From d5c57aa8f5046dd30ed18c3af08e14613e6c0b17 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 17 Mar 2022 10:44:37 +0100 Subject: [PATCH 1/3] ssa_minor_fix --- .../endpoint/ssa___delete_a_net_user.yml | 23 ++++++++-------- ...fy_acls_permission_of_files_or_folders.yml | 26 ++++++++++--------- 2 files changed, 26 insertions(+), 23 deletions(-) diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml index 6f3ac84444..965efa0641 100644 --- a/detections/endpoint/ssa___delete_a_net_user.yml +++ b/detections/endpoint/ssa___delete_a_net_user.yml @@ -1,7 +1,7 @@ name: Delete A Net User id: 8776d79c-d26e-11eb-9a56-acde48001122 -version: 3 -date: '2021-11-30' +version: 4 +date: '2022-03-17' author: Teoderick Contreras, Splunk type: Anomaly datamodel: @@ -12,16 +12,17 @@ description: This analytic will detect a suspicious net.exe/net1.exe command-lin user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" - OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, +search: '| from read_ssa_enriched_events() + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + process=lower(ucast(map_get(input_event, "process"), "string", null)), + process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), + process_path=ucast(map_get(input_event, "process_path"), "string",null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where process IS NOT NULL AND like(process, "%/delete%") AND like(process, "%user%") AND (process_name="net1.exe" OR process_name="net.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + "string", null)), body=create_map(["event_id", event_id, "process", process, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 9e19df9ae9..1962ab1507 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -12,19 +12,21 @@ description: This analytic identifies suspicious modification of ACL permission is commonly configured by the file or directory owner with appropriate permission. This behavior raises suspicion if this command is seen on an endpoint utilized by an account with no permission to do so. -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, - /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" - OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, - end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), +search: '| from read_ssa_enriched_events() + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + process=ucast(map_get(input_event, "process"), "string", null), + process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where process IS NOT NULL AND like(process, "%/g%") + | where (match_regex(process, /(?i)everyone:/)=true OR match_regex(process, /(?i)SYSTEM:/)=true OR match_regex(process, /(?i)S-1-1-0:/)=true) + | where (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, - "parent_process_name", parent_process_name, "process_path", process_path]) | into - write_ssa_detected_events();' + body=create_map(["event_id", event_id, "process", process, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From 990307c54d8b4af4d0cdc1fb329e4af86c980217 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 17 Mar 2022 10:54:25 +0100 Subject: [PATCH 2/3] Update ssa___modify_acls_permission_of_files_or_folders.yml --- .../ssa___modify_acls_permission_of_files_or_folders.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 1962ab1507..4787eecd18 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -1,7 +1,7 @@ name: Modify ACLs Permission Of Files Or Folders id: 9ae9a48a-cdbe-11eb-875a-acde48001122 -version: 2 -date: '2021-11-30' +version: 3 +date: '2022-03-17' author: Teoderick Contreras, Splunk type: Anomaly datamodel: From ad1ef7b61ec473c41ed659a793763ec71e7a4f46 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 17 Mar 2022 15:55:32 +0100 Subject: [PATCH 3/3] ssa_minor_fix --- .../ssa___modify_acls_permission_of_files_or_folders.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 4787eecd18..6cce7a7e5c 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where process IS NOT NULL AND like(process, "%/g%") + | where process IS NOT NULL AND NOT like(process, "%:\\Windows\\QG\\ServiceNow%") AND like(process, "%/g%") | where (match_regex(process, /(?i)everyone:/)=true OR match_regex(process, /(?i)SYSTEM:/)=true OR match_regex(process, /(?i)S-1-1-0:/)=true) | where (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),