From a1102853991f7951c274b572b56f686ee5a5d577 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 15 Sep 2021 13:13:38 -0700 Subject: [PATCH 1/5] deprecate --- .../{cloud => deprecated}/baseline_of_api_calls_per_user_arn.yml | 0 ...aseline_of_excessive_aws_instances_launched_by_user___mltk.yml | 0 ...eline_of_excessive_aws_instances_terminated_by_user___mltk.yml | 0 .../previously_seen_api_call_per_user_roles_in_cloudtrail.yml | 0 .../previously_seen_aws_cross_account_activity_initial.yml | 0 .../previously_seen_aws_provisioning_activity_sources.yml | 0 detections/{cloud => deprecated}/previously_seen_ec2_amis.yml | 0 .../{cloud => deprecated}/previously_seen_ec2_instance_types.yml | 0 .../previously_seen_ec2_launches_by_user.yml | 0 .../{cloud => deprecated}/previously_seen_users_in_cloudtrail.yml | 0 .../update_previously_seen_users_in_cloudtrail.yml | 0 11 files changed, 0 insertions(+), 0 deletions(-) rename detections/{cloud => deprecated}/baseline_of_api_calls_per_user_arn.yml (100%) rename detections/{cloud => deprecated}/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml (100%) rename detections/{cloud => deprecated}/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml (100%) rename detections/{cloud => deprecated}/previously_seen_api_call_per_user_roles_in_cloudtrail.yml (100%) rename detections/{cloud => deprecated}/previously_seen_aws_cross_account_activity_initial.yml (100%) rename detections/{cloud => deprecated}/previously_seen_aws_provisioning_activity_sources.yml (100%) rename detections/{cloud => deprecated}/previously_seen_ec2_amis.yml (100%) rename detections/{cloud => deprecated}/previously_seen_ec2_instance_types.yml (100%) rename detections/{cloud => deprecated}/previously_seen_ec2_launches_by_user.yml (100%) rename detections/{cloud => deprecated}/previously_seen_users_in_cloudtrail.yml (100%) rename detections/{cloud => deprecated}/update_previously_seen_users_in_cloudtrail.yml (100%) diff --git a/detections/cloud/baseline_of_api_calls_per_user_arn.yml b/detections/deprecated/baseline_of_api_calls_per_user_arn.yml similarity index 100% rename from detections/cloud/baseline_of_api_calls_per_user_arn.yml rename to detections/deprecated/baseline_of_api_calls_per_user_arn.yml diff --git a/detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/detections/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml similarity index 100% rename from detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml rename to detections/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml diff --git a/detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml b/detections/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml similarity index 100% rename from detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml rename to detections/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml diff --git a/detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml b/detections/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml similarity index 100% rename from detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml rename to detections/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml diff --git a/detections/cloud/previously_seen_aws_cross_account_activity_initial.yml b/detections/deprecated/previously_seen_aws_cross_account_activity_initial.yml similarity index 100% rename from detections/cloud/previously_seen_aws_cross_account_activity_initial.yml rename to detections/deprecated/previously_seen_aws_cross_account_activity_initial.yml diff --git a/detections/cloud/previously_seen_aws_provisioning_activity_sources.yml b/detections/deprecated/previously_seen_aws_provisioning_activity_sources.yml similarity index 100% rename from detections/cloud/previously_seen_aws_provisioning_activity_sources.yml rename to detections/deprecated/previously_seen_aws_provisioning_activity_sources.yml diff --git a/detections/cloud/previously_seen_ec2_amis.yml b/detections/deprecated/previously_seen_ec2_amis.yml similarity index 100% rename from detections/cloud/previously_seen_ec2_amis.yml rename to detections/deprecated/previously_seen_ec2_amis.yml diff --git a/detections/cloud/previously_seen_ec2_instance_types.yml b/detections/deprecated/previously_seen_ec2_instance_types.yml similarity index 100% rename from detections/cloud/previously_seen_ec2_instance_types.yml rename to detections/deprecated/previously_seen_ec2_instance_types.yml diff --git a/detections/cloud/previously_seen_ec2_launches_by_user.yml b/detections/deprecated/previously_seen_ec2_launches_by_user.yml similarity index 100% rename from detections/cloud/previously_seen_ec2_launches_by_user.yml rename to detections/deprecated/previously_seen_ec2_launches_by_user.yml diff --git a/detections/cloud/previously_seen_users_in_cloudtrail.yml b/detections/deprecated/previously_seen_users_in_cloudtrail.yml similarity index 100% rename from detections/cloud/previously_seen_users_in_cloudtrail.yml rename to detections/deprecated/previously_seen_users_in_cloudtrail.yml diff --git a/detections/cloud/update_previously_seen_users_in_cloudtrail.yml b/detections/deprecated/update_previously_seen_users_in_cloudtrail.yml similarity index 100% rename from detections/cloud/update_previously_seen_users_in_cloudtrail.yml rename to detections/deprecated/update_previously_seen_users_in_cloudtrail.yml From 9e221741152c758af9574a31dbb760ab3e78d1a8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 15 Sep 2021 15:48:01 -0700 Subject: [PATCH 2/5] revert --- .../previously_seen_aws_cross_account_activity_initial.yml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename detections/{deprecated => cloud}/previously_seen_aws_cross_account_activity_initial.yml (100%) diff --git a/detections/deprecated/previously_seen_aws_cross_account_activity_initial.yml b/detections/cloud/previously_seen_aws_cross_account_activity_initial.yml similarity index 100% rename from detections/deprecated/previously_seen_aws_cross_account_activity_initial.yml rename to detections/cloud/previously_seen_aws_cross_account_activity_initial.yml From 5b56ddb588593118f600b87cd9d1b73a4a136e53 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 21 Sep 2021 18:10:11 +0000 Subject: [PATCH 3/5] Added detection testing service results inPowershell Disable Security Monitoring --- ...powershell_disable_security_monitoring.yml | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 26a0d07e05..94dde9352f 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -12,10 +12,15 @@ description: This search is to identifies a modification in registry to disable search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*" AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*") - by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + by Processes.dest Processes.user Processes.parent_process Processes.original_file_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `powershell_disable_security_monitoring_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: Limited false positives. However, tune based on scripts that may perform this action. references: @@ -39,11 +44,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path From e2a6903b2616a071ae98ca0f1fa4742eddf01589 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 21 Sep 2021 18:14:10 +0000 Subject: [PATCH 4/5] Added detection testing service results inExcessive Usage Of Net App --- .../endpoint/excessive_usage_of_net_app.yml | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index e246211019..90d4e076d0 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -12,10 +12,15 @@ description: This analytic identifies excessive usage of `net.exe` or `net1.exe` malicious behavior. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name Processes.parent_process_name Processes.original_file_name - Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name + Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user + _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: unknown. Filter as needed. Modify the time span as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -60,11 +65,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path From 3010cea72452bb5b9f1bb1325082821a12df2c48 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 21 Sep 2021 18:24:38 +0000 Subject: [PATCH 5/5] Added detection testing service results inOffice Product Spawning MSHTA --- .../office_product_spawning_mshta.yml | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 00148dc9da..6106b3e695 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -19,10 +19,15 @@ description: The following detection identifies the latest behavior utilized by search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_mshta` - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_mshta_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `office_product_spawning_mshta_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: No false positives known. Filter as needed. references: - https://redcanary.com/threat-detection-report/threats/TA551/ @@ -61,11 +66,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path