adding analytic story and three new detections

detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml

@@ -21,6 +21,7 @@ references:
 tags:
   analytic_story:
   - Windows Privilege Escalation
+  - Active Directory Kerberos Attacks
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml

@@ -0,0 +1,68 @@
+name: Mimikatz PassTheTicket CommandLine Parameters
+id: 13bbd574-83ac-11ec-99d4-acde48001122
+version: 1
+date: '2022-02-01'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. 
+  Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
+  Defenders should be aware that adversaries may customize the source code of Mimikatz and modify the command line parameters. This would effectively bypass this analytic.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*sekurlsa::tickets /export*" 
+  OR Processes.process = "*kerberos::ptt*") by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz.
+references:
+- https://github.com/gentilkiwi/mimikatz  
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1550.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 60
+  confidence: 60 
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  message: Mimikatz command line parameters for pass the ticket attacks were used on $dest$ 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process

detections/endpoint/rubeus_command_line_parameters.yml

@@ -0,0 +1,72 @@
+name: Rubeus Command Line Parameters
+id: cca37478-8377-11ec-b59a-acde48001122
+version: 1
+date: '2022-02-01'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs 
+  MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized in common Kerberos attacks like exporting and importing tickets,
+  forging silver and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory networks.
+  Defenders should be aware that adversaries may customize the source code of Rubeus and modify the command line parameters. This would effectively bypass this analytic.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*" 
+  OR Processes.process = "* monitor*" OR Processes.process ="* asktgt* /user:*" OR Processes.process ="* asktgs* /service:*" 
+  OR Processes.process ="* golden* /user:*" OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*" 
+  OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*" OR Processes.process = "* brute* /password:*"
+  OR Processes.process = "* brute* /passwords:*" OR Processes.process ="* harvest*") by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed.
+references:
+- https://github.com/GhostPack/Rubeus  
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1550.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 60
+  confidence: 60 
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  message: Rubeus command line parameters were used on $dest$ 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process

detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml

@@ -0,0 +1,67 @@
+name: Rubeus Kerberos Ticket Exports Through Winlogon Access
+id: 5ed8c50a-8869-11ec-876f-acde48001122
+version: 1
+date: '2022-02-07'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic looks for a process accessing the winlogon.exe system process. The Splunk Threat Research team identified this behavior
+  when using the Rubeus tool to monitor for and export kerberos tickets from memory. Exporting tickets from memory is typically the first step for pass the ticket attacks.
+  Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
+  Defenders should be aware that adversaries may customize the source code of Rubeus to potentially bypass this analytic.
+search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff)
+  (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND 
+  SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND
+  SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage,
+  SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename
+  Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`'
+how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
+  includes EventCode 10.exe. This search uses an input macro named `sysmon`.
+  We strongly recommend that you specify your environment-specific configurations
+  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
+  with configurations for your Splunk environment.
+known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed
+references:
+- https://github.com/GhostPack/Rubeus
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1550.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetImage
+  - CallTrace
+  - Computer
+  - TargetProcessId
+  - SourceImage
+  - SourceProcessId
+  security_domain: endpoint
+  impact: 60
+  confidence: 60
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: Winlogon.exe was accessed by $SourceImage$ on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: TargetImage
+    type: Process
+    role:
+    - Target

detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml

@@ -48,6 +48,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml

@@ -66,6 +66,7 @@ tags:
   impact: 80
   kill_chain_phases:
   - Privilege Escalation
+  - Active Directory Kerberos Attacks
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ attempting to identify service principle names.
   mitre_attack_id:

stories/active_directory_kerberos_attacks.yml

@@ -0,0 +1,22 @@
+name: Active Directory Kerberos Attacks
+id: 38b8cf16-8461-11ec-ade1-acde48001122
+version: 1
+date: '2022-02-02'
+author: Mauricio Velazco, Splunk
+description: UPDATE_DESCRIPTION
+narrative: UPDATE_NARRATIVE
+references:
+- https://www.destroyallsoftware.com/talks/wat
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  category:
+  - Adversary Tactics
+  - Account Compromise
+  - Lateral Movement
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml

@@ -0,0 +1,12 @@
+name: Mimikatz PassTheTicket CommandLine Parameters Unit Test
+tests:
+- name: Mimikatz PassTheTicket CommandLine Parameters
+  file: endpoint/mimikatz_passtheticket_commandline_parameters.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rubeus_command_line_parameters.test.yml

@@ -0,0 +1,12 @@
+name: Rubeus Command Line Parameters Unit Test
+tests:
+- name: Rubeus Command Line Parameters
+  file: endpoint/rubeus_command_line_parameters.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml

@@ -0,0 +1,12 @@
+name: Rubeus Kerberos Ticket Exports Through Winlogon Access Unit Test
+tests:
+- name: Rubeus Kerberos Ticket Exports Through Winlogon Access
+  file: endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog