbroker.exe\"\ + \ OR process_name=\"useraccountcontrolsettings.exe\" OR process_name=\"usoclient.exe\"\ + \ OR process_name=\"utilman.exe\" OR process_name=\"vssvc.exe\" OR process_name=\"\ + vaultcmd.exe\" OR process_name=\"vaultsysui.exe\" OR process_name=\"wfs.exe\" OR\ + \ process_name=\"wmpdmc.exe\" OR process_name=\"wpdshextautoplay.exe\" OR process_name=\"\ + wscollect.exe\" OR process_name=\"wsmanhttpconfig.exe\" OR process_name=\"wsreset.exe\"\ + \ OR process_name=\"wudfhost.exe\" OR process_name=\"wwahost.exe\" OR process_name=\"\ + wallpaperhost.exe\" OR process_name=\"webcache.exe\" OR process_name=\"werfault.exe\"\ + \ OR process_name=\"werfaultsecure.exe\" OR process_name=\"winsat.exe\" OR process_name=\"\ + windows.media.backgroundplayback.exe\" OR process_name=\"windowsactiondialog.exe\"\ + \ OR process_name=\"windowsanytimeupgrade.exe\" OR process_name=\"windowsanytimeupgraderesults.exe\"\ + ;\n$cond_3 = \n| from $ssa_input \n| where process_name=\"windowsanytimeupgradeui.exe\"\ + \ OR process_name=\"windowsupdateelevatedinstaller.exe\" OR process_name=\"workfolders.exe\"\ + \ OR process_name=\"wpcmon.exe\" OR process_name=\"acu.exe\" OR process_name=\"\ + aitagent.exe\" OR process_name=\"aitstatic.exe\" OR process_name=\"alg.exe\" OR\ + \ process_name=\"appidcertstorecheck.exe\" OR process_name=\"appidpolicyconverter.exe\"\ + \ OR process_name=\"at.exe\" OR process_name=\"attrib.exe\" OR process_name=\"audiodg.exe\"\ + \ OR process_name=\"auditpol.exe\" OR process_name=\"autochk.exe\" OR process_name=\"\ + autoconv.exe\" OR process_name=\"autofmt.exe\" OR process_name=\"baaupdate.exe\"\ + \ OR process_name=\"backgroundtaskhost.exe\" OR process_name=\"bcastdvr.exe\" OR\ + \ process_name=\"bcdboot.exe\" OR process_name=\"bcdedit.exe\" OR process_name=\"\ + bdechangepin.exe\" OR process_name=\"bdeunlock.exe\" OR process_name=\"bitsadmin.exe\"\ + \ OR process_name=\"bootcfg.exe\" OR process_name=\"bootim.exe\" OR process_name=\"\ + bootsect.exe\" OR process_name=\"bridgeunattend.exe\" OR process_name=\"browser_broker.exe\"\ + \ OR process_name=\"bthudtask.exe\" OR process_name=\"cacls.exe\" OR process_name=\"\ + calc.exe\" OR process_name=\"cdpreference.exe\" OR process_name=\"certreq.exe\"\ + \ OR process_name=\"certutil.exe\" OR process_name=\"change.exe\" OR process_name=\"\ + changepk.exe\" OR process_name=\"charmap.exe\" OR process_name=\"chglogon.exe\"\ + \ OR process_name=\"chgport.exe\" OR process_name=\"chgusr.exe\" OR process_name=\"\ + chkdsk.exe\" OR process_name=\"chkntfs.exe\" OR process_name=\"choice.exe\" OR process_name=\"\ + cipher.exe\" OR process_name=\"cleanmgr.exe\" OR process_name=\"cliconfg.exe\" OR\ + \ process_name=\"clip.exe\" OR process_name=\"cmd.exe\" OR process_name=\"cmdkey.exe\"\ + \ OR process_name=\"cmdl32.exe\" OR process_name=\"cmmon32.exe\" OR process_name=\"\ + cmstp.exe\" OR process_name=\"cofire.exe\" OR process_name=\"colorcpl.exe\" OR process_name=\"\ + comp.exe\" OR process_name=\"compact.exe\" OR process_name=\"conhost.exe\" OR process_name=\"\ + consent.exe\" OR process_name=\"control.exe\" OR process_name=\"convert.exe\" OR\ + \ process_name=\"credwiz.exe\" OR process_name=\"cscript.exe\" OR process_name=\"\ + csrss.exe\" OR process_name=\"ctfmon.exe\" OR process_name=\"cttune.exe\" OR process_name=\"\ + cttunesvr.exe\" OR process_name=\"dashost.exe\" OR process_name=\"dccw.exe\" OR\ + \ process_name=\"dcomcnfg.exe\" OR process_name=\"ddodiag.exe\" OR process_name=\"\ + dfrgui.exe\" OR process_name=\"dialer.exe\" OR process_name=\"diantz.exe\" OR process_name=\"\ + dinotify.exe\" OR process_name=\"diskpart.exe\" OR process_name=\"diskperf.exe\"\ + \ OR process_name=\"diskraid.exe\" OR process_name=\"dispdiag.exe\" OR process_name=\"\ + djoin.exe\" OR process_name=\"dllhost.exe\" OR process_name=\"dllhst3g.exe\" OR\ + \ process_name=\"dmcertinst.exe\" OR process_name=\"dmcfghost.exe\" OR process_name=\"\ + dmclient.exe\" OR process_name=\"dnscacheugc.exe\" OR process_name=\"doskey.exe\"\ + \ OR process_name=\"dpapimig.exe\" OR process_name=\"dpnsvr.exe\" OR process_name=\"\ + driverquery.exe\" OR process_name=\"drvcfg.exe\" OR process_name=\"drvinst.exe\"\ + \ OR process_name=\"dsregcmd.exe\" OR process_name=\"dstokenclean.exe\" OR process_name=\"\ + dvdplay.exe\" OR process_name=\"dvdupgrd.exe\" OR process_name=\"dwm.exe\" OR process_name=\"\ + dxdiag.exe\" OR process_name=\"easinvoker.exe\" OR process_name=\"efsui.exe\";\n\ + $cond_4 = \n| from $ssa_input \n| where process_name=\"embeddedapplauncher.exe\"\ + \ OR process_name=\"esentutl.exe\" OR process_name=\"eudcedit.exe\" OR process_name=\"\ + eventcreate.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"expand.exe\"\ + \ OR process_name=\"extrac32.exe\" OR process_name=\"fc.exe\" OR process_name=\"\ + fhmanagew.exe\" OR process_name=\"find.exe\" OR process_name=\"findstr.exe\" OR\ + \ process_name=\"finger.exe\" OR process_name=\"fixmapi.exe\" OR process_name=\"\ + fltmc.exe\" OR process_name=\"fodhelper.exe\" OR process_name=\"fontdrvhost.exe\"\ + \ OR process_name=\"fontview.exe\" OR process_name=\"forfiles.exe\" OR process_name=\"\ + fsavailux.exe\" OR process_name=\"fsquirt.exe\" OR process_name=\"fsutil.exe\" OR\ + \ process_name=\"ftp.exe\" OR process_name=\"fvenotify.exe\" OR process_name=\"\ + fveprompt.exe\" OR process_name=\"getmac.exe\" OR process_name=\"gpresult.exe\"\ + \ OR process_name=\"gpscript.exe\" OR process_name=\"gpupdate.exe\" OR process_name=\"\ + grpconv.exe\" OR process_name=\"hdwwiz.exe\" OR process_name=\"help.exe\" OR process_name=\"\ + hwrcomp.exe\" OR process_name=\"hwrreg.exe\" OR process_name=\"icacls.exe\" OR process_name=\"\ + icardagt.exe\" OR process_name=\"icsunattend.exe\" OR process_name=\"ie4uinit.exe\"\ + \ OR process_name=\"ieunatt.exe\" OR process_name=\"ieetwcollector.exe\" OR process_name=\"\ + iexpress.exe\" OR process_name=\"immersivetpmvscmgrsvr.exe\" OR process_name=\"\ + ipconfig.exe\" OR process_name=\"irftp.exe\" OR process_name=\"iscsicli.exe\" OR\ + \ process_name=\"iscsicpl.exe\" OR process_name=\"isoburn.exe\" OR process_name=\"\ + klist.exe\" OR process_name=\"ksetup.exe\" OR process_name=\"ktmutil.exe\" OR process_name=\"\ + label.exe\" OR process_name=\"licensingdiag.exe\" OR process_name=\"lodctr.exe\"\ + \ OR process_name=\"logagent.exe\" OR process_name=\"logman.exe\" OR process_name=\"\ + logoff.exe\" OR process_name=\"lpkinstall.exe\" OR process_name=\"lpksetup.exe\"\ + \ OR process_name=\"lpremove.exe\" OR process_name=\"lsass.exe\" OR process_name=\"\ + lsm.exe\" OR process_name=\"makecab.exe\" OR process_name=\"manage-bde.exe\" OR\ + \ process_name=\"mblctr.exe\" OR process_name=\"mcbuilder.exe\" OR process_name=\"\ + mctadmin.exe\" OR process_name=\"mfpmp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"\ + mobsync.exe\" OR process_name=\"mountvol.exe\" OR process_name=\"mpnotify.exe\"\ + \ OR process_name=\"msconfig.exe\" OR process_name=\"msdt.exe\" OR process_name=\"\ + msdtc.exe\" OR process_name=\"msfeedssync.exe\" OR process_name=\"msg.exe\" OR process_name=\"\ + mshta.exe\" OR process_name=\"msiexec.exe\" OR process_name=\"msinfo32.exe\" OR\ + \ process_name=\"mspaint.exe\" OR process_name=\"msra.exe\" OR process_name=\"mstsc.exe\"\ + \ OR process_name=\"mtstocom.exe\" OR process_name=\"nbtstat.exe\" OR process_name=\"\ + ndadmin.exe\" OR process_name=\"net.exe\" OR process_name=\"net1.exe\" OR process_name=\"\ + netbtugc.exe\" OR process_name=\"netcfg.exe\" OR process_name=\"netiougc.exe\" OR\ + \ process_name=\"netsh.exe\" OR process_name=\"newdev.exe\" OR process_name=\"nltest.exe\"\ + \ OR process_name=\"notepad.exe\" OR process_name=\"nslookup.exe\" OR process_name=\"\ + ntoskrnl.exe\" OR process_name=\"ntprint.exe\" OR process_name=\"ocsetup.exe\" OR\ + \ process_name=\"odbcad32.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"\ + omadmclient.exe\" OR process_name=\"omadmprc.exe\";\n$cond_5 = \n| from $ssa_input\ + \ \n| where process_name=\"openfiles.exe\" OR process_name=\"osk.exe\" OR process_name=\"\ + p2phost.exe\" OR process_name=\"pcalua.exe\" OR process_name=\"pcaui.exe\" OR process_name=\"\ + pcawrk.exe\" OR process_name=\"pcwrun.exe\" OR process_name=\"perfmon.exe\" OR process_name=\"\ + phoneactivate.exe\" OR process_name=\"plasrv.exe\" OR process_name=\"poqexec.exe\"\ + \ OR process_name=\"powercfg.exe\" OR process_name=\"prevhost.exe\" OR process_name=\"\ + print.exe\" OR process_name=\"printfilterpipelinesvc.exe\" OR process_name=\"printui.exe\"\ + \ OR process_name=\"proquota.exe\" OR process_name=\"provtool.exe\" OR process_name=\"\ + psr.exe\" OR process_name=\"pwlauncher.exe\" OR process_name=\"qappsrv.exe\" OR\ + \ process_name=\"qprocess.exe\" OR process_name=\"query.exe\" OR process_name=\"\ + quser.exe\" OR process_name=\"qwinsta.exe\" OR process_name=\"rasautou.exe\" OR\ + \ process_name=\"rasdial.exe\" OR process_name=\"raserver.exe\" OR process_name=\"\ + rasphone.exe\" OR process_name=\"rdpclip.exe\" OR process_name=\"rdpinput.exe\"\ + \ OR process_name=\"rdrleakdiag.exe\" OR process_name=\"recdisc.exe\" OR process_name=\"\ + recover.exe\" OR process_name=\"reg.exe\" OR process_name=\"regedt32.exe\" OR process_name=\"\ + regini.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"rekeywiz.exe\" OR\ + \ process_name=\"relog.exe\" OR process_name=\"repair-bde.exe\" OR process_name=\"\ + replace.exe\" OR process_name=\"reset.exe\" OR process_name=\"resmon.exe\" OR process_name=\"\ + rmttpmvscmgrsvr.exe\" OR process_name=\"rrinstaller.exe\" OR process_name=\"rstrui.exe\"\ + \ OR process_name=\"runas.exe\" OR process_name=\"rundll32.exe\" OR process_name=\"\ + runonce.exe\" OR process_name=\"rwinsta.exe\" OR process_name=\"sbunattend.exe\"\ + \ OR process_name=\"sc.exe\" OR process_name=\"schtasks.exe\" OR process_name=\"\ + sdbinst.exe\" OR process_name=\"sdchange.exe\" OR process_name=\"sdclt.exe\" OR\ + \ process_name=\"sdiagnhost.exe\" OR process_name=\"secinit.exe\" OR process_name=\"\ + services.exe\" OR process_name=\"sessionmsg.exe\" OR process_name=\"sethc.exe\"\ + \ OR process_name=\"setspn.exe\" OR process_name=\"setupcl.exe\" OR process_name=\"\ + setupugc.exe\" OR process_name=\"setx.exe\" OR process_name=\"sfc.exe\" OR process_name=\"\ + shadow.exe\" OR process_name=\"shrpubw.exe\" OR process_name=\"shutdown.exe\" OR\ + \ process_name=\"sigverif.exe\" OR process_name=\"sihost.exe\" OR process_name=\"\ + slui.exe\" OR process_name=\"smss.exe\" OR process_name=\"snmptrap.exe\" OR process_name=\"\ + sort.exe\" OR process_name=\"spinstall.exe\" OR process_name=\"spoolsv.exe\" OR\ + \ process_name=\"sppsvc.exe\" OR process_name=\"spreview.exe\" OR process_name=\"\ + srdelayed.exe\" OR process_name=\"subst.exe\" OR process_name=\"svchost.exe\" OR\ + \ process_name=\"sxstrace.exe\" OR process_name=\"syskey.exe\" OR process_name=\"\ + systeminfo.exe\" OR process_name=\"systemreset.exe\" OR process_name=\"systray.exe\"\ + \ OR process_name=\"tabcal.exe\" OR process_name=\"takeown.exe\" OR process_name=\"\ + taskeng.exe\" OR process_name=\"taskhost.exe\" OR process_name=\"taskhostw.exe\"\ + \ OR process_name=\"taskkill.exe\" OR process_name=\"tasklist.exe\" OR process_name=\"\ + taskmgr.exe\" OR process_name=\"tcmsetup.exe\" OR process_name=\"timeout.exe\" OR\ + \ process_name=\"tpmvscmgr.exe\" OR process_name=\"tpmvscmgrsvr.exe\";\n$cond_6\ + \ = \n| from $ssa_input \n| where process_name=\"tracerpt.exe\" OR process_name=\"\ + tscon.exe\" OR process_name=\"tsdiscon.exe\" OR process_name=\"tskill.exe\" OR process_name=\"\ + typeperf.exe\" OR process_name=\"tzsync.exe\" OR process_name=\"tzutil.exe\" OR\ + \ process_name=\"ucsvc.exe\" OR process_name=\"unlodctr.exe\" OR process_name=\"\ + unregmp2.exe\" OR process_name=\"upnpcont.exe\" OR process_name=\"userinit.exe\"\ + \ OR process_name=\"vds.exe\" OR process_name=\"vdsldr.exe\" OR process_name=\"\ + verclsid.exe\" OR process_name=\"verifier.exe\" OR process_name=\"verifiergui.exe\"\ + \ OR process_name=\"vmicsvc.exe\" OR process_name=\"vssadmin.exe\" OR process_name=\"\ + w32tm.exe\" OR process_name=\"waitfor.exe\" OR process_name=\"wbadmin.exe\" OR process_name=\"\ + wbengine.exe\" OR process_name=\"wecutil.exe\" OR process_name=\"wermgr.exe\" OR\ + \ process_name=\"wevtutil.exe\" OR process_name=\"wextract.exe\" OR process_name=\"\ + where.exe\" OR process_name=\"whoami.exe\" OR process_name=\"wiaacmgr.exe\" OR process_name=\"\ + wiawow64.exe\" OR process_name=\"wifitask.exe\" OR process_name=\"wimserv.exe\"\ + \ OR process_name=\"wininit.exe\" OR process_name=\"winload.exe\" OR process_name=\"\ + winlogon.exe\" OR process_name=\"winresume.exe\" OR process_name=\"winrs.exe\" OR\ + \ process_name=\"winrshost.exe\" OR process_name=\"winver.exe\" OR process_name=\"\ + wisptis.exe\" OR process_name=\"wkspbroker.exe\" OR process_name=\"wksprt.exe\"\ + \ OR process_name=\"wlanext.exe\" OR process_name=\"wlrmdr.exe\" OR process_name=\"\ + wowreg32.exe\" OR process_name=\"wpnpinst.exe\" OR process_name=\"wpr.exe\" OR process_name=\"\ + write.exe\" OR process_name=\"wscript.exe\" OR process_name=\"wsmprovhost.exe\"\ + \ OR process_name=\"wsqmcons.exe\" OR process_name=\"wuapihost.exe\" OR process_name=\"\ + wuapp.exe\" OR process_name=\"wuauclt.exe\" OR process_name=\"wusa.exe\" OR process_name=\"\ + xcopy.exe\" OR process_name=\"xpsrchvw.exe\" OR process_name=\"xwizard.exe\";\n\n\ + | from $cond_1 \n| union $cond_2 \n| union $cond_3 \n| union $cond_4 \n| union $cond_5\ + \ \n| union $cond_6 \n| where match_regex(process_path, /(?i)\\\\windows\\\\system32/)=false\ + \ AND match_regex(process_path, /(?i)\\\\windows\\\\syswow64/)=false \n| eval start_time=timestamp,\ + \ end_time=timestamp, entities=mvappend(device, user), body=create_map([\"event_id\"\ + , event_id, \"process_path\", process_path, \"process_name\", process_name]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Defense Evasion Tactics diff --git a/dist/ssa/detections/unusually_long_command_line.yml b/dist/ssa/detections/unusually_long_command_line.yml index 9338c1af46..a91f69f5ed 100644 --- a/dist/ssa/detections/unusually_long_command_line.yml +++ b/dist/ssa/detections/unusually_long_command_line.yml @@ -1,28 +1,6 @@ author: Ignacio Bermudez Corrales, Splunk datamodel: [] date: '2020-10-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin to help identify command lines with lengths that are unusual for a given user. This @@ -36,25 +14,10 @@ known_false_positives: This detection may flag suspiciously long command lines w for the tracked process. Also, some legitimate applications may use long command lines. Such is the case of Ansible, that encodes Powershell scripts using long base64. Attackers may use this technique to obfuscate their payloads. -mappings: - cis20: - - CIS 8 - kill_chain_phases: - - Actions on Objectives - nist: - - PR.PT - - DE.CM name: Unusually Long Command Line product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 12 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 12 risk_message: A process $process_name$ with a long commandline $cmd_line$ executed in host $dest_device_id$ savedsearch_annotations: @@ -81,20 +44,23 @@ savedsearch_annotations: role: - Victim type: user -search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"), - "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), - process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval - cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, - /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm, - ""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line, - input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 - | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id", - "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp, - end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", - event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| eval cmd_line=ucast(map_get(input_event, \"\ + process\"), \"string\", null), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line!=null and dest_user_id!=null \n| eval cmd_line_norm=replace(cast(cmd_line,\ + \ \"string\"), /\\s(--?\\w+)\n|(\\/\\w+)/, \" ARG\"), cmd_line_norm=replace(cmd_line_norm,\ + \ /\\w:\\\\[^\\s]+/, \"PATH\"), cmd_line_norm=replace(cmd_line_norm, /\\d+/, \"\ + N\"), input=parse_double(len(coalesce(cmd_line_norm, \"\"))) \n| select timestamp,\ + \ process_name, dest_device_id, dest_user_id, cmd_line, input \n| adaptive_threshold\ + \ algorithm=\"quantile\" entity=\"process_name\" window=60480000 \n| where label\ + \ AND quantile>0.99 \n| first_time_event input_columns=[\"dest_device_id\", \"cmd_line\"\ + ] \n| where first_time_dest_device_id_cmd_line \n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map([\"\ + event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml b/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml index df1f647b78..04b8afba0e 100644 --- a/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-15' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, or system event logs. @@ -35,30 +13,11 @@ how_to_implement: You must be ingesting data that records process activity from id: 5438113c-cdd9-11eb-93b8-acde48001122 known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. -mappings: - cis20: - - CIS 8 - - CIS 13 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1070 - - T1070.001 - nist: - - PR.DS - - PR.IP name: WevtUtil Usage To Clear Logs product: - Splunk Behavioral Analytics references: - https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 63 risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear event logs in host $dest_device_id$ savedsearch_annotations: @@ -91,20 +50,21 @@ savedsearch_annotations: role: - Victim type: user -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, - /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line, - /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, - /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"% cl %\") AND (match_regex(cmd_line,\ + \ /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,\ + \ /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,\ + \ /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name=\"\ + wevtutil.exe\" \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Log Manipulation diff --git a/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml b/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml index bc72c7e903..6bc759ee40 100644 --- a/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-15' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections in compromised host. @@ -35,30 +13,11 @@ how_to_implement: You must be ingesting data that records process activity from id: a4bdc944-cdd9-11eb-ac97-acde48001122 known_false_positives: network operator may disable audit event logs for debugging purposes. -mappings: - cis20: - - CIS 8 - - CIS 13 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1070 - - T1070.001 - nist: - - PR.DS - - PR.IP name: Wevtutil Usage To Disable Logs product: - Splunk Behavioral Analytics references: - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 63 risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable event logs in host $dest_device_id$ savedsearch_annotations: @@ -90,17 +49,19 @@ savedsearch_annotations: role: - Victim type: user -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, - "%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, - entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, - "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", - cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, - "process_path", process_path]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"% sl %\") AND like(cmd_line,\ + \ \"%/e:false%\") AND process_name=\"wevtutil.exe\" \n| eval start_time=timestamp,\ + \ end_time=timestamp, entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ + , process_name, \"parent_process_name\", parent_process_name, \"process_path\",\ + \ process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Log Manipulation