From 14c09b5cc27803c6e49b6f1b5f60174883676a4f Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 14 Jun 2023 16:27:38 +0200 Subject: [PATCH 1/2] post_expoitation_correlation --- ...ndirect_command_execution_via_forfiles.yml | 1 + .../windows_information_discovery_fsutil.yml | 2 +- .../windows_password_managers_discovery.yml | 2 +- ...indows_post_exploitation_risk_behavior.yml | 75 +++++++++++++++++++ 4 files changed, 78 insertions(+), 2 deletions(-) create mode 100644 detections/endpoint/windows_post_exploitation_risk_behavior.yml diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index f8d02915c9..c80dbb3049 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Living Off The Land + - Windows Post-Exploitation asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_information_discovery_fsutil.yml b/detections/endpoint/windows_information_discovery_fsutil.yml index 5b84688db4..a4ea32793a 100644 --- a/detections/endpoint/windows_information_discovery_fsutil.yml +++ b/detections/endpoint/windows_information_discovery_fsutil.yml @@ -4,7 +4,7 @@ version: 1 date: '2022-11-30' author: Teoderick Contreras, Splunk status: production -type: Hunting +type: Anomaly description: The following analytic identifies a process execution of Windows OS built-in tool FSUTIL to discover file system information. This tool is being abused or used by several adversaries or threat actor to query/list all drives, drive type, volume diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml index 628fa93bca..7a40b2c22a 100644 --- a/detections/endpoint/windows_password_managers_discovery.yml +++ b/detections/endpoint/windows_password_managers_discovery.yml @@ -4,7 +4,7 @@ version: 1 date: '2022-11-30' author: Teoderick Contreras, Splunk status: production -type: Hunting +type: Anomaly description: The following analytic identifies a process command line that retrieves information related to password manager software. This technique was seen in several post exploitation tools like winpeas that are being used by Ransomware Prestige diff --git a/detections/endpoint/windows_post_exploitation_risk_behavior.yml b/detections/endpoint/windows_post_exploitation_risk_behavior.yml new file mode 100644 index 0000000000..c7c0e2eb26 --- /dev/null +++ b/detections/endpoint/windows_post_exploitation_risk_behavior.yml @@ -0,0 +1,75 @@ +name: Windows Post Exploitation Risk Behavior +id: edb930df-64c2-4bb7-9b5c-889ed53fb973 +version: 1 +date: '2023-06-14' +author: Teoderick Contreras, Splunk +status: production +type: Correlation +data_source: [] +description: The following correlation identifies a distinct amount of analytics associated + with the Windows Post-Expliotaiton analytic story that identify potentially suspicious + behavior. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime + sum(All_Risk.calculated_risk_score) as risk_score, + count(All_Risk.calculated_risk_score) as risk_event_count, + values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, + dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, + values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, + dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, + values(All_Risk.tag) as tag, values(source) as source, + dc(source) as source_count from datamodel=Risk.All_Risk + where All_Risk.analyticstories IN ("*Windows Post-Exploitation*") + by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic + | `drop_dm_object_name(All_Risk)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | where source_count >= 4 + | `windows_post_exploitation_risk_behavior_filter`' +how_to_implement: Splunk Enterprise Security is required to utilize this correlation. In addition, + modify the source_count value to your environment. In our testing, a count of 4 or 5 was decent in a lab, + but the number may need to be increased base on internal testing. In addition, + based on false positives, modify any analytics to be anomaly and lower or increase risk based on organization importance. +known_false_positives: False positives will be present based on many factors. Tune + the correlation as needed to reduce too many triggers. +references: +- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS/winPEASbat +tags: + analytic_story: + - Windows Post-Exploitation + asset_type: Endpoint + confidence: 70 + impact: 70 + message: An increase of Windows Post Exploitation behavior has been detected on $affected_systems$ + mitre_attack_id: + - T1012 + - T1049 + - T1069 + - T1016 + - T1003 + - T1082 + - T1115 + - T1552 + observable: + - name: affected_systems + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 49 + required_fields: + - _time + - All_Risk.analyticstories + - All_Risk.risk_object_type + - All_Risk.risk_object + - All_Risk.annotations.mitre_attack.mitre_tactic + - source + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/windows_post_exploitation/windows_post_exploitation_risk.log + source: wpe + sourcetype: stash From 7fb40505f8fb9d0064473f11ed9d8f9bf5412ee9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 12 Jul 2023 17:35:57 -0500 Subject: [PATCH 2/2] Update windows_post_exploitation_risk_behavior.yml --- .../endpoint/windows_post_exploitation_risk_behavior.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/detections/endpoint/windows_post_exploitation_risk_behavior.yml b/detections/endpoint/windows_post_exploitation_risk_behavior.yml index c7c0e2eb26..d4d1e3f0ef 100644 --- a/detections/endpoint/windows_post_exploitation_risk_behavior.yml +++ b/detections/endpoint/windows_post_exploitation_risk_behavior.yml @@ -6,9 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: Correlation data_source: [] -description: The following correlation identifies a distinct amount of analytics associated - with the Windows Post-Expliotaiton analytic story that identify potentially suspicious - behavior. +description: The following correlation identifies a four or more number of distinct analytics associated with the Windows Post-Exploitation analytic story, which enables the identification of potentially suspicious behavior. Windows Post-Exploitation refers to the phase that occurs after an attacker successfully compromises a Windows system. During this stage, attackers strive to maintain persistence, gather sensitive information, escalate privileges, and exploit the compromised environment further. Timely detection of post-exploitation activities is crucial for prompt response and effective mitigation. Common post-exploitation detections encompass identifying suspicious processes or services running on the system, detecting unusual network connections or traffic patterns, identifying modifications to system files or registry entries, monitoring abnormal user account activities, and flagging unauthorized privilege escalations. Ensuring the detection of post-exploitation activities is essential to proactively prevent further compromise, minimize damage, and restore the security of the Windows environment. search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count,