Branch was auto-updated.

detections/endpoint/windows_indirect_command_execution_via_forfiles.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Living Off The Land
+  - Windows Post-Exploitation
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/windows_information_discovery_fsutil.yml

@@ -4,7 +4,7 @@ version: 1
 date: '2022-11-30'
 author: Teoderick Contreras, Splunk
 status: production
-type: Hunting
+type: Anomaly
 description: The following analytic identifies a process execution of Windows OS built-in
   tool FSUTIL to discover file system information. This tool is being abused or used
   by several adversaries or threat actor to query/list all drives, drive type, volume

detections/endpoint/windows_password_managers_discovery.yml

@@ -4,7 +4,7 @@ version: 1
 date: '2022-11-30'
 author: Teoderick Contreras, Splunk
 status: production
-type: Hunting
+type: Anomaly
 description: The following analytic identifies a process command line that retrieves
   information related to password manager software. This technique was seen in several
   post exploitation tools like winpeas that are being used by Ransomware Prestige

detections/endpoint/windows_post_exploitation_risk_behavior.yml

@@ -0,0 +1,73 @@
+name: Windows Post Exploitation Risk Behavior
+id: edb930df-64c2-4bb7-9b5c-889ed53fb973
+version: 1
+date: '2023-06-14'
+author: Teoderick Contreras, Splunk
+status: production
+type: Correlation
+data_source: []
+description: The following correlation identifies a four or more number of distinct analytics associated with the Windows Post-Exploitation analytic story, which enables the identification of potentially suspicious behavior. Windows Post-Exploitation refers to the phase that occurs after an attacker successfully compromises a Windows system. During this stage, attackers strive to maintain persistence, gather sensitive information, escalate privileges, and exploit the compromised environment further. Timely detection of post-exploitation activities is crucial for prompt response and effective mitigation. Common post-exploitation detections encompass identifying suspicious processes or services running on the system, detecting unusual network connections or traffic patterns, identifying modifications to system files or registry entries, monitoring abnormal user account activities, and flagging unauthorized privilege escalations. Ensuring the detection of post-exploitation activities is essential to proactively prevent further compromise, minimize damage, and restore the security of the Windows environment.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime 
+  sum(All_Risk.calculated_risk_score) as risk_score, 
+  count(All_Risk.calculated_risk_score) as risk_event_count, 
+  values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id,
+  dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, 
+  values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, 
+  dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, 
+  values(All_Risk.tag) as tag, values(source) as source, 
+  dc(source) as source_count from datamodel=Risk.All_Risk 
+  where All_Risk.analyticstories IN ("*Windows Post-Exploitation*") 
+  by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic 
+  | `drop_dm_object_name(All_Risk)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | where source_count >= 4 
+  | `windows_post_exploitation_risk_behavior_filter`'
+how_to_implement: Splunk Enterprise Security is required to utilize this correlation. In addition, 
+  modify the source_count value to your environment. In our testing, a count of 4 or 5 was decent in a lab, 
+  but the number may need to be increased base on internal testing. In addition, 
+  based on false positives, modify any analytics to be anomaly and lower or increase risk based on organization importance.
+known_false_positives: False positives will be present based on many factors. Tune
+  the correlation as needed to reduce too many triggers.
+references:
+- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS/winPEASbat
+tags:
+  analytic_story:
+  - Windows Post-Exploitation
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: An increase of Windows Post Exploitation behavior has been detected on $affected_systems$
+  mitre_attack_id:
+  - T1012
+  - T1049
+  - T1069
+  - T1016
+  - T1003
+  - T1082
+  - T1115
+  - T1552
+  observable:
+  - name: affected_systems
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - All_Risk.analyticstories
+  - All_Risk.risk_object_type
+  - All_Risk.risk_object
+  - All_Risk.annotations.mitre_attack.mitre_tactic
+  - source
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/windows_post_exploitation/windows_post_exploitation_risk.log
+    source: wpe
+    sourcetype: stash