diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index fd02b34df5..759c31244f 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -144,6 +144,11 @@ setup_schema = { "app_version": "8.1.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz" }, + "SPLUNK_TA_FIX_WINDOWS":{ + "app_number": 9999, + "app_version": "1.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz" + }, "SPLUNK_COMMON_INFORMATION_MODEL": { "app_number": 1621, "app_version": "5.0.1", @@ -371,4 +376,4 @@ def validate(configuration: dict, skip_password_accessibility_check: bool = True except Exception as e: print("There was an error validation the configuration: [%s]" % ( str(e)), file=sys.stderr) - return None, setup_schema \ No newline at end of file + return None, setup_schema diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 5e6ba7915d..49a7687ab0 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -65,6 +65,11 @@ "app_version": "8.1.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz" }, + "SPLUNK_TA_FIX_WINDOWS":{ + "app_number": 9999, + "app_version": "1.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz" + }, "SPLUNK_COMMON_INFORMATION_MODEL": { "app_number": 1621, "app_version": "5.0.1", diff --git a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml new file mode 100644 index 0000000000..98ee9e880f --- /dev/null +++ b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml @@ -0,0 +1,75 @@ +name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos +id: 98f22d82-9d62-11eb-9fcf-acde48001122 +version: 2 +date: '2021-04-14' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies one source endpoint failing to authenticate + with 30 unique disabled domain users using the Kerberos protocol within 5 minutes. This behavior could + represent an adversary performing a Password Spraying attack against an Active Directory + environment using Kerberos to obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + As attackers + progress in a breach, mistakes will be made. In certain scenarios, adversaries may + execute a password spraying attack against disabled users. Event 4768 is generated + every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket + (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account + disabled, expired or locked out).\ + + This logic can be used for real time security monitoring as well as threat hunting exercises. + This detection will only trigger on domain controllers, not on member servers or workstations.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source ip and attempted user accounts.' +search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | where unique_accounts > 30 + | `windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple disabled domain + users is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners, multi-user systems missconfigured + systems. +references: +- https://attack.mitre.org/techniques/T1110/003/ +tags: + analytic_story: + - Active Directory Password Spraying + - Active Directory Kerberos Attacks + automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential Kerberos based password spraying attack from $IpAddress$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: IpAddress + type: Endpoint + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Status + - TargetUserName + - IpAddress + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml new file mode 100644 index 0000000000..a6135f6d0d --- /dev/null +++ b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml @@ -0,0 +1,76 @@ +name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos +id: 001266a6-9d5b-11eb-829b-acde48001122 +version: 2 +date: '2021-04-14' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies one source endpoint failing to authenticate + with 30 unique invalid domain users using the Kerberos protocol. This behavior could + represent an adversary performing a Password Spraying attack against an Active Directory + environment using Kerberos to obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + As attackers + progress in a breach, mistakes will be made. In certain scenarios, adversaries may + execute a password spraying attack using an invalid list of users. Event 4768 is + generated every time the Key Distribution Center issues a Kerberos Ticket Granting + Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` + (the attempted user is not a valid domain user).\ + + This logic can be used for real time security monitoring as well as threat hunting exercises. + This detection will only trigger on domain controllers, not on member servers or + workstations.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source ip and attempted user accounts.' +search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | where unique_accounts > 30 + | `windows_multiple_invalid_users_fail_to_authenticate_using_kerberos_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple invalid domain + users is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners, multi-user systems and missconfigured + systems. +references: +- https://attack.mitre.org/techniques/T1110/003/ +tags: + analytic_story: + - Active Directory Password Spraying + - Active Directory Kerberos Attacks + automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential Kerberos based password spraying attack from $IpAddress$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: IpAddress + type: Endpoint + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Status + - TargetUserName + - IpAddress + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml new file mode 100644 index 0000000000..560aa11bf0 --- /dev/null +++ b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml @@ -0,0 +1,78 @@ +name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM +id: 57ad5a64-9df7-11eb-a290-acde48001122 +version: 2 +date: '2021-04-15' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies one source endpoint failing to authenticate + with 30 unique invalid users using the NTLM protocol. This behavior could represent + an adversary performing a Password Spraying attack against an Active Directory environment + using NTLM to obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + As attackers progress + in a breach, mistakes will be made. In certain scenarios, adversaries may execute + a password spraying attack using an invalid list of users. Event 4776 is generated + on the computer that is authoritative for the provided credentials. For domain accounts, + the domain controller is authoritative. For local accounts, the local computer is + authoritative. Error code 0xC0000064 stands for `The username you typed does not + exist` (the attempted user is a legitimate domain user).\ + + This logic can be used for real time security monitoring as well as threat hunting exercises. + This detection will only trigger on domain controllers, not on member servers or + workstations.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source workstation name and attempted user accounts.' +search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation + | where unique_accounts > 30 + | `windows_multiple_invalid_users_failed_to_authenticate_using_ntlm_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller events. The Advanced Security Audit policy setting `Audit Credential + Validation' within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple invalid domain + users is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners and missconfigured systems. + If this detection triggers on a host other than a Domain Controller, the behavior + could represent a password spraying attack against the host's local accounts. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 +tags: + analytic_story: + - Active Directory Password Spraying + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential NTLM based password spraying attack from $Workstation$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: Workstation + type: Endpoint + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - TargetUserName + - Workstation + - Status + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml new file mode 100644 index 0000000000..d3b6758dd4 --- /dev/null +++ b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml @@ -0,0 +1,78 @@ +name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials +id: e61918fa-9ca4-11eb-836c-acde48001122 +version: 2 +date: '2021-04-13' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies a source user failing to authenticate + with 30 unique users using explicit credentials on a host. This behavior could represent + an adversary performing a Password Spraying attack against an Active Directory environment + to obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + Event 4648 is generated when a process + attempts an account logon by explicitly specifying that accounts credentials. This + event generates on domain controllers, member servers, and workstations.\ + + This logic can be used for real time security monitoring as well as threat hunting exercises. + This detection will trigger on the potenfially malicious host, perhaps controlled + via a trojan or operated by an insider threat, from where a password spraying attack + is being executed.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source account, attempted user accounts and the endpoint were + the behavior was identified.' +search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$ + | bucket span=5m _time + | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as tried_account by _time, Computer, Caller_User_Name + | where unique_accounts > 30 + | `windows_multiple_users_fail_to_authenticate_wth_explicitcredentials_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers as well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: A source user failing attempting to authenticate multiple users + on a host is not a common behavior for regular systems. Some applications, however, + may exhibit this behavior in which case sets of users hosts can be added to an allow + list. Possible false positive scenarios include systems where several users connect + to like Mail servers, identity providers, remote desktop services, Citrix, etc. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events +tags: + analytic_story: + - Active Directory Password Spraying + - Insider Threat + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential password spraying attack from $Computer$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Target_User_Name + - Caller_User_Name + - Computer + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml new file mode 100644 index 0000000000..e01ff2279a --- /dev/null +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml @@ -0,0 +1,76 @@ +name: Windows Multiple Users Failed To Authenticate From Host Using NTLM +id: 7ed272a4-9c77-11eb-af22-acde48001122 +version: 2 +date: '2021-04-13' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies one source endpoint failing to authenticate + with 30 unique valid users using the NTLM protocol. This behavior could represent + an adversary performing a Password Spraying attack against an Active Directory environment + using NTLM to obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + Event 4776 is generated + on the computer that is authoritative for the provided credentials. For domain accounts, + the domain controller is authoritative. For local accounts, the local computer is + authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted + user is a legitimate domain user).\ + + This logic can be used for real time security monitoring as well as threat hunting exercises. + This detection will only trigger on domain controllers, not on member servers or + workstations.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source workstation name and attempted user accounts.' +search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation + | where unique_accounts > 30 + | `windows_multiple_users_failed_to_authenticate_from_host_using_ntlm_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller events. The Advanced Security Audit policy setting `Audit Credential + Validation` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple valid domain users + is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners and missconfigured systems. + If this detection triggers on a host other than a Domain Controller, the behavior + could represent a password spraying attack against the host's local accounts. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 +tags: + analytic_story: + - Active Directory Password Spraying + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential NTLM based password spraying attack from $Workstation$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: Workstation + type: Endpoint + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Status + - TargetUserName + - Workstation + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml new file mode 100644 index 0000000000..3e8d59cb2e --- /dev/null +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml @@ -0,0 +1,79 @@ +name: Windows Multiple Users Failed To Authenticate From Process +id: 9015385a-9c84-11eb-bef2-acde48001122 +version: 2 +date: '2021-04-13' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies a source process name failing to authenticate + with 30 uniquer users. This behavior could represent an adversary performing a Password + Spraying attack against an Active Directory environment to obtain initial access + or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + Event 4625 generates on domain controllers, member servers, + and workstations when an account fails to logon. Logon Type 2 describes an iteractive + logon attempt.\ + + This logic can be used for real time security monitoring as well as threat hunting exercises. + This detection will trigger on the potenfially malicious host, perhaps controlled + via a trojan or operated by an insider threat, from where a password spraying attack + is being executed. This could be a domain controller as well as a member server + or workstation.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source process name, source account and attempted user accounts.' +search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-" + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, ProcessName, SubjectUserName, Computer + | where unique_accounts > 30 + | `windows_multiple_users_failed_to_authenticate_from_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers aas well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: A process failing to authenticate with multiple users is not + a common behavior for legitimate user sessions. Possible false positive scenarios + include but are not limited to vulnerability scanners and missconfigured systems. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 +- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events +tags: + analytic_story: + - Active Directory Password Spraying + - Insider Threat + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential password spraying attack from $Computer$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Logon_Type + - ProcessName + - SubjectUserName + - TargetUserName + - Computer + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml new file mode 100644 index 0000000000..9a155c03dd --- /dev/null +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml @@ -0,0 +1,76 @@ +name: Windows Multiple Users Failed To Authenticate Using Kerberos +id: 3a91a212-98a9-11eb-b86a-acde48001122 +version: 2 +date: '2021-04-08' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies one source endpoint failing to authenticate + with 30 unique users using the Kerberos protocol. This behavior could represent + an adversary performing a Password Spraying attack against an Active Directory environment + using Kerberos to obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + Event 4771 is generated + when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket + (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user + is a legitimate domain user).\ + + This logic can be used for real time security monitoring as well as threat hunting exercises. + This detection will only trigger on domain controllers, not on member servers or + workstations.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source ip and attempted user accounts.' +search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | where unique_accounts > 30 + | `windows_multiple_users_failed_to_authenticate_using_kerberos_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple valid domain users + is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners, missconfigured systems and + multi-user systems like Citrix farms. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319109(v=ws.11) +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771 +tags: + analytic_story: + - Active Directory Password Spraying + - Active Directory Kerberos Attacks + automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential Kerberos based password spraying attack from $IpAddress$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: IpAddress + type: Endpoint + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Status + - TargetUserName + - IpAddress + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml new file mode 100644 index 0000000000..32c66a3180 --- /dev/null +++ b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml @@ -0,0 +1,77 @@ +name: Windows Multiple Users Remotely Failed To Authenticate From Host +id: 80f9d53e-9ca1-11eb-b0d6-acde48001122 +version: 2 +date: '2021-04-13' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies a source host failing to authenticate + against a remote host with 30 unique users. This behavior could represent an adversary + performing a Password Spraying attack against an Active Directory environment to + obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + Event 4625 documents each and every + failed attempt to logon to the local computer. This event generates on domain controllers, + member servers, and workstations. Logon Type 3 describes an remote authentication + attempt.\ + + This logic can be used for real time security monitoring as well as threat hunting exercises. + This detection will trigger on the host that is the target of the password spraying + attack. This could be a domain controller as well as a member server or workstation.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source process name, source account and attempted user accounts.' +search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-" + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer + | where unique_accounts > 30 + | `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers as as well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: A host failing to authenticate with multiple valid users against + a remote host is not a common behavior for legitimate systems. Possible false positive + scenarios include but are not limited to vulnerability scanners, remote administration + tools, missconfigyred systems, etc. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 +- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events +tags: + analytic_story: + - Active Directory Password Spraying + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential password spraying attack on $ComputerName$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Logon_Type + - TargetUserName + - Computer + - IpAddress + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml similarity index 79% rename from detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml rename to detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml index a162d117a9..12f58d2fab 100644 --- a/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml @@ -1,7 +1,7 @@ -name: Windows Disabled Users Failing To Authenticate Kerberos -id: 98f22d82-9d62-11eb-9fcf-acde48001122 +name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos +id: f65aa026-b811-42ab-b4b9-d9088137648f version: 1 -date: '2021-04-14' +date: '2022-09-22' author: Mauricio Velazco, Splunk type: Anomaly datamodel: [] @@ -26,12 +26,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) +search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` ' + | search isOutlier=1 + | `windows_unusual_count_of_disabled_users_failed_auth_using_kerberos_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -52,19 +54,19 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -72,9 +74,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml similarity index 80% rename from detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml rename to detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml index be417870e8..190cc92973 100644 --- a/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml @@ -1,7 +1,7 @@ -name: Windows Invalid Users Failed Authentication via Kerberos -id: 001266a6-9d5b-11eb-829b-acde48001122 +name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos +id: f122cb2e-d773-4f11-8399-62a3572d8dd7 version: 1 -date: '2021-04-14' +date: '2022-09-22' author: Mauricio Velazco, Splunk type: Anomaly datamodel: [] @@ -26,12 +26,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) +search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` ' + | search isOutlier=1 + | `windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -52,19 +54,19 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -72,9 +74,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml similarity index 81% rename from detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml rename to detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml index b196a5ac52..7da39eaf34 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml @@ -1,7 +1,7 @@ -name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM -id: 57ad5a64-9df7-11eb-a290-acde48001122 +name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM +id: 15603165-147d-4a6e-9778-bd0ff39e668f version: 1 -date: '2021-04-15' +date: '2022-09-22' author: Mauricio Velazco, Splunk type: Anomaly datamodel: [] @@ -27,12 +27,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure - | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) - as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) +search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064 + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`' + | search isOutlier=1 + | `windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. @@ -54,7 +56,7 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation @@ -63,10 +65,10 @@ tags: - T1110.003 - T1110 observable: - - name: Source_Workstation + - name: Workstation type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -74,9 +76,9 @@ tags: required_fields: - _time - EventCode - - action - - Logon_Account - - Source_Workstation + - TargetUserName + - Workstation + - Status risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml similarity index 76% rename from detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml rename to detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml index 6e67a50199..e2a699b7ce 100644 --- a/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml @@ -1,7 +1,7 @@ -name: Windows Users Authenticate Using Explicit Credentials -id: e61918fa-9ca4-11eb-836c-acde48001122 +name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials +id: 14f414cf-3080-4b9b-aaf6-55a4ce947b93 version: 1 -date: '2021-04-13' +date: '2022-09-22' author: Mauricio Velazco, Splunk type: Anomaly datamodel: [] @@ -25,14 +25,14 @@ description: 'The following analytic identifies a source user failing to authent The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.' -search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account - = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) - | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" - | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as - tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) +search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$ + | bucket span=5m _time + | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as tried_account by _time, Computer, Caller_User_Name + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Computer + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` ' + | search isOutlier=1 + | `windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -56,19 +56,19 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack from $ComputerName$ + message: Potential password spraying attack from $Computer$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -76,9 +76,9 @@ tags: required_fields: - _time - EventCode - - Security_ID - - Account_Name - - ComputerName + - Target_User_Name + - Caller_User_Name + - Computer risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml similarity index 80% rename from detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml rename to detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml index e1ca5aa8f3..5f913bd39c 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml @@ -1,7 +1,7 @@ -name: Multiple Users Failing To Authenticate From Host Using Kerberos -id: 3a91a212-98a9-11eb-b86a-acde48001122 +name: Windows Unusual Count Of Users Failed To Auth Using Kerberos +id: bc9cb715-08ba-40c3-9758-6e2b26e455cb version: 1 -date: '2021-04-08' +date: '2022-09-22' author: Mauricio Velazco, Splunk type: Anomaly datamodel: [] @@ -24,12 +24,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) +search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`' + | search isOutlier=1 + | `windows_unusual_count_of_users_failed_to_auth_using_kerberos_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -52,19 +54,19 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -72,9 +74,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml similarity index 75% rename from detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml rename to detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml index c4ab63de4b..6c0734ccca 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml @@ -1,7 +1,7 @@ -name: Multiple Users Failing To Authenticate From Process -id: 9015385a-9c84-11eb-bef2-acde48001122 +name: Windows Unusual Count Of Users Failed To Authenticate From Process +id: 25bdb6cb-2e49-4d34-a93c-d6c567c122fe version: 1 -date: '2021-04-13' +date: '2022-09-22' author: Mauricio Velazco, Splunk type: Anomaly datamodel: [] @@ -25,14 +25,14 @@ description: 'The following analytic identifies a source process name failing to The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-" - | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account - = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName | - eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std - by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3) +search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-" + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, ProcessName, SubjectUserName, Computer + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ProcessName, SubjectUserName, Computer + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` ' + | search isOutlier=1 + | `windows_unusual_count_of_users_failed_to_authenticate_from_process_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -55,19 +55,19 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack from $ComputerName$ + message: Potential password spraying attack from $Computer$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -76,10 +76,10 @@ tags: - _time - EventCode - Logon_Type - - Caller_Process_Name - - Security_ID - - Account_Name - - ComputerName + - ProcessName + - SubjectUserName + - TargetUserName + - Computer risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml similarity index 78% rename from detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml rename to detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml index 392aa1aac1..acf144f72f 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml @@ -1,7 +1,7 @@ -name: Multiple Users Failing To Authenticate From Host Using NTLM -id: 7ed272a4-9c77-11eb-af22-acde48001122 +name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM +id: 6f6c8fd7-6a6b-4af9-a0e9-57cfc47a58b4 version: 1 -date: '2021-04-13' +date: '2022-09-22' author: Mauricio Velazco, Splunk type: Anomaly datamodel: [] @@ -25,12 +25,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure - | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) - as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) +search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter`' + | search isOutlier=1 + | `windows_unusual_count_of_users_failed_to_authenticate_using_ntlm_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled. @@ -52,19 +54,19 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation - message: Potential NTLM based password spraying attack from $Source_Workstation$ + message: Potential NTLM based password spraying attack from $Workstation$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Source_Workstation + - name: Workstation type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -72,9 +74,9 @@ tags: required_fields: - _time - EventCode - - action - - Logon_Account - - Source_Workstation + - Status + - TargetUserName + - Workstation risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml similarity index 74% rename from detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml rename to detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml index 6d9f1cb1fa..ed6b3d32e2 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml @@ -1,7 +1,7 @@ -name: Multiple Users Remotely Failing To Authenticate From Host -id: 80f9d53e-9ca1-11eb-b0d6-acde48001122 +name: Windows Unusual Count Of Users Remotely Failed To Auth From Host +id: cf06a0ee-ffa9-4ed3-be77-0670ed9bab52 version: 1 -date: '2021-04-13' +date: '2022-09-22' author: Mauricio Velazco, Splunk type: Anomaly datamodel: [] @@ -24,13 +24,14 @@ description: 'The following analytic identifies a source host failing to authent The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" - | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats - dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts - by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName - | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 - and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` ' +search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-" + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress, Computer + | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 + | `windows_unusual_count_of_users_remotely_failed_to_auth_from_host_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -53,19 +54,19 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack on $ComputerName$ + message: Potential password spraying attack on $Computer$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -74,10 +75,9 @@ tags: - _time - EventCode - Logon_Type - - Security_ID - - Account_Name - - ComputerName - - Source_Network_Address + - TargetUserName + - Computer + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/macros/wineventlog_security.yml b/macros/wineventlog_security.yml index 00d2e3d6b8..cfbe346e92 100644 --- a/macros/wineventlog_security.yml +++ b/macros/wineventlog_security.yml @@ -1,4 +1,4 @@ -definition: eventtype=wineventlog_security +definition: eventtype=wineventlog_security OR source="XmlWinEventLog:Security" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: wineventlog_security diff --git a/requirements.txt b/requirements.txt index 8ee8cdef0e..71b99b40c4 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,12 +1,12 @@ attackcti==0.3.8 docker==6.0.0 -GitPython==3.1.30 +GitPython==3.1.31 Jinja2==3.1.2 jsonschema==4.17.3 mock==4.0.3 psutil==5.9.4 pycvesearch==1.2 -pydantic==1.10.4 +pydantic==1.10.5 pytest==7.2.1 PyYAML==5.4.1 questionary==1.10.0 diff --git a/stories/active_directory_password_spraying.yml b/stories/active_directory_password_spraying.yml index c9f20df254..4f6eb46b6d 100644 --- a/stories/active_directory_password_spraying.yml +++ b/stories/active_directory_password_spraying.yml @@ -1,6 +1,6 @@ name: Active Directory Password Spraying id: 3de109da-97d2-11eb-8b6a-acde48001122 -version: 1 +version: 2 date: '2021-04-07' author: Mauricio Velazco, Splunk description: Monitor for activities and techniques associated with Password Spraying @@ -23,9 +23,9 @@ narrative: 'In a password spraying attack, adversaries leverage one or a small l Specifically, this Analytic Story is focused on detecting possible Password Spraying attacks against Active Directory environments leveraging Windows Event Logs in the `Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents - 9 detection analytics which can aid defenders in identifying instances where one + 16 detection analytics which can aid defenders in identifying instances where one source user, source host or source process attempts to authenticate against a target - or targets using a high, unsual, number of unique users. A user, host or process + or targets using a high or statiscally unsual, number of unique users. A user, host or process attempting to authenticate with multiple users is not common behavior for legitimate systems and should be monitored by security teams. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, diff --git a/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml b/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml deleted file mode 100644 index 3e50ccd72a..0000000000 --- a/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM Unit Test -tests: -- name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM - file: endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml b/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml deleted file mode 100644 index 4e6cc25342..0000000000 --- a/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Multiple Users Failing To Authenticate From Host Using Kerberos Unit Test -tests: -- name: Multiple Users Failing To Authenticate From Host Using Kerberos - file: endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml b/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml deleted file mode 100644 index ae8f9e96f3..0000000000 --- a/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Multiple Users Failing To Authenticate From Host Using NTLM Unit Test -tests: -- name: Multiple Users Failing To Authenticate From Host Using NTLM - file: endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_from_process.test.yml b/tests/endpoint/multiple_users_failing_to_authenticate_from_process.test.yml deleted file mode 100644 index e026eb0def..0000000000 --- a/tests/endpoint/multiple_users_failing_to_authenticate_from_process.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Multiple Users Failing To Authenticate From Process Unit Test -tests: -- name: Multiple Users Failing To Authenticate From Process - file: endpoint/multiple_users_failing_to_authenticate_from_process.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog diff --git a/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.test.yml b/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.test.yml deleted file mode 100644 index dbe9d7cb93..0000000000 --- a/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Multiple Users Remotely Failing To Authenticate From Host Unit Test -tests: -- name: Multiple Users Remotely Failing To Authenticate From Host - file: endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog diff --git a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml b/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml deleted file mode 100644 index fa414309f7..0000000000 --- a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Windows Disabled Users Failing To Authenticate Kerberos Unit Test -tests: -- name: Windows Disabled Users Failing To Authenticate Kerberos - file: endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog diff --git a/tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml b/tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml deleted file mode 100644 index 3c321e9d4a..0000000000 --- a/tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Windows Invalid Users Failed Authentication via Kerberos Unit Test -tests: -- name: Windows Invalid Users Failed Authentication via Kerberos - file: endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog diff --git a/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml b/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml new file mode 100644 index 0000000000..493bf7a4f7 --- /dev/null +++ b/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos Unit Test +tests: +- name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos + file: endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.test.yml b/tests/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.test.yml new file mode 100644 index 0000000000..1f1fd0041b --- /dev/null +++ b/tests/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos Unit Test +tests: +- name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos + file: endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.test.yml b/tests/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.test.yml new file mode 100644 index 0000000000..607107b007 --- /dev/null +++ b/tests/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.test.yml @@ -0,0 +1,12 @@ +name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM Unit Test +tests: +- name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM + file: endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.test.yml b/tests/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.test.yml new file mode 100644 index 0000000000..f5f4e10b07 --- /dev/null +++ b/tests/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.test.yml @@ -0,0 +1,12 @@ +name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials Unit Test +tests: +- name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials + file: endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.test.yml b/tests/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.test.yml new file mode 100644 index 0000000000..8f67831f95 --- /dev/null +++ b/tests/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.test.yml @@ -0,0 +1,12 @@ +name: Windows Multiple Users Failed To Authenticate From Host Using NTLM Unit Test +tests: +- name: Windows Multiple Users Failed To Authenticate From Host Using NTLM + file: endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_multiple_users_failed_to_authenticate_from_process.test.yml b/tests/endpoint/windows_multiple_users_failed_to_authenticate_from_process.test.yml new file mode 100644 index 0000000000..b2229173aa --- /dev/null +++ b/tests/endpoint/windows_multiple_users_failed_to_authenticate_from_process.test.yml @@ -0,0 +1,12 @@ +name: Windows Multiple Users Failed To Authenticate From Process Unit Test +tests: +- name: Windows Multiple Users Failed To Authenticate From Process + file: endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/tests/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.test.yml b/tests/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.test.yml new file mode 100644 index 0000000000..e08026d981 --- /dev/null +++ b/tests/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Windows Multiple Users Failed To Authenticate Using Kerberos Unit Test +tests: +- name: Windows Multiple Users Failed To Authenticate Using Kerberos + file: endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.test.yml b/tests/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.test.yml new file mode 100644 index 0000000000..57b3b78f83 --- /dev/null +++ b/tests/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.test.yml @@ -0,0 +1,12 @@ +name: Windows Multiple Users Remotely Failed To Authenticate From Host Unit Test +tests: +- name: Windows Multiple Users Remotely Failed To Authenticate From Host + file: endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.test.yml b/tests/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.test.yml new file mode 100644 index 0000000000..9656d3e7f6 --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos Unit Test +tests: +- name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos + file: endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/tests/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.test.yml b/tests/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.test.yml new file mode 100644 index 0000000000..89a0f0b218 --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos Unit Test +tests: +- name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos + file: endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.test.yml b/tests/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.test.yml new file mode 100644 index 0000000000..5db70d5d8c --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM Unit Test +tests: +- name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM + file: endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.test.yml b/tests/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.test.yml new file mode 100644 index 0000000000..2a6d1e8e6d --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials Unit Test +tests: +- name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials + file: endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.test.yml b/tests/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.test.yml new file mode 100644 index 0000000000..2304d156ca --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Users Failed To Auth Using Kerberos Unit Test +tests: +- name: Windows Unusual Count Of Users Failed To Auth Using Kerberos + file: endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.test.yml b/tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.test.yml new file mode 100644 index 0000000000..1f1b323b19 --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Users Failed To Authenticate From Process Unit Test +tests: +- name: Windows Unusual Count Of Users Failed To Authenticate From Process + file: endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.test.yml b/tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.test.yml new file mode 100644 index 0000000000..a4d1624f0c --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM Unit Test +tests: +- name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM + file: endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.test.yml b/tests/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.test.yml new file mode 100644 index 0000000000..d0d84ce19f --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Users Remotely Failed To Auth From Host Unit Test +tests: +- name: Windows Unusual Count Of Users Remotely Failed To Auth From Host + file: endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml b/tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml deleted file mode 100644 index 9ad33f4fb5..0000000000 --- a/tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Windows Users Authenticate Using Explicit Credentials Unit Test -tests: -- name: Windows Users Authenticate Using Explicit Credentials - file: endpoint/windows_users_authenticate_using_explicit_credentials.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog