diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 2d6a8474dd..df1edaec4a 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -1,7 +1,7 @@ name: Delete ShadowCopy With PowerShell id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 -version: 1 -date: '2021-05-12' +version: 2 +date: '2022-05-02' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -11,9 +11,10 @@ description: This following analytic detects PowerShell command to delete shadow to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. -search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" - OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText = "*Delete*" + OR ScriptBlockText = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime + by Opcode Computer + UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed @@ -32,11 +33,11 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log impact: 90 kill_chain_phases: - Exploitation - message: An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ + message: An attempt to delete ShadowCopy was performed using PowerShell on $Computer$ by $User$. mitre_attack_id: - T1490 @@ -45,7 +46,7 @@ tags: type: User role: - Victim - - name: ComputerName + - name: Computer type: Hostname role: - Victim @@ -55,10 +56,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 81 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml index 220e524b2a..d8bffdf820 100644 --- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml @@ -1,7 +1,7 @@ name: Detect Empire with PowerShell Script Block Logging id: bc1dc6b8-c954-11eb-bade-acde48001122 -version: 1 -date: '2021-06-09' +version: 2 +date: '2022-02-24' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -19,9 +19,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 (Message=*system.net.webclient* AND Message=*frombase64string*) - | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName - User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 (ScriptBlockText=*system.net.webclient* AND ScriptBlockText=*frombase64string*) + | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer + UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_empire_with_powershell_script_block_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -35,6 +35,7 @@ references: - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ - https://github.com/BC-SECURITY/Empire +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - Hermetic Wiper @@ -44,21 +45,21 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire.log impact: 90 kill_chain_phases: - Exploitation message: The following behavior was identified and typically related to PowerShell-Empire - on $ComputerName$ by $User$. + on $Computer$ by $UserID$. mitre_attack_id: - T1059 - T1059.001 observable: - - name: User + - name: UserID type: User role: - Victim - - name: ComputerName + - name: Computer type: Hostname role: - Victim @@ -68,10 +69,10 @@ tags: - Splunk Cloud required_fields: - _time - - Message - - OpCode - - ComputerName - - User + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode risk_score: 81 security_domain: endpoint diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 7c4881395f..25c7312764 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -1,7 +1,7 @@ name: Detect Mimikatz With PowerShell Script Block Logging id: 8148c29c-c952-11eb-9255-acde48001122 -version: 1 -date: '2021-06-09' +version: 2 +date: '2022-02-24' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -18,9 +18,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 Message IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*, +search: '`powershell` EventCode=4104 ScriptBlockText IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*, *kerberos::ptt*, *kerberos::golden*) | stats count min(_time) as firstTime max(_time) - as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` + as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mimikatz_with_powershell_script_block_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -32,6 +32,7 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - Hermetic Wiper @@ -41,20 +42,21 @@ tags: - Source:Endpoint - Stage:Credential Access dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log impact: 90 kill_chain_phases: - Exploitation message: The following behavior was identified and typically related to MimiKatz - being loaded within the context of PowerShell on $ComputerName$ by $User$. + being loaded within the context of PowerShell on $Computer$ by $UserID$. mitre_attack_id: - T1003 + - T1059.001 observable: - - name: User + - name: UserID type: User role: - Victim - - name: ComputerName + - name: Computer type: Hostname role: - Victim @@ -64,10 +66,10 @@ tags: - Splunk Cloud required_fields: - _time - - Message - - OpCode - - ComputerName - - User + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode risk_score: 90 security_domain: endpoint diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml index 8ef58fda2a..fa8b174e4c 100644 --- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml @@ -1,7 +1,7 @@ name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser id: 114c6bfe-9406-11ec-bcce-acde48001122 -version: 1 -date: '2022-02-22' +version: 2 +date: '2022-05-03' author: Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -13,9 +13,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline. -search: ' `powershell` EventCode=4104 (Message = "*Get-ADUser*" AND Message="*4194304*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`' +search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*") + | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -54,9 +53,10 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 54 security_domain: endpoint diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml index 26e0cc5247..fbf03d36c4 100644 --- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -1,7 +1,7 @@ name: Disabled Kerberos Pre-Authentication Discovery With PowerView id: b0b34e2c-90de-11ec-baeb-acde48001122 -version: 1 -date: '2022-02-18' +version: 2 +date: '2022-05-03' author: Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -13,9 +13,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline. -search: ' `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message="*PreauthNotRequired*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`' +search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*") + | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -34,7 +33,7 @@ tags: - Stage:Discovery - Stage:Recon dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log impact: 60 kill_chain_phases: - Exploitation @@ -53,9 +52,10 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 54 security_domain: endpoint diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml index 39be4ce713..221882212d 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml @@ -1,8 +1,8 @@ name: Get ADUserResultantPasswordPolicy with Powershell Script Block id: 737e1eb0-065a-11ec-921a-acde48001122 -version: 1 -date: '2021-08-26' -author: Teoderick Contreras, MAuricio Velazco, Splunk +version: 2 +date: '2022-05-02' +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) @@ -10,9 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 ScriptBlockText="*Get-ADUserResultantPasswordPolicy*" + | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or @@ -30,16 +29,16 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log impact: 30 kill_chain_phases: - Reconnaissance - message: powershell process having commandline $Message$ to query domain user password + message: powershell process having commandline $ScriptBlockText$ to query domain user password policy. mitre_attack_id: - T1201 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim @@ -53,10 +52,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 9 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml index 6744435f73..d6e944a375 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: Get DomainPolicy with Powershell Script Block id: a360d2b2-065a-11ec-b0bf-acde48001122 -version: 1 -date: '2021-08-26' +version: 2 +date: '2022-05-02' author: Teoderick Contreras, Splunk type: TTP datamodel: [] @@ -9,8 +9,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` +search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-DomainPolicy*" | stats count min(_time) + as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or @@ -28,19 +28,19 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy.log impact: 50 kill_chain_phases: - Reconnaissance - message: powershell process having commandline $Message$ to query domain policy. + message: powershell process having commandline $ScriptBlockText$ to query domain policy. mitre_attack_id: - T1201 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim - - name: User + - name: UserID type: User role: - Victim @@ -50,10 +50,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 30 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml index f90d423fed..dc546ff1a7 100644 --- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml +++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: Get-DomainTrust with PowerShell Script Block id: 89275e7e-0548-11ec-bf75-acde48001122 -version: 1 -date: '2021-08-24' +version: 2 +date: '2022-05-02' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -17,8 +17,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time) - as firstTime max(_time) as lastTime by Message ComputerName User EventCode | `security_content_ctime(firstTime)` +search: '`powershell` EventCode=4104 ScriptBlockText = "*get-domaintrust*" | stats count min(_time) + as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -39,20 +39,20 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log impact: 30 kill_chain_phases: - Reconnaissance - message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $ComputerName$ - by user $user$. + message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $Computer$ + by user $UserID$. mitre_attack_id: - T1482 observable: - - name: user + - name: UserID type: User role: - Victim - - name: ComputerName + - name: Computer type: Hostname role: - Victim @@ -66,12 +66,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - Path - - OpCode - - ComputerName - - User risk_score: 12 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml index 13ccd845b2..fd3da97b89 100644 --- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml +++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: Get-ForestTrust with PowerShell Script Block id: 70fac80e-0bf1-11ec-9ba0-acde48001122 -version: 1 -date: '2021-09-02' +version: 2 +date: '2022-02-24' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -28,6 +28,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: False positives may be present. Tune as needed. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/ +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - Active Directory Discovery @@ -40,16 +41,17 @@ tags: impact: 30 kill_chain_phases: - Reconnaissance - message: Suspicious PowerShell Get-ForestTrust was identified on endpoint $ComputerName$ - by user $User$. + message: Suspicious PowerShell Get-ForestTrust was identified on endpoint $Computer$ + by user $UserID$. mitre_attack_id: - T1482 + - T1059.001 observable: - - name: User + - name: UserID type: User role: - Victim - - name: ComputerName + - name: Computer type: Hostname role: - Victim @@ -60,11 +62,11 @@ tags: required_fields: - _time - EventCode - - Message + - ScriptBlockText - Path - - OpCode - - ComputerName - - User + - Opcode + - Computer + - UserID risk_score: 12 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml index 1eae787f11..a1f5a58c00 100644 --- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: GetAdComputer with PowerShell Script Block id: a9a1da02-8e27-4bf7-a348-f4389c9da487 -version: 1 -date: '2021-09-01' +version: 3 +date: '2022-05-02' author: Mauricio Velazco, Splunk type: Hunting datamodel: [] @@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev is used to return a list of all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message = "*Get-AdComputer*") | stats count - min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-AdComputer*") | stats count + min(_time) as firstTime max(_time) as lastTime by Opcode Computer + UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -33,11 +33,11 @@ tags: impact: 30 kill_chain_phases: - Reconnaissance - message: Remote system discovery enumeration on $dest$ by $user$ + message: Remote system discovery enumeration on $Computer$ by $UserID$ mitre_attack_id: - T1018 observable: - - name: dest + - name: Computer type: Endpoint role: - Victim @@ -47,10 +47,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 15 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml index 80b3df3b2d..90d0d49390 100644 --- a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: GetDomainComputer with PowerShell Script Block id: f64da023-b988-4775-8d57-38e512beb56e -version: 1 -date: '2021-09-02' +version: 2 +date: '2022-05-02' author: Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message = "*Get-DomainComputer*") | stats count - min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*") | stats count + min(_time) as firstTime max(_time) as lastTime by Opcode Computer + UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -28,15 +28,15 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log impact: 30 kill_chain_phases: - Reconnaissance - message: Remote system discovery with PowerView on $dest$ by $user$ + message: Remote system discovery with PowerView on $Computer$ by $user$ mitre_attack_id: - T1018 observable: - - name: dest + - name: Computer type: Endpoint role: - Victim @@ -46,10 +46,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 24 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml index e698e1f783..61fa6f4cb1 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: GetDomainController with PowerShell Script Block id: 676b600a-a94d-4951-b346-11329431e6c1 -version: 1 -date: '2021-09-02' +version: 2 +date: '2022-05-02' author: Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -10,9 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message = "*Get-DomainController*") | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainController*") | stats + count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -29,15 +28,15 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc.log impact: 30 kill_chain_phases: - Reconnaissance - message: Remote system discovery with PowerView on $dest$ by $user$ + message: Remote system discovery with PowerView on $Computer$ by $UserID$ mitre_attack_id: - T1018 observable: - - name: dest + - name: Computer type: Endpoint role: - Victim @@ -47,10 +46,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 24 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml index 4db3760c8c..607e9d353d 100644 --- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: GetDomainGroup with PowerShell Script Block id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53 -version: 1 -date: '2021-08-26' +version: 2 +date: '2022-05-02' author: Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -11,9 +11,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroup*") | stats count - min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroup*") | stats count + min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -30,16 +29,16 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup.log impact: 30 kill_chain_phases: - Reconnaissance - message: Domain group discovery enumeration using PowerView on $dest$ by $user$ + message: Domain group discovery enumeration using PowerView on $Computer$ by $UserID$ mitre_attack_id: - T1069 - T1069.002 observable: - - name: dest + - name: Computer type: Endpoint role: - Victim @@ -49,10 +48,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 15 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml index 2a1551d5fd..163589b991 100644 --- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml +++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml @@ -22,9 +22,11 @@ known_false_positives: Administrators or power users may use this PowerShell com for troubleshooting. references: - https://attack.mitre.org/techniques/T1087/001/ +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - Active Directory Discovery + - Malicious PowerShell confidence: 50 context: - Source:Endpoint @@ -34,12 +36,13 @@ tags: impact: 30 kill_chain_phases: - Reconnaissance - message: Local user discovery enumeration using PowerShell on $dest$ by $user$ + message: Local user discovery enumeration using PowerShell on $Computer$ by $user$ mitre_attack_id: - T1087 - T1087.001 + - T1059.001 observable: - - name: dest + - name: Computer type: Endpoint role: - Victim @@ -49,6 +52,10 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - ScriptBlockText + - Computer + - UserID risk_score: 15 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml index 08ff9f6fbe..b0bb08410a 100644 --- a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml +++ b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: GetNetTcpconnection with PowerShell Script Block id: 091712ff-b02a-4d43-82ed-34765515d95d -version: 1 -date: '2021-09-10' +version: 2 +date: '2022-04-02' author: Mauricio Velazco, Splunk type: Hunting datamodel: [] @@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev is used to return a listing of network connections on a compromised system. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message = "*Get-NetTcpconnection*") | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-NetTcpconnection*") | stats + count min(_time) as firstTime max(_time) as lastTime by Opcode Computer + UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -29,15 +29,15 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection.log impact: 30 kill_chain_phases: - Reconnaissance - message: Network Connection discovery on $dest$ by $user$ + message: Network Connection discovery on $Computer$ by $user$ mitre_attack_id: - T1049 observable: - - name: dest + - name: Computer type: Endpoint role: - Victim @@ -47,10 +47,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 15 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml index 5b9ad0fee1..43cc651c0b 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: GetWmiObject Ds Computer with PowerShell Script Block id: 29b99201-723c-4118-847a-db2b3d3fb8ea -version: 1 -date: '2021-09-01' +version: 2 +date: '2022-05-02' author: Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace - root\\directory\\ldap*" AND Message="*class ds_computer*") | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` +search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace + root\\directory\\ldap*" AND ScriptBlockText="*class ds_computer*") | stats count min(_time) + as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -30,15 +30,15 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log impact: 30 kill_chain_phases: - Reconnaissance - message: Remote system discovery enumeration on $dest$ by $user$ + message: Remote system discovery enumeration on $Computer$ by $UserID$ mitre_attack_id: - T1018 observable: - - name: dest + - name: Computer type: Endpoint role: - Victim @@ -48,10 +48,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 15 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml index a07988555c..f34ece15a0 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: GetWmiObject Ds Group with PowerShell Script Block id: 67740bd3-1506-469c-b91d-effc322cc6e5 -version: 1 -date: '2021-08-25' +version: 2 +date: '2022-05-02' author: Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -10,9 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace - root\\directory\\ldap*" AND Message="*class ds_group*") | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` +search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_group*") | stats count min(_time) + as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -30,11 +29,11 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log impact: 30 kill_chain_phases: - Reconnaissance - message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ + message: Domain group discovery enumeration using PowerShell on $Computer$ by $UserID$ mitre_attack_id: - T1069 - T1069.002 @@ -49,10 +48,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 15 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml index 867d819d10..1da9780554 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: GetWmiObject DS User with PowerShell Script Block id: fabd364e-04f3-11ec-b34b-acde48001122 -version: 1 -date: '2021-08-24' +version: 2 +date: '2022-05-02' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" - Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` +search: '`powershell` EventCode=4104 ScriptBlockText = "*get-wmiobject*" ScriptBlockText = "*ds_user*" + ScriptBlockText = "*-namespace*" ScriptBlockText = "*root\\directory\\ldap*" | stats count min(_time) + as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`' how_to_implement: he following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or @@ -33,12 +33,12 @@ tags: impact: 50 kill_chain_phases: - Reconnaissance - message: powershell process having commandline $Message$ for user enumeration + message: powershell process having commandline $ScriptBlockText$ for user enumeration mitre_attack_id: - T1087.002 - T1087 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim @@ -52,10 +52,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 25 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml index 2323809306..bb3a548d47 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: GetWmiObject User Account with PowerShell Script Block id: 640b0eda-0429-11ec-accd-acde48001122 -version: 1 -date: '2021-08-23' +version: 2 +date: '2022-05-02' author: Mauricio Velazco, Splunk type: Hunting datamodel: [] @@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev The `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message="*Get-WmiObject*" AND Message="*Win32_UserAccount*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 (ScriptBlockText="*Get-WmiObject*" AND ScriptBlockText="*Win32_UserAccount*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText + Computer UserID | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -20,9 +20,11 @@ known_false_positives: Administrators or power users may use this PowerShell com for troubleshooting. references: - https://attack.mitre.org/techniques/T1087/001/ +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - Active Directory Discovery + - Malicious PowerShell confidence: 50 context: - Source:Endpoint @@ -32,12 +34,13 @@ tags: impact: 30 kill_chain_phases: - Reconnaissance - message: Local user discovery enumeration using PowerShell on $dest$ by $user$ + message: Local user discovery enumeration using PowerShell on $Computer$ by $UserID$ mitre_attack_id: - T1087 - T1087.001 + - T1059.001 observable: - - name: dest + - name: Computer type: Endpoint role: - Victim @@ -47,6 +50,10 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - ScriptBlockText + - Computer + - UserID risk_score: 15 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index 30c12cc1ec..8c8ad272fc 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -1,7 +1,7 @@ name: Mailsniper Invoke functions id: a36972c8-b894-11eb-9f78-acde48001122 -version: 1 -date: '2021-05-19' +version: 2 +date: '2022-05-02' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -9,12 +9,12 @@ datamodel: description: This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. -search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer + UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mailsniper_invoke_functions_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed @@ -30,17 +30,17 @@ tags: - Source:Endpoint - Stage:Exfiltration dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log impact: 90 kill_chain_phases: - Exploitation - message: mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user + message: mailsniper.ps1 functions $ScriptBlockText$ executed on a $Computer$ by user $user$. mitre_attack_id: - T1114 - T1114.001 observable: - - name: dest + - name: Computer type: Endpoint role: - Victim @@ -54,10 +54,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 72 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 07aab110ed..8cadd8dda0 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,7 +1,7 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 1 -date: '2021-08-18' +version: 3 +date: '2022-05-02' author: Michael Haag, Splunk type: Hunting datamodel: [] @@ -10,26 +10,26 @@ description: The following Hunting analytic assists with identifying suspicious to be ran hourly, but occasionally to identify malicious or suspicious PowerShell. This analytic is a combination of work completed by Alex Teixeira and Splunk Threat Research Team. -search: '`powershell` EventCode=4104 | eval DoIt = if(match(Message,"(?i)(\$doit)"), - "4", 0) | eval enccom=if(match(Message,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") - OR match(Message, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(Message, +search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), + "4", 0) | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") + OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) - | eval base64 = if(match(lower(Message),"frombase64"), "4", 0) | eval empire=if(match(lower(Message),"system.net.webclient") - AND match(lower(Message), "frombase64string") ,5,0) | eval mimikatz=if(match(lower(Message),"mimikatz") - OR match(lower(Message), "-dumpcr") OR match(lower(Message), "SEKURLSA::Pth") OR - match(lower(Message), "kerberos::ptt") OR match(lower(Message), "kerberos::golden") - ,5,0) | eval iex = if(match(lower(Message),"iex"), "2", 0) | eval webclient=if(match(lower(Message),"http") - OR match(lower(Message),"web(client|request)") OR match(lower(Message),"socket") - OR match(lower(Message),"download(file|string)") OR match(lower(Message),"bitstransfer") - OR match(lower(Message),"internetexplorer.application") OR match(lower(Message),"xmlhttp"),5,0) - | eval get = if(match(lower(Message),"get-"), "1", 0) | eval rundll32 = if(match(lower(Message),"rundll32"), - "4", 0) | eval suspkeywrd=if(match(Message, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0) - | eval syswow64 = if(match(lower(Message),"syswow64"), "3", 0) | eval httplocal - = if(match(lower(Message),"http://127.0.0.1"), "4", 0) | eval reflection = if(match(lower(Message),"reflection"), - "1", 0) | eval invokewmi=if(match(lower(Message), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0) - | eval downgrade=if(match(Message, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(Message),"powershell - -version"),3,0) | eval compressed=if(match(Message, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0) - | eval invokecmd = if(match(lower(Message),"invoke-command"), "4", 0) | addtotals + | eval base64 = if(match(lower(ScriptBlockText),"frombase64"), "4", 0) | eval empire=if(match(lower(ScriptBlockText),"system.net.webclient") + AND match(lower(ScriptBlockText), "frombase64string") ,5,0) | eval mimikatz=if(match(lower(ScriptBlockText),"mimikatz") + OR match(lower(ScriptBlockText), "-dumpcr") OR match(lower(ScriptBlockText), "SEKURLSA::Pth") OR + match(lower(ScriptBlockText), "kerberos::ptt") OR match(lower(ScriptBlockText), "kerberos::golden") + ,5,0) | eval iex = if(match(lower(ScriptBlockText),"iex"), "2", 0) | eval webclient=if(match(lower(ScriptBlockText),"http") + OR match(lower(ScriptBlockText),"web(client|request)") OR match(lower(ScriptBlockText),"socket") + OR match(lower(ScriptBlockText),"download(file|string)") OR match(lower(ScriptBlockText),"bitstransfer") + OR match(lower(ScriptBlockText),"internetexplorer.application") OR match(lower(ScriptBlockText),"xmlhttp"),5,0) + | eval get = if(match(lower(ScriptBlockText),"get-"), "1", 0) | eval rundll32 = if(match(lower(ScriptBlockText),"rundll32"), + "4", 0) | eval suspkeywrd=if(match(ScriptBlockText, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0) + | eval syswow64 = if(match(lower(ScriptBlockText),"syswow64"), "3", 0) | eval httplocal + = if(match(lower(ScriptBlockText),"http://127.0.0.1"), "4", 0) | eval reflection = if(match(lower(ScriptBlockText),"reflection"), + "1", 0) | eval invokewmi=if(match(lower(ScriptBlockText), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0) + | eval downgrade=if(match(ScriptBlockText, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(ScriptBlockText),"powershell + -version"),3,0) | eval compressed=if(match(ScriptBlockText, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0) + | eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0) | addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get | stats values(Score) by DoIt, enccom, compressed, downgrade, iex, mimikatz, @@ -47,6 +47,7 @@ references: - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1 - https://www.mandiant.com/resources/greater-visibilityt - https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/ +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - Hermetic Wiper @@ -55,21 +56,22 @@ tags: context: - Source:Endpoint - Stage:Defense Evasion - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log impact: 80 kill_chain_phases: - Exploitation message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ executing suspicious commands. + on endpoint $Computer$ by user $user$ executing suspicious commands. mitre_attack_id: - T1059 - T1059.001 observable: - - name: user + - name: UserID type: User role: - Victim - - name: dest + - name: Computer type: Hostname role: - Victim @@ -87,7 +89,11 @@ tags: - Splunk Cloud required_fields: - _time - - Message + - ScriptBlockText + - Opcode + - Computer + - UserID + - EventCode risk_score: 80 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 844089242f..bd2bb44a59 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -1,7 +1,7 @@ name: Powershell Creating Thread Mutex id: 637557ec-ca08-11eb-bd0a-acde48001122 -version: 1 -date: '2021-06-10' +version: 3 +date: '2022-05-02' author: Teoderick Contreras, Splunk type: TTP datamodel: [] @@ -11,8 +11,8 @@ description: The following analytic identifies suspicious PowerShell script exec there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. -search: '`powershell` EventCode=4104 Message = "*Threading.Mutex*" | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` +search: '`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -33,21 +33,22 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log impact: 50 kill_chain_phases: - Exploitation - message: A suspicious powershell script contains Thread Mutex in $Message$ with - EventCode $EventCode$ in host $ComputerName$ + message: A suspicious powershell script contains Thread Mutex in $ScriptBlockText$ with + EventCode $EventCode$ in host $Computer$ mitre_attack_id: - T1027 - T1027.005 + - T1059.001 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim - - name: User + - name: UserID type: User role: - Victim @@ -58,9 +59,9 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName - - User + - ScriptBlockText + - Computer + - UserID risk_score: 40 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml index b2a9e89b0c..ee1e9e2b14 100644 --- a/detections/endpoint/powershell_domain_enumeration.yml +++ b/detections/endpoint/powershell_domain_enumeration.yml @@ -1,7 +1,7 @@ name: PowerShell Domain Enumeration id: e1866ce2-ca22-11eb-8e44-acde48001122 -version: 1 -date: '2021-06-10' +version: 2 +date: '2022-02-25' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -17,9 +17,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netforesttrust*, +search: '`powershell` EventCode=4104 ScriptBlockText IN (*get-netdomaintrust*, *get-netforesttrust*, *get-addomain*, *get-adgroupmember*, *get-domainuser*) | stats count min(_time) - as firstTime max(_time) as lastTime by ComputerName EventCode Message | `security_content_ctime(firstTime)` + as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -30,6 +30,7 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - Hermetic Wiper @@ -39,21 +40,21 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log impact: 60 kill_chain_phases: - Reconnaissance - message: A suspicious powershell script contains domain enumeration command in $Message$ - with EventCode $EventCode$ in host $ComputerName$ + message: A suspicious powershell script contains domain enumeration command in $ScriptBlockText$ + with EventCode $EventCode$ in host $Computer$ mitre_attack_id: - T1059 - T1059.001 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim - - name: User + - name: UserID type: User role: - Victim @@ -63,8 +64,10 @@ tags: - Splunk Cloud required_fields: - _time - - Message - - ComputerName + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode risk_score: 42 security_domain: endpoint diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index 69f40f1f5b..974bb42a8e 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -1,7 +1,7 @@ name: Powershell Enable SMB1Protocol Feature id: afed80b2-d34b-11eb-a952-acde48001122 -version: 1 -date: '2021-06-22' +version: 2 +date: '2022-02-25' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -10,9 +10,9 @@ description: This search is to detect a suspicious enabling of smb1protocol thro "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. -search: '`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message +search: '`powershell` EventCode=4104 ScriptBlockText = "*Enable-WindowsOptionalFeature*" ScriptBlockText = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_enable_smb1protocol_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed @@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: network operator may enable or disable this windows feature. references: - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - Hermetic Wiper @@ -29,7 +30,7 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log kill_chain_phases: - Exploitation message: Powershell Enable SMB1Protocol Feature @@ -48,9 +49,9 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName - - User + - ScriptBlockText + - Computer + - UserID security_domain: endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 0aea3c131b..c3af3bf92f 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -23,6 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: network operrator may use this command. references: - https://threadreaderapp.com/thread/1423361119926816776.html +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - Hermetic Wiper @@ -34,17 +35,17 @@ tags: - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-powershell.log impact: 10 kill_chain_phases: - Exploitation - message: A suspicious powershell script contains COM CLSID command in $Message$ - with EventCode $EventCode$ in host $ComputerName$ + message: A suspicious powershell script contains COM CLSID command in $ScriptBlockText$ + with EventCode $EventCode$ in host $Computer$ mitre_attack_id: - T1546.015 - T1546 + - T1059.001 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim @@ -58,6 +59,9 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Computer + - EventCode risk_score: 5 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml index 8d9d719e90..63548c9b3e 100644 --- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml +++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml @@ -1,7 +1,7 @@ name: Powershell Fileless Process Injection via GetProcAddress id: a26d9db4-c883-11eb-9d75-acde48001122 -version: 1 -date: '2021-06-08' +version: 2 +date: '2022-02-25' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -21,8 +21,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 Message=*getprocaddress* | stats count min(_time) - as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message +search: '`powershell` EventCode=4104 ScriptBlockText=*getprocaddress* | stats count min(_time) + as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_process_injection_via_getprocaddress_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -33,6 +33,7 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - Hermetic Wiper @@ -42,18 +43,18 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log impact: 60 kill_chain_phases: - Exploitation - message: A suspicious powershell script contains GetProcAddress API in $Message$ - with EventCode $EventCode$ in host $ComputerName$ + message: A suspicious powershell script contains GetProcAddress API in $ScriptBlockText$ + with EventCode $EventCode$ in host $Computer$ mitre_attack_id: - T1059 - T1055 - T1059.001 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim @@ -67,10 +68,10 @@ tags: - Splunk Cloud required_fields: - _time - - Message - - OpCode - - ComputerName - - User + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode risk_score: 48 security_domain: endpoint diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 9db6cc1d80..6be2fe62a8 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -1,7 +1,7 @@ name: Powershell Fileless Script Contains Base64 Encoded Content id: 8acbc04c-c882-11eb-b060-acde48001122 -version: 1 -date: '2021-06-08' +version: 2 +date: '2022-04-26' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -20,8 +20,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 Message=*frombase64string* | stats count min(_time) - as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message +search: '`powershell` EventCode=4104 ScriptBlockText=*frombase64string* | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -41,7 +41,7 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log impact: 70 kill_chain_phases: - Exploitation @@ -66,11 +66,11 @@ tags: - Splunk Cloud required_fields: - _time - - Message - - OpCode - - ComputerName - - User - - EventCode + - ScriptBlockText + - Opcode + - Computer + - UserID + - EventCodes risk_score: 56 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml index 332ca9476a..59b4e448c7 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml @@ -1,7 +1,7 @@ name: Powershell Get LocalGroup Discovery with Script Block Logging id: d7c6ad22-155c-11ec-bb64-acde48001122 -version: 1 -date: '2021-09-14' +version: 2 +date: '2022-04-26' author: Michael Haag, Splunk type: Hunting datamodel: [] @@ -18,9 +18,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 Message = "*get-localgroup*" | stats count min(_time) - as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode| - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*" | stats count min(_time) + as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -40,7 +40,7 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log impact: 30 kill_chain_phases: - Reconnaissance @@ -63,10 +63,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 15 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index dd6af6110a..e63435e80d 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -1,7 +1,7 @@ name: PowerShell Loading DotNET into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 -version: 1 -date: '2021-06-10' +version: 2 +date: '2022-05-02' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -19,9 +19,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") - | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName - User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", "*reflection.assembly*") + | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -43,21 +42,21 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log impact: 70 kill_chain_phases: - Exploitation - message: A suspicious powershell script contains reflective class assembly command - in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$ + message: A suspicious powershell script contains reflective class assembly command + in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in host $Computer$ mitre_attack_id: - T1059 - T1059.001 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim - - name: User + - name: UserID type: User role: - Victim @@ -67,10 +66,10 @@ tags: - Splunk Cloud required_fields: - _time - - Message - - OpCode - - ComputerName - - User + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode risk_score: 56 security_domain: endpoint diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index ad5bee4f5f..f1916b6e27 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -1,7 +1,7 @@ name: Powershell Processing Stream Of Data id: 0d718b52-c9f1-11eb-bc61-acde48001122 -version: 1 -date: '2021-06-10' +version: 2 +date: '2022-02-25' author: Teoderick Contreras, Splunk type: TTP datamodel: [] @@ -11,9 +11,9 @@ description: The following analytic identifies suspicious PowerShell script exec that are stream flattened and will be deflated durnig execution. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. -search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*" - OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` +search: '`powershell` EventCode=4104 ScriptBlockText = "*IO.Compression.*" OR ScriptBlockText = "*IO.StreamReader*" + OR ScriptBlockText = "*]::Decompress*" | stats count min(_time) as firstTime max(_time) + as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -25,6 +25,7 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - Hermetic Wiper @@ -34,22 +35,22 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log impact: 50 kill_chain_phases: - Exploitation - message: A suspicious powershell script contains stream command in $Message$ commonly + message: A suspicious powershell script contains stream command in $ScriptBlockText$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ - in host $ComputerName$ + in host $Computer$ mitre_attack_id: - T1059 - T1059.001 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim - - name: User + - name: UserID type: User role: - Victim @@ -60,9 +61,9 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName - - User + - ScriptBlockText + - Computer + - UserID - Score risk_score: 40 security_domain: endpoint diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index 272c081ed4..adf93972c7 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -1,7 +1,7 @@ name: Powershell Remove Windows Defender Directory id: adf47620-79fa-11ec-b248-acde48001122 -version: 2 -date: '2022-01-18' +version: 3 +date: '2022-05-02' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -11,9 +11,7 @@ description: This analytic will identify a suspicious PowerShell command used to campaign where it used Nirsofts advancedrun.exe to gain administrative privileges to then execute a PowerShell command to delete the Windows Defender folder. This is a good indicator the offending process is trying corrupt a Windows Defender installation. -search: '`powershell` EventCode=4104 Message = "*rmdir *" AND Message = "*\\Microsoft\\Windows - Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode - Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 ScriptBlockText = "*rmdir *" AND ScriptBlockText = "*\\Microsoft\\Windows Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remove_windows_defender_directory_filter` ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -34,22 +32,22 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/rmdir_defender_pwsh/powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log impact: 100 kill_chain_phases: - Exploitation - message: suspicious powershell script $Message$ was executed on the $ComputerName$ + message: suspicious powershell script $ScriptBlockText$ was executed on the $Computer$ mitre_attack_id: - T1562.001 - T1562 nist: - DE.CM observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim - - name: User + - name: UserID type: User role: - Victim @@ -59,10 +57,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 90 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index bbc498ef64..8659f09b14 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -39,17 +39,17 @@ tags: impact: 50 kill_chain_phases: - Exploitation - message: A suspicious powershell script contains memorystream command in $Message$ - as new object backstore with EventCode $EventCode$ in host $ComputerName$ + message: A suspicious powershell script contains memorystream command in $ScriptBlockText$ + as new object backstore with EventCode $EventCode$ in host $Computer$ mitre_attack_id: - T1059.001 - T1059 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim - - name: User + - name: UserID type: User role: - Victim @@ -60,9 +60,9 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName - - User + - ScriptBlockText + - Computer + - UserID risk_score: 40 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index 1bfb2a8c39..c10f5701a9 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -11,6 +11,7 @@ description: The following analytic identifies suspicious PowerShell script exec adversary will map all running security applications or services. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. + search: '`powershell` EventCode=4104 (ScriptBlockText = "*SELECT*" OR ScriptBlockText = "*WMIC*") AND (ScriptBlockText = "*AntiVirusProduct*" OR ScriptBlockText = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id @@ -27,6 +28,7 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - Hermetic Wiper @@ -38,16 +40,15 @@ tags: - Stage:Discovery dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/pwh_av_recon/windows-powershell-xml.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log impact: 70 kill_chain_phases: - Reconnaissance - message: A suspicious powershell script contains AV recon command in $Message$ with - EventCode $EventCode$ in host $ComputerName$ + message: A suspicious powershell script contains AV recon command in $ScriptBlockText$ with + EventCode $EventCode$ in host $Computer$ mitre_attack_id: - T1592 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim @@ -62,9 +63,9 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName - - User + - ScriptBlockText + - Computer + - UserID risk_score: 56 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index 7997fc0342..8aa950d343 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -1,7 +1,7 @@ name: Recon Using WMI Class id: 018c1972-ca07-11eb-9473-acde48001122 -version: 1 -date: '2021-06-10' +version: 2 +date: '2022-02-25' author: Teoderick Contreras, Splunk type: TTP datamodel: [] @@ -11,11 +11,11 @@ description: The following analytic identifies suspicious PowerShell via EventCo and system information on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. -search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*") - AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*" - OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*" - OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` +search: '`powershell` EventCode=4104 (ScriptBlockText= "*SELECT*" OR ScriptBlockText= "*Get-WmiObject*") + AND (ScriptBlockText= "*Win32_Bios*" OR ScriptBlockText= "*Win32_OperatingSystem*" OR ScriptBlockText= "*Win32_Processor*" + OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_ComputerSystemProduct*" + OR ScriptBlockText= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time) + as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -27,10 +27,11 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ +- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ tags: analytic_story: - - Hermetic Wiper + - Hermetic Wiper - Malicious PowerShell - Industroyer2 confidence: 80 @@ -38,16 +39,17 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log impact: 75 kill_chain_phases: - Reconnaissance - message: A suspicious powershell script contains host recon command in $Message$ - with EventCode $EventCode$ in host $ComputerName$ + message: A suspicious powershell script contains host recon command in $ScriptBlockText$ + with EventCode $EventCode$ in host $Computer$ mitre_attack_id: - T1592 + - T1059.001 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim @@ -62,9 +64,9 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName - - User + - ScriptBlockText + - Computer + - UserID risk_score: 60 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml index a6ca441873..8489e9b6bc 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml @@ -37,13 +37,13 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: A process was started on a remote endpoint from $ComputerName by abusing + message: A process was started on a remote endpoint from $Computer$ by abusing WinRM using PowerShell.exe mitre_attack_id: - T1021 - T1021.006 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - Victim @@ -53,10 +53,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 45 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml index 83d645d3f1..3775197466 100644 --- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml +++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml @@ -1,7 +1,7 @@ name: Remote System Discovery with Adsisearcher id: 70803451-0047-4e12-9d63-77fa7eb8649c -version: 1 -date: '2021-09-01' +version: 2 +date: '2022-06-29' author: Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -9,9 +9,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain computers for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*objectclass=computer*" - AND Message = "*findAll()*") | stats count min(_time) as firstTime max(_time) as - lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` +search: '`powershell` EventCode=4104 ScriptBlockText = "*adsisearcher*" AND ScriptBlockText = "*objectcategory=computer*" + AND ScriptBlockText IN ("*findAll()*","*findOne()*") | stats count min(_time) as firstTime max(_time) as + lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `remote_system_discovery_with_adsisearcher_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -29,15 +29,15 @@ tags: - Stage:Discovery - Stage:Recon dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log impact: 30 kill_chain_phases: - Reconnaissance - message: Remote system discovery enumeration on $dest$ by $user$ + message: Remote system discovery enumeration on $Computer$ by $user$ mitre_attack_id: - T1018 observable: - - name: dest + - name: Computer type: Endpoint role: - Victim @@ -48,9 +48,9 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName - - User + - ScriptBlockText + - Computer + - UserID risk_score: 15 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml index 78ed3308a1..ad004ac7c1 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml @@ -1,7 +1,7 @@ name: ServicePrincipalNames Discovery with PowerShell id: 13243068-2d38-11ec-8908-acde48001122 -version: 1 -date: '2021-10-14' +version: 2 +date: '2022-02-26' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -22,9 +22,9 @@ description: 'The following analytic identifies `powershell.exe` usage, using Sc class in PowerShell is the equivelant of using setspn.exe. \ During triage, review parallel processes for further suspicious activity.' -search: '`powershell` EventCode=4104 Message="*KerberosRequestorSecurityToken*" | - stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName - User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 ScriptBlockText="*KerberosRequestorSecurityToken*" | + stats count min(_time) as firstTime max(_time) as lastTime by ScriptBlockText Opcode Computer + UserID EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `serviceprincipalnames_discovery_with_powershell_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -49,6 +49,7 @@ tags: analytic_story: - Active Directory Discovery - Active Directory Kerberos Attacks + - Malicious PowerShell automated_detection_testing: passed confidence: 100 context: @@ -60,15 +61,15 @@ tags: kill_chain_phases: - Exploitation message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to identify service principle names. + on endpoint $Computer$ by user $UserID$ attempting to identify service principle names. mitre_attack_id: - T1558.003 observable: - - name: user + - name: UserID type: User role: - Victim - - name: dest + - name: Computer type: Hostname role: - Victim @@ -86,17 +87,11 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - ScriptBlockText + - Opcode + - Computer + - UserID + - EventCode risk_score: 80 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml index 31e478a896..ac0b1068b3 100644 --- a/detections/endpoint/unloading_amsi_via_reflection.yml +++ b/detections/endpoint/unloading_amsi_via_reflection.yml @@ -48,13 +48,13 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$ + message: Possible AMSI Unloading via Reflection using PowerShell on $Computer$ mitre_attack_id: - T1562 - T1059.001 - T1059 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - Victim @@ -64,10 +64,10 @@ tags: - Splunk Cloud required_fields: - _time - - Message - - OpCode - - ComputerName - - User + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml index 269b959417..76932413e5 100644 --- a/detections/endpoint/wmi_recon_running_process_or_services.yml +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -1,7 +1,7 @@ name: WMI Recon Running Process Or Services id: b5cd5526-cce7-11eb-b3bd-acde48001122 -version: 1 -date: '2021-06-14' +version: 2 +date: '2022-05-02' author: Teoderick Contreras, Splunk type: TTP datamodel: [] @@ -11,9 +11,9 @@ description: The following analytic identifies suspicious PowerShell script exec where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. -search: '`powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*" - OR Message="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as - lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` +search: '`powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBlockText="*Win32_Process*" + OR ScriptBlockText="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as + lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -33,17 +33,17 @@ tags: - Source:Endpoint - Stage:Recon dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log impact: 30 kill_chain_phases: - Reconnaissance - message: Suspicious powerShell script execution by $user$ on $ComputerName$ via + message: Suspicious powerShell script execution by $user$ on $Computer$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services mitre_attack_id: - T1592 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - Victim @@ -57,10 +57,11 @@ tags: - Splunk Cloud required_fields: - _time + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode - - Message - - ComputerName - - User risk_score: 30 security_domain: endpoint asset_type: Endpoint diff --git a/detections/experimental/endpoint/exchange_powershell_module_usage.yml b/detections/experimental/endpoint/exchange_powershell_module_usage.yml index 45ce11a430..172e39c8e4 100644 --- a/detections/experimental/endpoint/exchange_powershell_module_usage.yml +++ b/detections/experimental/endpoint/exchange_powershell_module_usage.yml @@ -1,7 +1,7 @@ name: Exchange PowerShell Module Usage id: 2d10095e-05ae-11ec-8fdf-acde48001122 -version: 1 -date: '2021-08-27' +version: 2 +date: '2022-05-02' author: Michael Haag type: TTP datamodel: [] @@ -19,9 +19,9 @@ description: 'The following analytic identifies the usage of Exchange PowerShell Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG).' -search: '`powershell` EventCode=4104 Message IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*") - | stats count min(_time) as firstTime max(_time) as lastTime by Path Message OpCode - ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*") + | stats count min(_time) as firstTime max(_time) as lastTime by lastTime by Opcode Computer + UserID EventCode ScriptBlockText| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exchange_powershell_module_usage_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -63,11 +63,10 @@ tags: - Splunk Cloud required_fields: - _time - - Path - - Message - - OpCode - - ComputerName - - User + - ScriptBlockText + - Opcode + - Computer + - UserID - EventCode risk_score: 15 security_domain: endpoint diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml index f65c6f0c59..d579f5f910 100644 --- a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml +++ b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml b/tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml index d0feb73f8a..d626e4857d 100644 --- a/tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml +++ b/tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: empire.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml index 68444245ca..e23bfe2b90 100644 --- a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml +++ b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: credaccess-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml index 034af504ea..9681402e71 100644 --- a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml +++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml @@ -6,10 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog - - - + - file_name: get-aduser-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml index 95445f94db..02ec15cf55 100644 --- a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml +++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog \ No newline at end of file + - file_name: getdomainuser.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disabling_folderoptions_windows_feature.test.yml b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml index b5252c8271..205ea854c7 100644 --- a/tests/endpoint/disabling_folderoptions_windows_feature.test.yml +++ b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml @@ -19,4 +19,4 @@ tests: - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlogE + sourcetype: xmlwineventlog diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml index 48001f2acc..f582bda359 100644 --- a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml @@ -9,4 +9,4 @@ tests: - file_name: windows-powershell-xml.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + sourcetype: xmlwineventlog diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml index 72007a7295..875b673a77 100644 --- a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml index d65f4ccf3e..ce3a2f2de5 100644 --- a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: domainpolicy.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml b/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml index e6d8b8e1df..5c4f7c7267 100644 --- a/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog:Microsoft-Windows-PowerShell/Operational + - file_name: domaintrust.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml index c943f9ecea..53fd5e1b21 100644 --- a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml @@ -9,4 +9,4 @@ tests: - file_name: windows-powershell-xml.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + sourcetype: xmlwineventlog diff --git a/tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml b/tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml index 58b0b2f3f0..f68214c8f1 100644 --- a/tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml @@ -9,4 +9,4 @@ tests: - file_name: windows-powershell-xml.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + sourcetype: xmlwineventlog diff --git a/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml b/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml index 1c2b617a8b..f6f9013d14 100644 --- a/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml +++ b/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml b/tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml index 4502690697..6dde3ca382 100644 --- a/tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml +++ b/tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml b/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml index 183634e851..d46b967c4e 100644 --- a/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml +++ b/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: getdc.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml b/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml index 296c581cd8..3ca580680e 100644 --- a/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml +++ b/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: domaingroup.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml index 3303bde512..b2abc4915b 100644 --- a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml +++ b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml @@ -9,4 +9,4 @@ tests: - file_name: windows-powershell-xml.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + sourcetype: xmlwineventlog diff --git a/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml b/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml index 088d172453..743e244d53 100644 --- a/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml +++ b/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: nettcpconnection.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml index ca7ff36731..d0516a0f98 100644 --- a/tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml +++ b/tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml index 0fc0f1421e..b24d2be1ee 100644 --- a/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml +++ b/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml index 49113fd821..6dc922ff78 100644 --- a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml +++ b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml index 7b099a2b03..2cc3314696 100644 --- a/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml +++ b/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/mailsniper_invoke_functions.test.yml b/tests/endpoint/mailsniper_invoke_functions.test.yml index 43be48b636..12a13cdc61 100644 --- a/tests/endpoint/mailsniper_invoke_functions.test.yml +++ b/tests/endpoint/mailsniper_invoke_functions.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/powershell_4104_hunting.test.yml b/tests/endpoint/powershell_4104_hunting.test.yml index 5ee81bda27..f5521e4a8a 100644 --- a/tests/endpoint/powershell_4104_hunting.test.yml +++ b/tests/endpoint/powershell_4104_hunting.test.yml @@ -6,7 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_testing/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + diff --git a/tests/endpoint/powershell_creating_thread_mutex.test.yml b/tests/endpoint/powershell_creating_thread_mutex.test.yml index a32d89cab3..37c4689bf6 100644 --- a/tests/endpoint/powershell_creating_thread_mutex.test.yml +++ b/tests/endpoint/powershell_creating_thread_mutex.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/powershell_domain_enumeration.test.yml b/tests/endpoint/powershell_domain_enumeration.test.yml index 6d025312f2..e9d8fa1345 100644 --- a/tests/endpoint/powershell_domain_enumeration.test.yml +++ b/tests/endpoint/powershell_domain_enumeration.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: enumeration.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml b/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml index 13c95788b5..f473641d83 100644 --- a/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml +++ b/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml b/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml index 2ec67fbc06..0440e79f08 100644 --- a/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml +++ b/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml b/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml index 1a75d8e2c6..4e29d2f76b 100644 --- a/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml +++ b/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: frombase64string.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml b/tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml index afb412a246..9442c06b3d 100644 --- a/tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml +++ b/tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: getlocalgroup.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml index da5bf70239..35727127ad 100644 --- a/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml +++ b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: reflection.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/powershell_processing_stream_of_data.test.yml b/tests/endpoint/powershell_processing_stream_of_data.test.yml index 4efed82800..c76cfddc9b 100644 --- a/tests/endpoint/powershell_processing_stream_of_data.test.yml +++ b/tests/endpoint/powershell_processing_stream_of_data.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: streamreader.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/powershell_remove_windows_defender_directory.test.yml b/tests/endpoint/powershell_remove_windows_defender_directory.test.yml index 7d2b2a107f..57f2901f9f 100644 --- a/tests/endpoint/powershell_remove_windows_defender_directory.test.yml +++ b/tests/endpoint/powershell_remove_windows_defender_directory.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/rmdir_defender_pwsh/powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog \ No newline at end of file + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/recon_using_wmi_class.test.yml b/tests/endpoint/recon_using_wmi_class.test.yml index 83de3af306..ff3eb94fe1 100644 --- a/tests/endpoint/recon_using_wmi_class.test.yml +++ b/tests/endpoint/recon_using_wmi_class.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml b/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml index eafdaf78a4..b048967b98 100644 --- a/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml +++ b/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml @@ -9,4 +9,4 @@ tests: - file_name: windows-powershell-xml.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: xmlwineventlog + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml b/tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml index adee413abd..6068ceec4a 100644 --- a/tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml +++ b/tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: adsisearcher-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml b/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml index e5c9cdd982..3851ac94cb 100644 --- a/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml +++ b/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell_kerberos.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: sbl_xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wmi_recon_running_process_or_services.test.yml b/tests/endpoint/wmi_recon_running_process_or_services.test.yml index b18eb8cfb0..1241bd7cb4 100644 --- a/tests/endpoint/wmi_recon_running_process_or_services.test.yml +++ b/tests/endpoint/wmi_recon_running_process_or_services.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: win32process.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog