From 62e859ba7b7407a9418d9b64f1869f579ffe8dd4 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 May 2023 16:30:18 -0400 Subject: [PATCH 1/2] correlation for priv esc --- ...ectory_privilege_escalation_identified.yml | 58 +++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 detections/endpoint/active_directory_privilege_escalation_identified.yml diff --git a/detections/endpoint/active_directory_privilege_escalation_identified.yml b/detections/endpoint/active_directory_privilege_escalation_identified.yml new file mode 100644 index 0000000000..3c54901881 --- /dev/null +++ b/detections/endpoint/active_directory_privilege_escalation_identified.yml @@ -0,0 +1,58 @@ +name: Active Directory Privilege Escalation Identified +id: 583e8a68-f2f7-45be-8fc9-bf725f0e22fd +version: 1 +date: '2023-05-23' +author: Mauricio Velazco, Splunk +status: production +type: Correlation +data_source: [] +description: The primary objective of this correlation rule is to detect and alert on potential privilege escalation activities within an organization's Active Directory (AD) environment. By identifying multiple analytics associated with the Active Directory Privilege Escalation analytic story, security analysts can gain better insight into possible threats and respond accordingly to mitigate risks. + The correlation rule will trigger an alert when multiple analytics from the Active Directory Privilege Escalation analytic story are detected within a specified time frame. + The rule will generate an alert if a predetermined threshold of correlated analytics is reached within the specified time frame. This threshold can be customized to suit the needs and risk appetite of the organization. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Active Directory Privilege Escalation" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic + | `drop_dm_object_name(All_Risk)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | where source_count >= 4 + | `active_directory_lateral_movement_identified_filter`' +how_to_implement: Splunk Enterprise Security is required to utilize this correlation. In addition, modify the source_count value to your environment. In our testing, a count of 4 or 5 was decent in a lab, but the number may need to be increased as the analytic story includes over 30 analytics. In addition, based on false positives, modify any analytics to be anomaly and lower or increase risk based on organization importance. +known_false_positives: False positives will most likely be present based on risk scoring and how the organization handles system to system communication. Filter, or modify as needed. In addition to count by analytics, adding a risk score may be useful. In our testing, with 22 events over 30 days, the risk scores ranged from 500 to 80,000. Your organization will be different, monitor and modify as needed. +references: + - https://attack.mitre.org/tactics/TA0004/ + - https://research.splunk.com/stories/active_directory_privilege_escalation/ +tags: + analytic_story: + - Active Directory Privilege Escalation + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + impact: 80 + message: Activity related to privilege escalation has been identified on $risk_object$. + mitre_attack_id: + - T1210 + observable: + - name: risk_object + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - All_Risk.calculated_risk_score + - All_Risk.annotations.mitre_attack.mitre_tactic_id + - All_Risk.annotations.mitre_attack.mitre_technique_id + - All_Risk.tag + - All_Risk.analyticstories + - All_Risk.risk_object_type + - All_Risk.risk_object + - All_Risk.annotations.mitre_attack.mitre_tactic + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/living_off_the_land/adlm_risk.log + source: adlm + sourcetype: stash From 508ca2a051fd670dd9a1ea8b1049f0b2769badd0 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 May 2023 17:26:18 -0400 Subject: [PATCH 2/2] updates --- .../active_directory_privilege_escalation_identified.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/active_directory_privilege_escalation_identified.yml b/detections/endpoint/active_directory_privilege_escalation_identified.yml index 3c54901881..bba5f6ad64 100644 --- a/detections/endpoint/active_directory_privilege_escalation_identified.yml +++ b/detections/endpoint/active_directory_privilege_escalation_identified.yml @@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 4 - | `active_directory_lateral_movement_identified_filter`' + | `active_directory_privilege_escalation_identified_filter`' how_to_implement: Splunk Enterprise Security is required to utilize this correlation. In addition, modify the source_count value to your environment. In our testing, a count of 4 or 5 was decent in a lab, but the number may need to be increased as the analytic story includes over 30 analytics. In addition, based on false positives, modify any analytics to be anomaly and lower or increase risk based on organization importance. known_false_positives: False positives will most likely be present based on risk scoring and how the organization handles system to system communication. Filter, or modify as needed. In addition to count by analytics, adding a risk score may be useful. In our testing, with 22 events over 30 days, the risk scores ranged from 500 to 80,000. Your organization will be different, monitor and modify as needed. references: @@ -29,7 +29,7 @@ tags: impact: 80 message: Activity related to privilege escalation has been identified on $risk_object$. mitre_attack_id: - - T1210 + - T1484 observable: - name: risk_object type: Hostname @@ -53,6 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/living_off_the_land/adlm_risk.log + - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1484/privesc/priv_esc.log source: adlm sourcetype: stash