From 238718f23dc0a4af78176b7deb6330db0b2afd2c Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 12 Sep 2022 11:16:39 -0400 Subject: [PATCH 01/16] updating dataset fields --- ...d_users_failing_to_authenticate_from_host_using_ntlm.yml | 2 +- ...ers_failing_to_authenticate_from_host_using_kerberos.yml | 2 +- ...e_users_failing_to_authenticate_from_host_using_ntlm.yml | 2 +- .../multiple_users_failing_to_authenticate_from_process.yml | 2 +- ...ple_users_remotely_failing_to_authenticate_from_host.yml | 2 +- ...dows_disabled_users_failing_to_authenticate_kerberos.yml | 2 +- ...ows_invalid_users_failed_authentication_via_kerberos.yml | 2 +- ...indows_users_authenticate_using_explicit_credentials.yml | 2 +- ...rs_failing_to_authenticate_from_host_using_ntlm.test.yml | 6 +++--- ...ailing_to_authenticate_from_host_using_kerberos.test.yml | 6 +++--- ...rs_failing_to_authenticate_from_host_using_ntlm.test.yml | 6 +++--- ...iple_users_failing_to_authenticate_from_process.test.yml | 6 +++--- ...sers_remotely_failing_to_authenticate_from_host.test.yml | 6 +++--- ...disabled_users_failing_to_authenticate_kerberos.test.yml | 6 +++--- ...nvalid_users_failed_authentication_via_kerberos.test.yml | 6 +++--- ...s_users_authenticate_using_explicit_credentials.test.yml | 6 +++--- 16 files changed, 32 insertions(+), 32 deletions(-) diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml index b196a5ac52..378c840655 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -54,7 +54,7 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index e1ca5aa8f3..c4805a016a 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -52,7 +52,7 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml index 392aa1aac1..d066d91190 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -52,7 +52,7 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml index c4ab63de4b..f51e565b23 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml @@ -55,7 +55,7 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml index 6d9f1cb1fa..c52b1c11c3 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml @@ -53,7 +53,7 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml b/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml index a162d117a9..5258268a48 100644 --- a/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml +++ b/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml @@ -52,7 +52,7 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml b/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml index be417870e8..29dde380da 100644 --- a/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml +++ b/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml @@ -52,7 +52,7 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml b/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml index 6e67a50199..2a829a8ac1 100644 --- a/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml @@ -56,7 +56,7 @@ tags: - Stage:Initial Access - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log impact: 70 kill_chain_phases: - Exploitation diff --git a/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml b/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml index 3e50ccd72a..3761285a16 100644 --- a/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml +++ b/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml b/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml index 4e6cc25342..868fcfcbfd 100644 --- a/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml +++ b/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml b/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml index ae8f9e96f3..8f9d79db97 100644 --- a/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml +++ b/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_from_process.test.yml b/tests/endpoint/multiple_users_failing_to_authenticate_from_process.test.yml index e026eb0def..d211861224 100644 --- a/tests/endpoint/multiple_users_failing_to_authenticate_from_process.test.yml +++ b/tests/endpoint/multiple_users_failing_to_authenticate_from_process.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.test.yml b/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.test.yml index dbe9d7cb93..da81754aa7 100644 --- a/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.test.yml +++ b/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml b/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml index 292e3877c8..0e3e606f5d 100644 --- a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml +++ b/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml b/tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml index 3c321e9d4a..fa57f47cbc 100644 --- a/tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml +++ b/tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml b/tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml index 9ad33f4fb5..7de63aa327 100644 --- a/tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml +++ b/tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog From fee038e7ff2e3e6827e1da8571c1337ca989f108 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 22 Sep 2022 11:43:22 -0400 Subject: [PATCH 02/16] renaming detections --- ...ple_invalid_users_failed_to_authenticate_using_ntlm.yml} | 4 ++-- ...e_users_failed_to_authenticate_from_host_using_ntlm.yml} | 2 +- ..._multiple_users_failed_to_authenticate_from_process.yml} | 2 +- ...ultiple_users_failed_to_authenticate_using_kerberos.yml} | 2 +- ...ple_users_remotely_failed_to_authenticate_from_host.yml} | 2 +- ...nvalid_users_failed_to_authenticate_using_ntlm.test.yml} | 6 +++--- ...rs_failed_to_authenticate_from_host_using_ntlm.test.yml} | 6 +++--- ...iple_users_failed_to_authenticate_from_process.test.yml} | 6 +++--- ...le_users_failed_to_authenticate_using_kerberos.test.yml} | 6 +++--- ...sers_remotely_failed_to_authenticate_from_host.test.yml} | 6 +++--- 10 files changed, 21 insertions(+), 21 deletions(-) rename detections/endpoint/{multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml => windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml} (95%) rename detections/endpoint/{multiple_users_failing_to_authenticate_from_host_using_ntlm.yml => windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml} (98%) rename detections/endpoint/{multiple_users_failing_to_authenticate_from_process.yml => windows_multiple_users_failed_to_authenticate_from_process.yml} (98%) rename detections/endpoint/{multiple_users_failing_to_authenticate_from_host_using_kerberos.yml => windows_multiple_users_failed_to_authenticate_using_kerberos.yml} (98%) rename detections/endpoint/{multiple_users_remotely_failing_to_authenticate_from_host.yml => windows_multiple_users_remotely_failed_to_authenticate_from_host.yml} (98%) rename tests/endpoint/{multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml => windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.test.yml} (60%) rename tests/endpoint/{multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml => windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.test.yml} (61%) rename tests/endpoint/{multiple_users_failing_to_authenticate_from_process.test.yml => windows_multiple_users_failed_to_authenticate_from_process.test.yml} (64%) rename tests/endpoint/{multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml => windows_multiple_users_failed_to_authenticate_using_kerberos.test.yml} (62%) rename tests/endpoint/{multiple_users_remotely_failing_to_authenticate_from_host.test.yml => windows_multiple_users_remotely_failed_to_authenticate_from_host.test.yml} (61%) diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml similarity index 95% rename from detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml rename to detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml index 378c840655..2fa132226f 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml @@ -1,4 +1,4 @@ -name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM +name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM id: 57ad5a64-9df7-11eb-a290-acde48001122 version: 1 date: '2021-04-15' @@ -32,7 +32,7 @@ search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 a as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`' + | search isOutlier=1 | `windows_multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml similarity index 98% rename from detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml rename to detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml index d066d91190..c1abafdc69 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml @@ -1,4 +1,4 @@ -name: Multiple Users Failing To Authenticate From Host Using NTLM +name: Windows Multiple Users Failed To Authenticate From Host Using NTLM id: 7ed272a4-9c77-11eb-af22-acde48001122 version: 1 date: '2021-04-13' diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml similarity index 98% rename from detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml rename to detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml index f51e565b23..e6af640d1b 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml @@ -1,4 +1,4 @@ -name: Multiple Users Failing To Authenticate From Process +name: Windows Multiple Users Failed To Authenticate From Process id: 9015385a-9c84-11eb-bef2-acde48001122 version: 1 date: '2021-04-13' diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml similarity index 98% rename from detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml rename to detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml index c4805a016a..5379acb4c3 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml @@ -1,4 +1,4 @@ -name: Multiple Users Failing To Authenticate From Host Using Kerberos +name: Windows Multiple Users Failed To Authenticate Using Kerberos id: 3a91a212-98a9-11eb-b86a-acde48001122 version: 1 date: '2021-04-08' diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml similarity index 98% rename from detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml rename to detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml index c52b1c11c3..d905cf9804 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml @@ -1,4 +1,4 @@ -name: Multiple Users Remotely Failing To Authenticate From Host +name: Windows Multiple Users Remotely Failed To Authenticate From Host id: 80f9d53e-9ca1-11eb-b0d6-acde48001122 version: 1 date: '2021-04-13' diff --git a/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml b/tests/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.test.yml similarity index 60% rename from tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml rename to tests/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.test.yml index 3761285a16..607107b007 100644 --- a/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml +++ b/tests/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.test.yml @@ -1,7 +1,7 @@ -name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM Unit Test +name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM Unit Test tests: -- name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM - file: endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +- name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM + file: endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml b/tests/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.test.yml similarity index 61% rename from tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml rename to tests/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.test.yml index 8f9d79db97..8f67831f95 100644 --- a/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml +++ b/tests/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.test.yml @@ -1,7 +1,7 @@ -name: Multiple Users Failing To Authenticate From Host Using NTLM Unit Test +name: Windows Multiple Users Failed To Authenticate From Host Using NTLM Unit Test tests: -- name: Multiple Users Failing To Authenticate From Host Using NTLM - file: endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml +- name: Windows Multiple Users Failed To Authenticate From Host Using NTLM + file: endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_from_process.test.yml b/tests/endpoint/windows_multiple_users_failed_to_authenticate_from_process.test.yml similarity index 64% rename from tests/endpoint/multiple_users_failing_to_authenticate_from_process.test.yml rename to tests/endpoint/windows_multiple_users_failed_to_authenticate_from_process.test.yml index d211861224..b2229173aa 100644 --- a/tests/endpoint/multiple_users_failing_to_authenticate_from_process.test.yml +++ b/tests/endpoint/windows_multiple_users_failed_to_authenticate_from_process.test.yml @@ -1,7 +1,7 @@ -name: Multiple Users Failing To Authenticate From Process Unit Test +name: Windows Multiple Users Failed To Authenticate From Process Unit Test tests: -- name: Multiple Users Failing To Authenticate From Process - file: endpoint/multiple_users_failing_to_authenticate_from_process.yml +- name: Windows Multiple Users Failed To Authenticate From Process + file: endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml b/tests/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.test.yml similarity index 62% rename from tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml rename to tests/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.test.yml index 868fcfcbfd..e08026d981 100644 --- a/tests/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml +++ b/tests/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.test.yml @@ -1,7 +1,7 @@ -name: Multiple Users Failing To Authenticate From Host Using Kerberos Unit Test +name: Windows Multiple Users Failed To Authenticate Using Kerberos Unit Test tests: -- name: Multiple Users Failing To Authenticate From Host Using Kerberos - file: endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +- name: Windows Multiple Users Failed To Authenticate Using Kerberos + file: endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.test.yml b/tests/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.test.yml similarity index 61% rename from tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.test.yml rename to tests/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.test.yml index da81754aa7..57b3b78f83 100644 --- a/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.test.yml +++ b/tests/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.test.yml @@ -1,7 +1,7 @@ -name: Multiple Users Remotely Failing To Authenticate From Host Unit Test +name: Windows Multiple Users Remotely Failed To Authenticate From Host Unit Test tests: -- name: Multiple Users Remotely Failing To Authenticate From Host - file: endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +- name: Windows Multiple Users Remotely Failed To Authenticate From Host + file: endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From bff89c6a92bc5203e345990da38ad22771cb0e58 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 22 Sep 2022 12:21:11 -0400 Subject: [PATCH 03/16] renaming detections --- ...le_disabled_users_failed_to_authenticate_w_kerberos.yml} | 2 +- ...e_invalid_users_fail_to_authenticate_using_kerberos.yml} | 2 +- ..._users_fail_to_authenticate_wth_explicitcredentials.yml} | 2 +- ...bled_users_failed_to_authenticate_wth_kerberos.test.yml} | 6 +++--- ...alid_users_fail_to_authenticate_using_kerberos.test.yml} | 6 +++--- ...s_fail_to_authenticate_wth_explicitcredentials.test.yml} | 6 +++--- 6 files changed, 12 insertions(+), 12 deletions(-) rename detections/endpoint/{windows_disabled_users_failing_to_authenticate_kerberos.yml => windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml} (97%) rename detections/endpoint/{windows_invalid_users_failed_authentication_via_kerberos.yml => windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml} (97%) rename detections/endpoint/{windows_users_authenticate_using_explicit_credentials.yml => windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml} (98%) rename tests/endpoint/{windows_disabled_users_failing_to_authenticate_kerberos.test.yml => windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml} (61%) rename tests/endpoint/{windows_invalid_users_failed_authentication_via_kerberos.test.yml => windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.test.yml} (61%) rename tests/endpoint/{windows_users_authenticate_using_explicit_credentials.test.yml => windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.test.yml} (61%) diff --git a/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml similarity index 97% rename from detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml rename to detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml index 5258268a48..b456258380 100644 --- a/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml +++ b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml @@ -1,4 +1,4 @@ -name: Windows Disabled Users Failing To Authenticate Kerberos +name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos id: 98f22d82-9d62-11eb-9fcf-acde48001122 version: 1 date: '2021-04-14' diff --git a/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml similarity index 97% rename from detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml rename to detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml index 29dde380da..a60b1c0296 100644 --- a/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml +++ b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml @@ -1,4 +1,4 @@ -name: Windows Invalid Users Failed Authentication via Kerberos +name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos id: 001266a6-9d5b-11eb-829b-acde48001122 version: 1 date: '2021-04-14' diff --git a/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml similarity index 98% rename from detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml rename to detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml index 2a829a8ac1..2e33ae2ee0 100644 --- a/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml @@ -1,4 +1,4 @@ -name: Windows Users Authenticate Using Explicit Credentials +name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials id: e61918fa-9ca4-11eb-836c-acde48001122 version: 1 date: '2021-04-13' diff --git a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml b/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml similarity index 61% rename from tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml rename to tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml index 0e3e606f5d..791a19829a 100644 --- a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml +++ b/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml @@ -1,7 +1,7 @@ -name: Windows Disabled Users Failing To Authenticate Using Kerberos Unit Test +name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos Unit Test tests: -- name: Windows Disabled Users Failing To Authenticate Using Kerberos - file: endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml +- name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos + file: endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml b/tests/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.test.yml similarity index 61% rename from tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml rename to tests/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.test.yml index fa57f47cbc..1f1fd0041b 100644 --- a/tests/endpoint/windows_invalid_users_failed_authentication_via_kerberos.test.yml +++ b/tests/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.test.yml @@ -1,7 +1,7 @@ -name: Windows Invalid Users Failed Authentication via Kerberos Unit Test +name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos Unit Test tests: -- name: Windows Invalid Users Failed Authentication via Kerberos - file: endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml +- name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos + file: endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml b/tests/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.test.yml similarity index 61% rename from tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml rename to tests/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.test.yml index 7de63aa327..f5f4e10b07 100644 --- a/tests/endpoint/windows_users_authenticate_using_explicit_credentials.test.yml +++ b/tests/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.test.yml @@ -1,7 +1,7 @@ -name: Windows Users Authenticate Using Explicit Credentials Unit Test +name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials Unit Test tests: -- name: Windows Users Authenticate Using Explicit Credentials - file: endpoint/windows_users_authenticate_using_explicit_credentials.yml +- name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials + file: endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 109bf5e70710da7dec86dc5cff0a2a0c16891c5e Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 22 Sep 2022 15:00:21 -0400 Subject: [PATCH 04/16] modifying existing detections and adding new --- ...sers_failed_to_authenticate_w_kerberos.yml | 20 ++--- ...rs_fail_to_authenticate_using_kerberos.yml | 17 ++-- ...sers_failed_to_authenticate_using_ntlm.yml | 17 ++-- ...o_authenticate_wth_explicitcredentials.yml | 17 ++-- ...d_to_authenticate_from_host_using_ntlm.yml | 17 ++-- ...rs_failed_to_authenticate_from_process.yml | 17 ++-- ..._failed_to_authenticate_using_kerberos.yml | 17 ++-- ...otely_failed_to_authenticate_from_host.yml | 17 ++-- ...d_users_failed_to_authe_using_kerberos.yml | 80 +++++++++++++++++ ...alid_users_fail_to_auth_using_kerberos.yml | 80 +++++++++++++++++ ...nvalid_users_failed_to_auth_using_ntlm.yml | 82 ++++++++++++++++++ ...s_fail_to_auth_wth_explicitcredentials.yml | 84 ++++++++++++++++++ ...of_users_failed_to_auth_using_kerberos.yml | 80 +++++++++++++++++ ...rs_failed_to_authenticate_from_process.yml | 85 +++++++++++++++++++ ...sers_failed_to_authenticate_using_ntlm.yml | 80 +++++++++++++++++ ...sers_remotely_failed_to_auth_from_host.yml | 83 ++++++++++++++++++ ...ers_failed_to_auth_using_kerberos.test.yml | 12 +++ ...users_fail_to_auth_using_kerberos.test.yml | 12 +++ ...d_users_failed_to_auth_using_ntlm.test.yml | 12 +++ ...l_to_auth_wth_explicitcredentials.test.yml | 12 +++ ...ers_failed_to_auth_using_kerberos.test.yml | 12 +++ ...iled_to_authenticate_from_process.test.yml | 12 +++ ...failed_to_authenticate_using_ntlm.test.yml | 12 +++ ...remotely_failed_to_auth_from_host.test.yml | 12 +++ 24 files changed, 807 insertions(+), 82 deletions(-) create mode 100644 detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml create mode 100644 detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml create mode 100644 detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml create mode 100644 detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml create mode 100644 detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml create mode 100644 detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml create mode 100644 detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml create mode 100644 detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml create mode 100644 tests/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.test.yml create mode 100644 tests/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.test.yml create mode 100644 tests/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.test.yml create mode 100644 tests/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.test.yml create mode 100644 tests/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.test.yml create mode 100644 tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.test.yml create mode 100644 tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.test.yml create mode 100644 tests/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.test.yml diff --git a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml index b456258380..4cbf981c85 100644 --- a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml +++ b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml @@ -1,28 +1,24 @@ name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos id: 98f22d82-9d62-11eb-9fcf-acde48001122 -version: 1 +version: 2 date: '2021-04-14' author: Mauricio Velazco, Splunk -type: Anomaly +type: TTP datamodel: [] description: 'The following analytic identifies one source endpoint failing to authenticate - with multiple disabled domain users using the Kerberos protocol. This behavior could + with 30 unique disabled domain users using the Kerberos protocol within 5 minutes. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory - environment using Kerberos to obtain initial access or elevate privileges. As attackers + environment using Kerberos to obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ - The detection calculates the standard deviation for each host and leverages the - 3-sigma statistical rule to identify an unusual number of users. To customize this - analytic, users can try different combinations of the `bucket` span time and the - calculation of the `upperBound` field. This logic can be used for real time security - monitoring as well as threat hunting exercises.\ - - This detection will only trigger on domain controllers, not on member servers or - workstations.\ + This logic can be used for real time security monitoring as well as threat hunting exercises. + This detection will only trigger on domain controllers, not on member servers or workstations.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' diff --git a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml index a60b1c0296..872842890f 100644 --- a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml +++ b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml @@ -1,26 +1,23 @@ name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos id: 001266a6-9d5b-11eb-829b-acde48001122 -version: 1 +version: 2 date: '2021-04-14' author: Mauricio Velazco, Splunk -type: Anomaly +type: TTP datamodel: [] description: 'The following analytic identifies one source endpoint failing to authenticate - with multiple invalid domain users using the Kerberos protocol. This behavior could + with 30 unique invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory - environment using Kerberos to obtain initial access or elevate privileges. As attackers + environment using Kerberos to obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ - The detection calculates the standard deviation for each host and leverages the - 3-sigma statistical rule to identify an unusual number of users. To customize this - analytic, users can try different combinations of the `bucket` span time and the - calculation of the `upperBound` field. This logic can be used for real time security - monitoring as well as threat hunting exercises.\ - + This logic can be used for real time security monitoring as well as threat hunting exercises. This detection will only trigger on domain controllers, not on member servers or workstations.\ diff --git a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml index 2fa132226f..4ef8dc5bd9 100644 --- a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml @@ -1,14 +1,16 @@ name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM id: 57ad5a64-9df7-11eb-a290-acde48001122 -version: 1 +version: 2 date: '2021-04-15' author: Mauricio Velazco, Splunk -type: Anomaly +type: TTP datamodel: [] description: 'The following analytic identifies one source endpoint failing to authenticate - with multiple invalid users using the NTLM protocol. This behavior could represent + with 30 unique invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment - using NTLM to obtain initial access or elevate privileges. As attackers progress + using NTLM to obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, @@ -16,12 +18,7 @@ description: 'The following analytic identifies one source endpoint failing to a authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ - The detection calculates the standard deviation for each host and leverages the - 3-sigma statistical rule to identify an unusual number of users. To customize this - analytic, users can try different combinations of the `bucket` span time and the - calculation of the `upperBound` field. This logic can be used for real time security - monitoring as well as threat hunting exercises.\ - + This logic can be used for real time security monitoring as well as threat hunting exercises. This detection will only trigger on domain controllers, not on member servers or workstations.\ diff --git a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml index 2e33ae2ee0..2d08404dff 100644 --- a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml +++ b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml @@ -1,23 +1,20 @@ name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials id: e61918fa-9ca4-11eb-836c-acde48001122 -version: 1 +version: 2 date: '2021-04-13' author: Mauricio Velazco, Splunk -type: Anomaly +type: TTP datamodel: [] description: 'The following analytic identifies a source user failing to authenticate - with multiple users using explicit credentials on a host. This behavior could represent + with 30 unique users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment - to obtain initial access or elevate privileges. Event 4648 is generated when a process + to obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ - The detection calculates the standard deviation for each host and leverages the - 3-sigma statistical rule to identify an unusual number of users. To customize this - analytic, users can try different combinations of the `bucket` span time and the - calculation of the `upperBound` field. This logic can be used for real time security - monitoring as well as threat hunting exercises.\ - + This logic can be used for real time security monitoring as well as threat hunting exercises. This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml index c1abafdc69..afcaaaf69e 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml @@ -1,25 +1,22 @@ name: Windows Multiple Users Failed To Authenticate From Host Using NTLM id: 7ed272a4-9c77-11eb-af22-acde48001122 -version: 1 +version: 2 date: '2021-04-13' author: Mauricio Velazco, Splunk -type: Anomaly +type: TTP datamodel: [] description: 'The following analytic identifies one source endpoint failing to authenticate - with multiple valid users using the NTLM protocol. This behavior could represent + with 30 unique valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment - using NTLM to obtain initial access or elevate privileges. Event 4776 is generated + using NTLM to obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted user is a legitimate domain user).\ - The detection calculates the standard deviation for each host and leverages the - 3-sigma statistical rule to identify an unusual number of users. To customize this - analytic, users can try different combinations of the `bucket` span time and the - calculation of the `upperBound` field. This logic can be used for real time security - monitoring as well as threat hunting exercises.\ - + This logic can be used for real time security monitoring as well as threat hunting exercises. This detection will only trigger on domain controllers, not on member servers or workstations.\ diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml index e6af640d1b..0a88aee126 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml @@ -1,23 +1,20 @@ name: Windows Multiple Users Failed To Authenticate From Process id: 9015385a-9c84-11eb-bef2-acde48001122 -version: 1 +version: 2 date: '2021-04-13' author: Mauricio Velazco, Splunk -type: Anomaly +type: TTP datamodel: [] description: 'The following analytic identifies a source process name failing to authenticate - with multiple users. This behavior could represent an adversary performing a Password + with 30 uniquer users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access - or elevate privileges. Event 4625 generates on domain controllers, member servers, + or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + Event 4625 generates on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes an iteractive logon attempt.\ - The detection calculates the standard deviation for each host and leverages the - 3-sigma statistical rule to identify an unusual number of users. To customize this - analytic, users can try different combinations of the `bucket` span time and the - calculation of the `upperBound` field. This logic can be used for real time security - monitoring as well as threat hunting exercises.\ - + This logic can be used for real time security monitoring as well as threat hunting exercises. This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed. This could be a domain controller as well as a member server diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml index 5379acb4c3..7ddcb0e365 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml @@ -1,24 +1,21 @@ name: Windows Multiple Users Failed To Authenticate Using Kerberos id: 3a91a212-98a9-11eb-b86a-acde48001122 -version: 1 +version: 2 date: '2021-04-08' author: Mauricio Velazco, Splunk -type: Anomaly +type: TTP datamodel: [] description: 'The following analytic identifies one source endpoint failing to authenticate - with multiple valid users using the Kerberos protocol. This behavior could represent + with 30 unique users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment - using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated + using Kerberos to obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + Event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ - The detection calculates the standard deviation for each host and leverages the - 3-sigma statistical rule to identify an unusual number of users. To customize this - analytic, users can try different combinations of the `bucket` span time and the - calculation of the `upperBound` field. This logic can be used for real time security - monitoring as well as threat hunting exercises.\ - + This logic can be used for real time security monitoring as well as threat hunting exercises. This detection will only trigger on domain controllers, not on member servers or workstations.\ diff --git a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml index d905cf9804..7a3307ce62 100644 --- a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml +++ b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml @@ -1,24 +1,21 @@ name: Windows Multiple Users Remotely Failed To Authenticate From Host id: 80f9d53e-9ca1-11eb-b0d6-acde48001122 -version: 1 +version: 2 date: '2021-04-13' author: Mauricio Velazco, Splunk -type: Anomaly +type: TTP datamodel: [] description: 'The following analytic identifies a source host failing to authenticate - against a remote host with multiple users. This behavior could represent an adversary + against a remote host with 30 unique users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to - obtain initial access or elevate privileges. Event 4625 documents each and every + obtain initial access or elevate privileges. + Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed. + Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt.\ - The detection calculates the standard deviation for each host and leverages the - 3-sigma statistical rule to identify an unusual number of users. To customize this - analytic, users can try different combinations of the `bucket` span time and the - calculation of the `upperBound` field. This logic can be used for real time security - monitoring as well as threat hunting exercises.\ - + This logic can be used for real time security monitoring as well as threat hunting exercises. This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\ diff --git a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml new file mode 100644 index 0000000000..f98fdbdc96 --- /dev/null +++ b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml @@ -0,0 +1,80 @@ +name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos +id: f65aa026-b811-42ab-b4b9-d9088137648f +version: 1 +date: '2022-09-22' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: 'The following analytic identifies one source endpoint failing to authenticate + with multiple disabled domain users using the Kerberos protocol. This behavior could + represent an adversary performing a Password Spraying attack against an Active Directory + environment using Kerberos to obtain initial access or elevate privileges. As attackers + progress in a breach, mistakes will be made. In certain scenarios, adversaries may + execute a password spraying attack against disabled users. Event 4768 is generated + every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket + (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account + disabled, expired or locked out).\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ + + This detection will only trigger on domain controllers, not on member servers or + workstations.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source ip and attempted user accounts.' +search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 + | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) + as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as + comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple disabled domain + users is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners, multi-user systems missconfigured + systems. +references: +- https://attack.mitre.org/techniques/T1110/003/ +tags: + analytic_story: + - Active Directory Password Spraying + - Active Directory Kerberos Attacks + automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential Kerberos based password spraying attack from $Client_Address$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: Client_Address + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Result_Code + - Account_Name + - Client_Address + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml new file mode 100644 index 0000000000..8b05e3f278 --- /dev/null +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml @@ -0,0 +1,80 @@ +name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos +id: f122cb2e-d773-4f11-8399-62a3572d8dd7 +version: 1 +date: '2022-09-22' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: 'The following analytic identifies one source endpoint failing to authenticate + with multiple invalid domain users using the Kerberos protocol. This behavior could + represent an adversary performing a Password Spraying attack against an Active Directory + environment using Kerberos to obtain initial access or elevate privileges. As attackers + progress in a breach, mistakes will be made. In certain scenarios, adversaries may + execute a password spraying attack using an invalid list of users. Event 4768 is + generated every time the Key Distribution Center issues a Kerberos Ticket Granting + Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` + (the attempted user is not a valid domain user).\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ + + This detection will only trigger on domain controllers, not on member servers or + workstations.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source ip and attempted user accounts.' +search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" + | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) + as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as + comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple invalid domain + users is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners, multi-user systems and missconfigured + systems. +references: +- https://attack.mitre.org/techniques/T1110/003/ +tags: + analytic_story: + - Active Directory Password Spraying + - Active Directory Kerberos Attacks + automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential Kerberos based password spraying attack from $Client_Address$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: Client_Address + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Result_Code + - Account_Name + - Client_Address + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml new file mode 100644 index 0000000000..fdd53fc4dd --- /dev/null +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml @@ -0,0 +1,82 @@ +name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM +id: 15603165-147d-4a6e-9778-bd0ff39e668f +version: 1 +date: '2022-09-22' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: 'The following analytic identifies one source endpoint failing to authenticate + with multiple invalid users using the NTLM protocol. This behavior could represent + an adversary performing a Password Spraying attack against an Active Directory environment + using NTLM to obtain initial access or elevate privileges. As attackers progress + in a breach, mistakes will be made. In certain scenarios, adversaries may execute + a password spraying attack using an invalid list of users. Event 4776 is generated + on the computer that is authoritative for the provided credentials. For domain accounts, + the domain controller is authoritative. For local accounts, the local computer is + authoritative. Error code 0xC0000064 stands for `The username you typed does not + exist` (the attempted user is a legitimate domain user).\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ + + This detection will only trigger on domain controllers, not on member servers or + workstations.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source workstation name and attempted user accounts.' +search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure + | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) + as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `windows_multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller events. The Advanced Security Audit policy setting `Audit Credential + Validation' within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple invalid domain + users is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners and missconfigured systems. + If this detection triggers on a host other than a Domain Controller, the behavior + could represent a password spraying attack against the host's local accounts. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 +tags: + analytic_story: + - Active Directory Password Spraying + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential NTLM based password spraying attack from $Source_Workstation$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: Source_Workstation + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - action + - Logon_Account + - Source_Workstation + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml new file mode 100644 index 0000000000..88d02656db --- /dev/null +++ b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml @@ -0,0 +1,84 @@ +name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials +id: 14f414cf-3080-4b9b-aaf6-55a4ce947b93 +version: 1 +date: '2022-09-22' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: 'The following analytic identifies a source user failing to authenticate + with multiple users using explicit credentials on a host. This behavior could represent + an adversary performing a Password Spraying attack against an Active Directory environment + to obtain initial access or elevate privileges. Event 4648 is generated when a process + attempts an account logon by explicitly specifying that accounts credentials. This + event generates on domain controllers, member servers, and workstations.\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ + + This detection will trigger on the potenfially malicious host, perhaps controlled + via a trojan or operated by an insider threat, from where a password spraying attack + is being executed.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source account, attempted user accounts and the endpoint were + the behavior was identified.' +search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account + = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) + | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" + | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as + tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers as well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: A source user failing attempting to authenticate multiple users + on a host is not a common behavior for regular systems. Some applications, however, + may exhibit this behavior in which case sets of users hosts can be added to an allow + list. Possible false positive scenarios include systems where several users connect + to like Mail servers, identity providers, remote desktop services, Citrix, etc. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events +tags: + analytic_story: + - Active Directory Password Spraying + - Insider Threat + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential password spraying attack from $ComputerName$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Security_ID + - Account_Name + - ComputerName + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml new file mode 100644 index 0000000000..74a7c86c14 --- /dev/null +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml @@ -0,0 +1,80 @@ +name: Windows Unusual Count Of Users Failed To Auth Using Kerberos +id: bc9cb715-08ba-40c3-9758-6e2b26e455cb +version: 1 +date: '2022-09-22' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: 'The following analytic identifies one source endpoint failing to authenticate + with multiple valid users using the Kerberos protocol. This behavior could represent + an adversary performing a Password Spraying attack against an Active Directory environment + using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated + when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket + (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user + is a legitimate domain user).\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ + + This detection will only trigger on domain controllers, not on member servers or + workstations.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source ip and attempted user accounts.' +search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" + | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) + as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as + comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple valid domain users + is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners, missconfigured systems and + multi-user systems like Citrix farms. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319109(v=ws.11) +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771 +tags: + analytic_story: + - Active Directory Password Spraying + - Active Directory Kerberos Attacks + automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential Kerberos based password spraying attack from $Client_Address$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: Client_Address + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Result_Code + - Account_Name + - Client_Address + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml new file mode 100644 index 0000000000..2e85c0dfb6 --- /dev/null +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml @@ -0,0 +1,85 @@ +name: Windows Unusual Count Of Users Failed To Authenticate From Process +id: 25bdb6cb-2e49-4d34-a93c-d6c567c122fe +version: 1 +date: '2022-09-22' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: 'The following analytic identifies a source process name failing to authenticate + with multiple users. This behavior could represent an adversary performing a Password + Spraying attack against an Active Directory environment to obtain initial access + or elevate privileges. Event 4625 generates on domain controllers, member servers, + and workstations when an account fails to logon. Logon Type 2 describes an iteractive + logon attempt.\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ + + This detection will trigger on the potenfially malicious host, perhaps controlled + via a trojan or operated by an insider threat, from where a password spraying attack + is being executed. This could be a domain controller as well as a member server + or workstation.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source process name, source account and attempted user accounts.' +search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-" + | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account + = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name) + as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName | + eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std + by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers aas well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: A process failing to authenticate with multiple users is not + a common behavior for legitimate user sessions. Possible false positive scenarios + include but are not limited to vulnerability scanners and missconfigured systems. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 +- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events +tags: + analytic_story: + - Active Directory Password Spraying + - Insider Threat + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential password spraying attack from $ComputerName$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Logon_Type + - Caller_Process_Name + - Security_ID + - Account_Name + - ComputerName + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml new file mode 100644 index 0000000000..3e49a28f17 --- /dev/null +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml @@ -0,0 +1,80 @@ +name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM +id: 6f6c8fd7-6a6b-4af9-a0e9-57cfc47a58b4 +version: 1 +date: '2022-09-22' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: 'The following analytic identifies one source endpoint failing to authenticate + with multiple valid users using the NTLM protocol. This behavior could represent + an adversary performing a Password Spraying attack against an Active Directory environment + using NTLM to obtain initial access or elevate privileges. Event 4776 is generated + on the computer that is authoritative for the provided credentials. For domain accounts, + the domain controller is authoritative. For local accounts, the local computer is + authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted + user is a legitimate domain user).\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ + + This detection will only trigger on domain controllers, not on member servers or + workstations.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source workstation name and attempted user accounts.' +search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure + | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) + as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller events. The Advanced Security Audit policy setting `Audit Credential + Validation` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple valid domain users + is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners and missconfigured systems. + If this detection triggers on a host other than a Domain Controller, the behavior + could represent a password spraying attack against the host's local accounts. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 +tags: + analytic_story: + - Active Directory Password Spraying + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential NTLM based password spraying attack from $Source_Workstation$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: Source_Workstation + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - action + - Logon_Account + - Source_Workstation + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml new file mode 100644 index 0000000000..6917673182 --- /dev/null +++ b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml @@ -0,0 +1,83 @@ +name: Windows Unusual Count Of Users Remotely Failed To Auth From Host +id: cf06a0ee-ffa9-4ed3-be77-0670ed9bab52 +version: 1 +date: '2022-09-22' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: 'The following analytic identifies a source host failing to authenticate + against a remote host with multiple users. This behavior could represent an adversary + performing a Password Spraying attack against an Active Directory environment to + obtain initial access or elevate privileges. Event 4625 documents each and every + failed attempt to logon to the local computer. This event generates on domain controllers, + member servers, and workstations. Logon Type 3 describes an remote authentication + attempt.\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ + + This detection will trigger on the host that is the target of the password spraying + attack. This could be a domain controller as well as a member server or workstation.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source process name, source account and attempted user accounts.' +search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" + | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats + dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts + by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 + and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers as as well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: A host failing to authenticate with multiple valid users against + a remote host is not a common behavior for legitimate systems. Possible false positive + scenarios include but are not limited to vulnerability scanners, remote administration + tools, missconfigyred systems, etc. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 +- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events +tags: + analytic_story: + - Active Directory Password Spraying + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential password spraying attack on $ComputerName$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Logon_Type + - Security_ID + - Account_Name + - ComputerName + - Source_Network_Address + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint diff --git a/tests/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.test.yml b/tests/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.test.yml new file mode 100644 index 0000000000..9656d3e7f6 --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos Unit Test +tests: +- name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos + file: endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/tests/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.test.yml b/tests/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.test.yml new file mode 100644 index 0000000000..89a0f0b218 --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos Unit Test +tests: +- name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos + file: endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.test.yml b/tests/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.test.yml new file mode 100644 index 0000000000..5db70d5d8c --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM Unit Test +tests: +- name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM + file: endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.test.yml b/tests/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.test.yml new file mode 100644 index 0000000000..2a6d1e8e6d --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials Unit Test +tests: +- name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials + file: endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.test.yml b/tests/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.test.yml new file mode 100644 index 0000000000..2304d156ca --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Users Failed To Auth Using Kerberos Unit Test +tests: +- name: Windows Unusual Count Of Users Failed To Auth Using Kerberos + file: endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.test.yml b/tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.test.yml new file mode 100644 index 0000000000..1f1b323b19 --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Users Failed To Authenticate From Process Unit Test +tests: +- name: Windows Unusual Count Of Users Failed To Authenticate From Process + file: endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.test.yml b/tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.test.yml new file mode 100644 index 0000000000..a4d1624f0c --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM Unit Test +tests: +- name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM + file: endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.test.yml b/tests/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.test.yml new file mode 100644 index 0000000000..d0d84ce19f --- /dev/null +++ b/tests/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.test.yml @@ -0,0 +1,12 @@ +name: Windows Unusual Count Of Users Remotely Failed To Auth From Host Unit Test +tests: +- name: Windows Unusual Count Of Users Remotely Failed To Auth From Host + file: endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog From 56de63cff1279555ff32847ef9d8b59534d2b038 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 23 Sep 2022 11:46:17 -0400 Subject: [PATCH 05/16] updating macro --- macros/wineventlog_security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/wineventlog_security.yml b/macros/wineventlog_security.yml index 00d2e3d6b8..cfbe346e92 100644 --- a/macros/wineventlog_security.yml +++ b/macros/wineventlog_security.yml @@ -1,4 +1,4 @@ -definition: eventtype=wineventlog_security +definition: eventtype=wineventlog_security OR source="XmlWinEventLog:Security" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: wineventlog_security From 27dad59624906a3e8e6995488bc7aaa718eb6f01 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 23 Sep 2022 15:45:24 -0400 Subject: [PATCH 06/16] migrating detections to XML --- ...sers_failed_to_authenticate_w_kerberos.yml | 23 ++++++++------- ...rs_fail_to_authenticate_using_kerberos.yml | 23 ++++++++------- ...sers_failed_to_authenticate_using_ntlm.yml | 23 ++++++++------- ...o_authenticate_wth_explicitcredentials.yml | 23 +++++++-------- ...d_to_authenticate_from_host_using_ntlm.yml | 23 ++++++++------- ...rs_failed_to_authenticate_from_process.yml | 23 +++++++-------- ..._failed_to_authenticate_using_kerberos.yml | 23 ++++++++------- ...otely_failed_to_authenticate_from_host.yml | 19 ++++++------- ...d_users_failed_to_authe_using_kerberos.yml | 24 ++++++++-------- ...alid_users_fail_to_auth_using_kerberos.yml | 24 ++++++++-------- ...nvalid_users_failed_to_auth_using_ntlm.yml | 22 ++++++++------- ...s_fail_to_auth_wth_explicitcredentials.yml | 26 ++++++++--------- ...of_users_failed_to_auth_using_kerberos.yml | 24 ++++++++-------- ...rs_failed_to_authenticate_from_process.yml | 28 +++++++++---------- ...sers_failed_to_authenticate_using_ntlm.yml | 24 ++++++++-------- ...sers_remotely_failed_to_auth_from_host.yml | 28 +++++++++---------- 16 files changed, 188 insertions(+), 192 deletions(-) diff --git a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml index 4cbf981c85..98ee9e880f 100644 --- a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml +++ b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml @@ -22,12 +22,11 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` ' +search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | where unique_accounts > 30 + | `windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -52,15 +51,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -68,9 +67,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml index 872842890f..a6135f6d0d 100644 --- a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml +++ b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml @@ -23,12 +23,11 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` ' +search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | where unique_accounts > 30 + | `windows_multiple_invalid_users_fail_to_authenticate_using_kerberos_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -53,15 +52,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -69,9 +68,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml index 4ef8dc5bd9..560aa11bf0 100644 --- a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml @@ -24,12 +24,11 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure - | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) - as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`' +search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation + | where unique_accounts > 30 + | `windows_multiple_invalid_users_failed_to_authenticate_using_ntlm_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. @@ -55,15 +54,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential NTLM based password spraying attack from $Source_Workstation$ + message: Potential NTLM based password spraying attack from $Workstation$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Source_Workstation + - name: Workstation type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -71,9 +70,9 @@ tags: required_fields: - _time - EventCode - - action - - Logon_Account - - Source_Workstation + - TargetUserName + - Workstation + - Status risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml index 2d08404dff..d3b6758dd4 100644 --- a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml +++ b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml @@ -22,14 +22,11 @@ description: 'The following analytic identifies a source user failing to authent The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.' -search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account - = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) - | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" - | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as - tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` ' +search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$ + | bucket span=5m _time + | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as tried_account by _time, Computer, Caller_User_Name + | where unique_accounts > 30 + | `windows_multiple_users_fail_to_authenticate_wth_explicitcredentials_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -57,12 +54,12 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack from $ComputerName$ + message: Potential password spraying attack from $Computer$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - Victim @@ -73,9 +70,9 @@ tags: required_fields: - _time - EventCode - - Security_ID - - Account_Name - - ComputerName + - Target_User_Name + - Caller_User_Name + - Computer risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml index afcaaaf69e..e01ff2279a 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml @@ -22,12 +22,11 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure - | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) - as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter`' +search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation + | where unique_accounts > 30 + | `windows_multiple_users_failed_to_authenticate_from_host_using_ntlm_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled. @@ -53,15 +52,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential NTLM based password spraying attack from $Source_Workstation$ + message: Potential NTLM based password spraying attack from $Workstation$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Source_Workstation + - name: Workstation type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -69,9 +68,9 @@ tags: required_fields: - _time - EventCode - - action - - Logon_Account - - Source_Workstation + - Status + - TargetUserName + - Workstation risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml index 0a88aee126..3e8d59cb2e 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml @@ -22,14 +22,11 @@ description: 'The following analytic identifies a source process name failing to The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-" - | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account - = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName | - eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std - by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` ' +search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-" + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, ProcessName, SubjectUserName, Computer + | where unique_accounts > 30 + | `windows_multiple_users_failed_to_authenticate_from_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -56,7 +53,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack from $ComputerName$ + message: Potential password spraying attack from $Computer$ mitre_attack_id: - T1110.003 - T1110 @@ -73,10 +70,10 @@ tags: - _time - EventCode - Logon_Type - - Caller_Process_Name - - Security_ID - - Account_Name - - ComputerName + - ProcessName + - SubjectUserName + - TargetUserName + - Computer risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml index 7ddcb0e365..9a155c03dd 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml @@ -21,12 +21,11 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`' +search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | where unique_accounts > 30 + | `windows_multiple_users_failed_to_authenticate_using_kerberos_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -53,15 +52,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -69,9 +68,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml index 7a3307ce62..32c66a3180 100644 --- a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml +++ b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml @@ -21,13 +21,11 @@ description: 'The following analytic identifies a source host failing to authent The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" - | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats - dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts - by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName - | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 - and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` ' +search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-" + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer + | where unique_accounts > 30 + | `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -71,10 +69,9 @@ tags: - _time - EventCode - Logon_Type - - Security_ID - - Account_Name - - ComputerName - - Source_Network_Address + - TargetUserName + - Computer + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml index f98fdbdc96..f8362b4938 100644 --- a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml @@ -26,12 +26,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) +search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12 + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` ' + | search isOutlier=1 + | `windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -56,15 +58,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -72,9 +74,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml index 8b05e3f278..8c9df0b4dd 100644 --- a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml @@ -26,12 +26,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) +search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6 + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` ' + | search isOutlier=1 + | `windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -56,15 +58,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -72,9 +74,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml index fdd53fc4dd..7da39eaf34 100644 --- a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml @@ -27,12 +27,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure - | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) - as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) +search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064 + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`' + | search isOutlier=1 + | `windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. @@ -63,10 +65,10 @@ tags: - T1110.003 - T1110 observable: - - name: Source_Workstation + - name: Workstation type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -74,9 +76,9 @@ tags: required_fields: - _time - EventCode - - action - - Logon_Account - - Source_Workstation + - TargetUserName + - Workstation + - Status risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml index 88d02656db..a9c5fb5870 100644 --- a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml +++ b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml @@ -25,14 +25,14 @@ description: 'The following analytic identifies a source user failing to authent The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.' -search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account - = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) - | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" - | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as - tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) +search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$ + | bucket span=2m _time + | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as tried_account by _time, Computer, Caller_User_Name + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Computer + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` ' + | search isOutlier=1 + | `windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -60,15 +60,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack from $ComputerName$ + message: Potential password spraying attack from $Computer$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -76,9 +76,9 @@ tags: required_fields: - _time - EventCode - - Security_ID - - Account_Name - - ComputerName + - Target_User_Name + - Caller_User_Name + - Computer risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml index 74a7c86c14..9dc129d004 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml @@ -24,12 +24,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) +search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18 + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`' + | search isOutlier=1 + | `windows_unusual_count_of_users_failed_to_auth_using_kerberos_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -56,15 +58,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -72,9 +74,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml index 2e85c0dfb6..6c0734ccca 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml @@ -25,14 +25,14 @@ description: 'The following analytic identifies a source process name failing to The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-" - | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account - = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName | - eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std - by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3) +search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-" + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, ProcessName, SubjectUserName, Computer + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ProcessName, SubjectUserName, Computer + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` ' + | search isOutlier=1 + | `windows_unusual_count_of_users_failed_to_authenticate_from_process_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -59,15 +59,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack from $ComputerName$ + message: Potential password spraying attack from $Computer$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -76,10 +76,10 @@ tags: - _time - EventCode - Logon_Type - - Caller_Process_Name - - Security_ID - - Account_Name - - ComputerName + - ProcessName + - SubjectUserName + - TargetUserName + - Computer risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml index 3e49a28f17..acf144f72f 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml @@ -25,12 +25,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure - | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) - as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) +search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter`' + | search isOutlier=1 + | `windows_unusual_count_of_users_failed_to_authenticate_using_ntlm_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled. @@ -56,15 +58,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential NTLM based password spraying attack from $Source_Workstation$ + message: Potential NTLM based password spraying attack from $Workstation$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Source_Workstation + - name: Workstation type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -72,9 +74,9 @@ tags: required_fields: - _time - EventCode - - action - - Logon_Account - - Source_Workstation + - Status + - TargetUserName + - Workstation risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml index 6917673182..ed6b3d32e2 100644 --- a/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml +++ b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml @@ -24,13 +24,14 @@ description: 'The following analytic identifies a source host failing to authent The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" - | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats - dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts - by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName - | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 - and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` ' +search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-" + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress, Computer + | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 + | `windows_unusual_count_of_users_remotely_failed_to_auth_from_host_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -57,15 +58,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack on $ComputerName$ + message: Potential password spraying attack on $Computer$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -74,10 +75,9 @@ tags: - _time - EventCode - Logon_Type - - Security_ID - - Account_Name - - ComputerName - - Source_Network_Address + - TargetUserName + - Computer + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint From b3a8f13023b2b0f3b5d9375f29703a656a56cbd0 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 26 Sep 2022 11:03:27 -0400 Subject: [PATCH 07/16] update description --- stories/active_directory_password_spraying.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/stories/active_directory_password_spraying.yml b/stories/active_directory_password_spraying.yml index c9f20df254..4f6eb46b6d 100644 --- a/stories/active_directory_password_spraying.yml +++ b/stories/active_directory_password_spraying.yml @@ -1,6 +1,6 @@ name: Active Directory Password Spraying id: 3de109da-97d2-11eb-8b6a-acde48001122 -version: 1 +version: 2 date: '2021-04-07' author: Mauricio Velazco, Splunk description: Monitor for activities and techniques associated with Password Spraying @@ -23,9 +23,9 @@ narrative: 'In a password spraying attack, adversaries leverage one or a small l Specifically, this Analytic Story is focused on detecting possible Password Spraying attacks against Active Directory environments leveraging Windows Event Logs in the `Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents - 9 detection analytics which can aid defenders in identifying instances where one + 16 detection analytics which can aid defenders in identifying instances where one source user, source host or source process attempts to authenticate against a target - or targets using a high, unsual, number of unique users. A user, host or process + or targets using a high or statiscally unsual, number of unique users. A user, host or process attempting to authenticate with multiple users is not common behavior for legitimate systems and should be monitored by security teams. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, From dc80d8ea364e07aa7318a48acc80a54645f07cc5 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Feb 2023 16:25:24 -0800 Subject: [PATCH 08/16] Fixed up some incorrect paths in test and detection files. --- ...t_of_disabled_users_failed_to_auth_using_kerberos.yml} | 0 ...bled_users_failed_to_authenticate_w_kerberos.test.yml} | 8 ++++---- 2 files changed, 4 insertions(+), 4 deletions(-) rename detections/endpoint/{windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml => windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml} (100%) rename tests/endpoint/{windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml => windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml} (76%) diff --git a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml similarity index 100% rename from detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml rename to detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml diff --git a/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml b/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml similarity index 76% rename from tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml rename to tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml index 791a19829a..493bf7a4f7 100644 --- a/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml +++ b/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml @@ -1,7 +1,7 @@ -name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos Unit Test +name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos Unit Test tests: -- name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos - file: endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml +- name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos + file: endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now @@ -9,4 +9,4 @@ tests: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog From a871d51dfdd42945d107c018c7eee98badbbf397 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Feb 2023 17:24:25 -0800 Subject: [PATCH 09/16] Added the path TA to fix issues with the windows TA to S3. Added it to the baseline JSON and PY files. --- .../modules/validate_args.py | 17 +++++++++++++---- .../test_config_github_actions.json | 14 ++++++++++++-- 2 files changed, 25 insertions(+), 6 deletions(-) diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index 051c2cc3ea..e3ac66f3bd 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -74,7 +74,11 @@ setup_schema = { "default": { # The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template - + "Splunk Add-on for CrowdStrike FDR": { + "app_number": 5579, + "app_version": "1.2.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_120.tgz" + }, "ADD_ON_FOR_LINUX_SYSMON": { "app_number": 6176, "app_version": "1.0.4", @@ -140,6 +144,11 @@ setup_schema = { "app_version": "8.1.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz" }, + "SPLUNK_TA_FIX_WINDOWS":{ + "app_number": None, + "app_version": None, + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz" + }, "SPLUNK_COMMON_INFORMATION_MODEL": { "app_number": 1621, "app_version": "5.0.1", @@ -162,8 +171,8 @@ setup_schema = { }, "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { "app_number": 3110, - "app_version": "4.5.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz" + "app_version": "4.5.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz" }, "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": { "app_number": 3088, @@ -367,4 +376,4 @@ def validate(configuration: dict, skip_password_accessibility_check: bool = True except Exception as e: print("There was an error validation the configuration: [%s]" % ( str(e)), file=sys.stderr) - return None, setup_schema \ No newline at end of file + return None, setup_schema diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 2001714718..47d2043d41 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -1,5 +1,10 @@ { "apps": { + "Splunk Add-on for CrowdStrike FDR": { + "app_number": 5579, + "app_version": "1.2.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_120.tgz" + }, "ADD_ON_FOR_LINUX_SYSMON": { "app_number": 6176, "app_version": "1.0.4", @@ -60,6 +65,11 @@ "app_version": "8.1.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz" }, + "SPLUNK_TA_FIX_WINDOWS":{ + "app_number": null, + "app_version": null, + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz" + }, "SPLUNK_COMMON_INFORMATION_MODEL": { "app_number": 1621, "app_version": "5.0.1", @@ -97,8 +107,8 @@ }, "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { "app_number": 3110, - "app_version": "4.5.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz" + "app_version": "4.5.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz" }, "SPLUNK_TA_FOR_IIS": { "app_number": 3185, From eec8c7ff7fb57809cc878bde08ed57907443ee36 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Feb 2023 17:26:31 -0800 Subject: [PATCH 10/16] Fixing improperly named filter macro --- ...al_count_of_disabled_users_failed_to_auth_using_kerberos.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml index f8362b4938..a086f632f5 100644 --- a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml @@ -33,7 +33,7 @@ search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12 | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 - | `windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos_filter` ' + | `windows_unusual_count_of_disabled_users_failed_auth_using_kerberos_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. From 8e59ac984f60c02d4f669108653d9659f3628624 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Feb 2023 17:34:15 -0800 Subject: [PATCH 11/16] Fixing app number and version for Windows Fix App. --- bin/docker_detection_tester/modules/validate_args.py | 4 ++-- bin/docker_detection_tester/test_config_github_actions.json | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index e3ac66f3bd..759c31244f 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -145,8 +145,8 @@ setup_schema = { "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz" }, "SPLUNK_TA_FIX_WINDOWS":{ - "app_number": None, - "app_version": None, + "app_number": 9999, + "app_version": "1.0.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz" }, "SPLUNK_COMMON_INFORMATION_MODEL": { diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 47d2043d41..49a7687ab0 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -66,8 +66,8 @@ "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz" }, "SPLUNK_TA_FIX_WINDOWS":{ - "app_number": null, - "app_version": null, + "app_number": 9999, + "app_version": "1.0.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz" }, "SPLUNK_COMMON_INFORMATION_MODEL": { From 6c6e63feac6d5689a5b39dbadcdb3df8958dcb03 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 22 Feb 2023 11:54:54 -0500 Subject: [PATCH 12/16] fixing bucket time in detections --- ...al_count_of_disabled_users_failed_to_auth_using_kerberos.yml | 2 +- ...usual_count_of_invalid_users_fail_to_auth_using_kerberos.yml | 2 +- ...sual_count_of_users_fail_to_auth_wth_explicitcredentials.yml | 2 +- ...ows_unusual_count_of_users_failed_to_auth_using_kerberos.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml index a086f632f5..12f58d2fab 100644 --- a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml @@ -27,7 +27,7 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12 - | bucket span=2m _time + | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress | eval upperBound=(comp_avg+comp_std*3) diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml index 8c9df0b4dd..190cc92973 100644 --- a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml @@ -27,7 +27,7 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6 - | bucket span=2m _time + | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress | eval upperBound=(comp_avg+comp_std*3) diff --git a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml index a9c5fb5870..e2a699b7ce 100644 --- a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml +++ b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml @@ -26,7 +26,7 @@ description: 'The following analytic identifies a source user failing to authent providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.' search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$ - | bucket span=2m _time + | bucket span=5m _time | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as tried_account by _time, Computer, Caller_User_Name | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Computer | eval upperBound=(comp_avg+comp_std*3) diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml index 9dc129d004..5f913bd39c 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml @@ -25,7 +25,7 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18 - | bucket span=2m _time + | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress | eval upperBound=(comp_avg+comp_std*3) From 18017128bffaf5cd15541082e357df626844fd07 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 1 Mar 2023 23:56:41 +0000 Subject: [PATCH 13/16] Bump pydantic from 1.10.4 to 1.10.5 Bumps [pydantic](https://github.com/pydantic/pydantic) from 1.10.4 to 1.10.5. - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/v1.10.5/HISTORY.md) - [Commits](https://github.com/pydantic/pydantic/compare/v1.10.4...v1.10.5) --- updated-dependencies: - dependency-name: pydantic dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index a6c97c7065..2bb7c51a20 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,7 +6,7 @@ jsonschema==4.17.3 mock==4.0.3 psutil==5.9.4 pycvesearch==1.2 -pydantic==1.10.4 +pydantic==1.10.5 pytest==7.2.1 PyYAML==5.4.1 questionary==1.10.0 From a79e4b8f88d47cf4ae6a8fd2cb87e48dc460df20 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 1 Mar 2023 23:56:48 +0000 Subject: [PATCH 14/16] Bump gitpython from 3.1.30 to 3.1.31 Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.30 to 3.1.31. - [Release notes](https://github.com/gitpython-developers/GitPython/releases) - [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES) - [Commits](https://github.com/gitpython-developers/GitPython/compare/3.1.30...3.1.31) --- updated-dependencies: - dependency-name: gitpython dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index a6c97c7065..d442100602 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,6 +1,6 @@ attackcti==0.3.8 docker==6.0.0 -GitPython==3.1.30 +GitPython==3.1.31 Jinja2==3.1.2 jsonschema==4.17.3 mock==4.0.3 From 0ae7ff4b85470d2803c729ba52130f1b3b9c870e Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 3 Mar 2023 11:41:45 -0800 Subject: [PATCH 15/16] adding missing file --- ...users_failing_to_authenticate_kerberos.yml | 80 +++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml diff --git a/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml b/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml new file mode 100644 index 0000000000..f1ad97497f --- /dev/null +++ b/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml @@ -0,0 +1,80 @@ +name: Windows Disabled Users Failing To Authenticate Kerberos +id: 98f22d82-9d62-11eb-9fcf-acde48001122 +version: 1 +date: '2021-04-14' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: 'The following analytic identifies one source endpoint failing to authenticate + with multiple disabled domain users using the Kerberos protocol. This behavior could + represent an adversary performing a Password Spraying attack against an Active Directory + environment using Kerberos to obtain initial access or elevate privileges. As attackers + progress in a breach, mistakes will be made. In certain scenarios, adversaries may + execute a password spraying attack against disabled users. Event 4768 is generated + every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket + (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account + disabled, expired or locked out).\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ + + This detection will only trigger on domain controllers, not on member servers or + workstations.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source ip and attempted user accounts.' +search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 + | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) + as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as + comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple disabled domain + users is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners, multi-user systems missconfigured + systems. +references: +- https://attack.mitre.org/techniques/T1110/003/ +tags: + analytic_story: + - Active Directory Password Spraying + - Active Directory Kerberos Attacks + automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential Kerberos based password spraying attack from $Client_Address$ + mitre_attack_id: + - T1110.003 + - T1110 + observable: + - name: Client_Address + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Result_Code + - Account_Name + - Client_Address + risk_score: 49 + security_domain: endpoint + asset_type: Endpoint \ No newline at end of file From b075c902a1962f19327f0c5efbecf9c2f8da1df1 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 3 Mar 2023 11:49:27 -0800 Subject: [PATCH 16/16] remove old classic detectionn --- ...users_failing_to_authenticate_kerberos.yml | 80 ------------------- ..._failing_to_authenticate_kerberos.test.yml | 12 --- 2 files changed, 92 deletions(-) delete mode 100644 detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml delete mode 100644 tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml diff --git a/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml b/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml deleted file mode 100644 index f1ad97497f..0000000000 --- a/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Windows Disabled Users Failing To Authenticate Kerberos -id: 98f22d82-9d62-11eb-9fcf-acde48001122 -version: 1 -date: '2021-04-14' -author: Mauricio Velazco, Splunk -type: Anomaly -datamodel: [] -description: 'The following analytic identifies one source endpoint failing to authenticate - with multiple disabled domain users using the Kerberos protocol. This behavior could - represent an adversary performing a Password Spraying attack against an Active Directory - environment using Kerberos to obtain initial access or elevate privileges. As attackers - progress in a breach, mistakes will be made. In certain scenarios, adversaries may - execute a password spraying attack against disabled users. Event 4768 is generated - every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket - (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account - disabled, expired or locked out).\ - - The detection calculates the standard deviation for each host and leverages the - 3-sigma statistical rule to identify an unusual number of users. To customize this - analytic, users can try different combinations of the `bucket` span time and the - calculation of the `upperBound` field. This logic can be used for real time security - monitoring as well as threat hunting exercises.\ - - This detection will only trigger on domain controllers, not on member servers or - workstations.\ - - The analytics returned fields allow analysts to investigate the event further by - providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` ' -how_to_implement: To successfully implement this search, you need to be ingesting - Domain Controller and Kerberos events. The Advanced Security Audit policy setting - `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. -known_false_positives: A host failing to authenticate with multiple disabled domain - users is not a common behavior for legitimate systems. Possible false positive scenarios - include but are not limited to vulnerability scanners, multi-user systems missconfigured - systems. -references: -- https://attack.mitre.org/techniques/T1110/003/ -tags: - analytic_story: - - Active Directory Password Spraying - - Active Directory Kerberos Attacks - automated_detection_testing: passed - confidence: 70 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Privilege Escalation - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log - impact: 70 - kill_chain_phases: - - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ - mitre_attack_id: - - T1110.003 - - T1110 - observable: - - name: Client_Address - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventCode - - Result_Code - - Account_Name - - Client_Address - risk_score: 49 - security_domain: endpoint - asset_type: Endpoint \ No newline at end of file diff --git a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml b/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml deleted file mode 100644 index fa414309f7..0000000000 --- a/tests/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Windows Disabled Users Failing To Authenticate Kerberos Unit Test -tests: -- name: Windows Disabled Users Failing To Authenticate Kerberos - file: endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog