From 37cdc47b1692ea88cb4629ed5c9433cc7fa8c4ac Mon Sep 17 00:00:00 2001 From: "jim@apger.com" Date: Fri, 9 Jul 2021 08:37:43 -0500 Subject: [PATCH 1/2] start from original develop and add a date change to troubleshoot build process. If this fails, it not a content issue --- detections/endpoint/winword_spawning_powershell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index a76e3afa90..da882fa6bb 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -1,7 +1,7 @@ name: Winword Spawning PowerShell id: b2c950b8-9be2-11eb-8658-acde48001122 version: 1 -date: '2021-04-12' +date: '2021-07-09' author: Michael Haag, Splunk type: batch datamodel: From bbb3a72bfe273c6fbf58eac5e9728107c897d499 Mon Sep 17 00:00:00 2001 From: "jim@apger.com" Date: Mon, 12 Jul 2021 09:24:58 -0500 Subject: [PATCH 2/2] 6 perfect rules --- .../endpoint/windows_event_log_cleared.yml | 13 +++++++++++ ...ndows_security_account_manager_stopped.yml | 21 +++++++++++++++++ ..._scheduled_task_created_to_spawn_shell.yml | 19 +++++++++++++++ ...eduled_task_created_within_public_path.yml | 19 +++++++++++++++ detections/endpoint/winword_spawning_cmd.yml | 21 +++++++++++++++++ .../endpoint/winword_spawning_powershell.yml | 23 ++++++++++++++++++- 6 files changed, 115 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 2d1093afd1..04326313d8 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -56,3 +56,16 @@ tags: - EventCode - dest security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: "Windows event logs cleared on $dest$ via EventCode $EventCode$" + observable: + - name: dest + type: Endpoint + role: + - Victim diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index fef52f7f43..a4249f4b96 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -47,3 +47,24 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: "The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $processs$" + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + - name: process + type: Process + role: + - Target diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 6398576f38..eab7585981 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -64,3 +64,22 @@ tags: - Description - Command security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Persistence + - Stage:Privilege Escalation + message: "A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$" + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: Command + type: Command + role: + - Target diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 50bf759520..286365a871 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -64,3 +64,22 @@ tags: - Description - Command security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Persistence + - Stage:Privilege Escalation + message: "A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$" + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: Command + type: Command + role: + - Target diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml index 74c31fea07..691992fcec 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -50,3 +50,24 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - Source:Endpoint + - Stage:Initial Access + message: "$parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks." + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + - name: process_name + type: Process + role: + - Target diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index da882fa6bb..1f0deefa42 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -1,7 +1,7 @@ name: Winword Spawning PowerShell id: b2c950b8-9be2-11eb-8658-acde48001122 version: 1 -date: '2021-07-09' +date: '2021-04-12' author: Michael Haag, Splunk type: batch datamodel: @@ -52,3 +52,24 @@ tags: - user - parent_process_id security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - Source:Endpoint + - Stage:Initial Access + message: "$parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks" + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + - name: process_name + type: Process + role: + - Target