admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into improved_kerberoasting_attack

Browse Source
This commit is contained in:
Jose Enrique Hernandez
2020-10-19 17:29:03 -04:00
committed by GitHub
parent 85146bd2b8 38aecd9114
commit ca119d7cb5
28 changed files with 827 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
automated_detection_testing/requirements.txt
+22 -22
View File
@@ -1,20 +1,20 @@
ansible==2.9.2
ansible==2.10.1
ansible-runner==1.4.6
apipkg==1.5
aspy.yaml==1.3.0
atomicwrites==1.4.0
attackcti==0.3.3
attrs==19.3.0
bcrypt==3.1.7
boto3==1.15.17
botocore==1.18.17
bcrypt==3.2.0
boto3==1.16.0
botocore==1.19.0
certifi==2019.11.28
cffi==1.13.2
cffi==1.14.3
cfgv==2.0.1
chardet==3.0.4
configparser==4.0.2
contextlib2==0.6.0.post1
cryptography==2.8
cryptography==3.1.1
Deprecated==1.2.10
dnspython==2.0.0
docutils==0.16
@@ -25,32 +25,32 @@ identify==1.4.10
idna==2.8
importlib-metadata==1.3.0
Jinja2==2.10.3
jmespath==0.9.4
jmespath==0.10.0
lockfile==0.12.2
MarkupSafe==1.1.1
mock==3.0.5
mock==4.0.2
more-itertools==8.0.2
mysql-connector-python==8.0.19
mysql-connector-python==8.0.22
nodeenv==1.3.4
ntlm-auth==1.4.0
packaging==19.2
ntlm-auth==1.5.0
packaging==20.4
packer.py==0.3.0
paramiko==2.7.2
path==13.1.0
path==15.0.0
path.py==12.5.0
pexpect==4.7.0
pexpect==4.8.0
pluggy==0.13.1
pre-commit==1.21.0
protobuf==3.6.1
protobuf==3.13.0
psutil==5.7.2
ptyprocess==0.6.0
py==1.8.1
pycparser==2.19
PyGithub==1.51
py==1.9.0
pycparser==2.20
PyGithub==1.53
PyJWT==1.7.1
PyNaCl==1.4.0
pyparsing==2.4.6
pytest==5.3.2
pytest==6.1.1
python-daemon==2.2.4
python-dateutil==2.8.1
python-terraform==0.10.1
@@ -61,12 +61,12 @@ requests-ntlm==1.1.0
s3transfer==0.3.3
six==1.13.0
smmap==3.0.4
splunk-sdk==1.6.12
tabulate==0.8.6
splunk-sdk==1.6.14
tabulate==0.8.7
termcolor==1.1.0
toml==0.10.0
urllib3==1.25.7
virtualenv==16.7.9
urllib3==1.25.11
virtualenv==20.0.35
wcwidth==0.2.5
wget==3.2
wrapt==1.12.1
detections/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml
+23
View File
@@ -0,0 +1,23 @@
author: "Rod Soto, Splunk"
date: "2020-10-09"
description: "This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges at different projects depending on organization schema."
how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
id: 27af8c15-38b0-4408-b339-920170724adb
known_false_positives: "Accounts with high risk roles should be reduced to the minimum number needed, however specific tasks and setups may be simply expected behavior within organization"
name: GCP Detect accounts with high risk roles by project
references:
- https://github.com/dxa4481/gcploit
- https://www.youtube.com/watch?v=Ml09R38jpok
- https://cloud.google.com/iam/docs/understanding-roles
search: "`google_gcp_pubsub_message` data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project_filter`"
tags:
analytics_story:
- GCP Cross Account Activity
asset_type: "GCP Account"
kill_chain_phases:
- Lateral Movement
mitre_attack_id:
- T1078
security_domain: threat
type: ESCU
version: 1
detections/cloud/gcp_detect_gcploit_framework.yml
+22
View File
@@ -0,0 +1,22 @@
author: "Rod Soto, Splunk"
date: "2020-10-08"
description: "This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts."
how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
id: a1c5a85e-a162-410c-a5d9-99ff639e5a52
known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects"
name: GCP Detect gcploit framework
references:
- https://github.com/dxa4481/gcploit
- https://www.youtube.com/watch?v=Ml09R38jpok
search: "`google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework_filter`"
tags:
analytics_story:
- GCP Cross Account Activity
asset_type: "GCP Account"
kill_chain_phases:
- Lateral Movement
mitre_attack_id:
- T1078
security_domain: threat
type: ESCU
version: 1
detections/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml
+23
View File
@@ -0,0 +1,23 @@
author: "Rod Soto, Splunk"
date: "2020-10-09"
description: "This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts to move laterally and escalate privileges."
how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs"
id: 2e70ef35-2187-431f-aedc-4503dc9b06ba
known_false_positives: "High risk permissions are part of any GCP environment, however it is important to track resource and accounts usage, this search may produce false positives."
name: GCP Detect high risk permissions by resource and account
references:
- https://github.com/dxa4481/gcploit
- https://www.youtube.com/watch?v=Ml09R38jpok
- https://cloud.google.com/iam/docs/permissions-reference
search: "`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account_filter`"
tags:
analytics_story:
- GCP Cross Account Activity
asset_type: "GCP Account"
kill_chain_phases:
- Lateral Movement
mitre_attack_id:
- T1078
security_domain: threat
type: ESCU
version: 1
detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml
+9 -6
View File
@@ -17,12 +17,15 @@ search: '
dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
| where process_name="cmd.exe" OR process_name="reg.exe"
| where cmd_line LIKE "%save%" AND
(match_regex(cmd_line, /(?i)HKLM\\System/)=true OR
match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true
OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true
OR match_regex(cmd_line, /(?i)HKLM\\Security/)=true)
| where cmd_line != null AND
match_regex(cmd_line, /(?i)save\s+/)=true AND
( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR
match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR
match_regex(cmd_line, /(?i)HKLM\\System/)=true OR
match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR
match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR
match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true
)
| eval start_time = timestamp,
end_time = timestamp,
entities = mvappend(dest_device_id, dest_user_id),
detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml
+1 -1
View File
@@ -16,7 +16,7 @@ process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
process=lower(ucast(map_get(input_event, "process"), "string", null))
| where process_name LIKE "%rundll32.exe%"
AND match_regex(process, /(?i)comsvcs.dll MiniDump/)=true
AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
| eval start_time = timestamp,
end_time = timestamp,
entities = mvappend(machine),
detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml
+6 -4
View File
@@ -19,10 +19,11 @@ dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
| where parent_process!=null
| select parent_process, process_name, timestamp, dest_device_id, dest_user_id
| conditional_anomaly conditional="parent_process" target="process_name"
| rename output as input
| adaptive_threshold algorithm="quantile" entity="parent_process" value="input" window=604800000L
| where output AND quantile<0.1 AND (process_name="powershell.exe" OR
| adaptive_threshold algorithm="quantile" entity="parent_process" window=604800000L
| where label AND quantile<0.1 AND (process_name="powershell.exe" OR
process_name="regsvcs.exe" OR
process_name="ftp.exe" OR
process_name="dfsvc.exe" OR
@@ -103,8 +104,9 @@ end_time = timestamp,
entities = mvappend(dest_device_id, dest_user_id),
body = "TBD"
| into write_ssa_detected_events();'
known_false_positives: Some custom tools used by admins could be used rarely to launch remotely applications.
This might trigger false positives at the beginning when it hasn't collected yet enough data to construct the baseline.
known_false_positives: >
Some custom tools used by admins could be used rarely to launch remotely applications.
This might trigger false positives at the beginning when it hasn't collected yet enough data to construct the baseline.
tags:
mitre_technique_id:
- T1203
detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml
+3 -2
View File
@@ -90,8 +90,9 @@ timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
process_name=="msconfig.exe"
| stats count(process_name) as lolbas_counter by device,span(timestamp, 300s)
| eval lolbas_counter=lolbas_counter*1.0
| adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000
| where output AND quantile>0.5
| rename window_end as timestamp
| adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000L
| where label AND quantile>0.99
| eval start_time = timestamp,
end_time = timestamp,
entities = mvappend(device),
detections/endpoint/unusually_long_command_line___ssa.yml
+2 -2
View File
@@ -20,9 +20,9 @@ process_name=ucast(map_get(input_event, "process_name"), "string", null)
| eval cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"),
cmd_line_norm=replace(cmd_line_norm, /\w:\\[^\s]+/, "PATH"),
cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"),
input=parse_double(len(coalesce(cmd_line_norm, ""))),
input=parse_double(len(coalesce(cmd_line_norm, "")))
| adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
| where output="True" AND quantile>0.99
| where label AND quantile>0.99
| first_time_event cache_partitions=1 input_columns="dest_device_id,cmd_line"
| where first_time_dest_device_id_cmd_line
| eval start_time = timestamp,
notebooks/phishing_detection_unit_test.ipynb
+32 -30
View File
@@ -12,11 +12,11 @@
"execution_count": 1,
"metadata": {
"execution": {
"iopub.execute_input": "2020-10-15T07:17:42.569781Z",
"iopub.status.busy": "2020-10-15T07:17:42.569484Z",
"iopub.status.idle": "2020-10-15T07:17:43.335803Z",
"shell.execute_reply": "2020-10-15T07:17:43.335057Z",
"shell.execute_reply.started": "2020-10-15T07:17:42.569756Z"
"iopub.execute_input": "2020-10-16T22:23:22.484428Z",
"iopub.status.busy": "2020-10-16T22:23:22.484097Z",
"iopub.status.idle": "2020-10-16T22:23:23.007578Z",
"shell.execute_reply": "2020-10-16T22:23:23.006978Z",
"shell.execute_reply.started": "2020-10-16T22:23:22.484401Z"
}
},
"outputs": [],
@@ -31,7 +31,7 @@
"cell_type": "markdown",
"metadata": {},
"source": [
"## Extract first 5 records from the test dataset as unit test data"
"## Extract first 10 records from the test dataset as unit test data"
]
},
{
@@ -39,11 +39,11 @@
"execution_count": 2,
"metadata": {
"execution": {
"iopub.execute_input": "2020-10-15T07:17:43.337196Z",
"iopub.status.busy": "2020-10-15T07:17:43.336970Z",
"iopub.status.idle": "2020-10-15T07:17:44.064803Z",
"shell.execute_reply": "2020-10-15T07:17:44.063792Z",
"shell.execute_reply.started": "2020-10-15T07:17:43.337174Z"
"iopub.execute_input": "2020-10-16T22:23:35.177805Z",
"iopub.status.busy": "2020-10-16T22:23:35.177535Z",
"iopub.status.idle": "2020-10-16T22:23:35.800940Z",
"shell.execute_reply": "2020-10-16T22:23:35.800336Z",
"shell.execute_reply.started": "2020-10-16T22:23:35.177783Z"
}
},
"outputs": [
@@ -61,8 +61,10 @@
}
],
"source": [
"df = pd.read_json('s3://smle-experiments/datasets/phishing_email/splunk_test.json', lines=True)[0:5]\n",
"df.to_json('./unit_test.json', orient='records', lines=True)"
"df = pd.read_json('s3://smle-experiments/datasets/phishing_email/splunk_test.json', lines=True)[0:10]\n",
"t = [i for i in range(10)]\n",
"df['_time'] = t\n",
"df.to_json('./detect_phishing_content.json', orient='records', lines=True)"
]
},
{
@@ -77,18 +79,18 @@
"execution_count": 3,
"metadata": {
"execution": {
"iopub.execute_input": "2020-10-15T07:17:44.066646Z",
"iopub.status.busy": "2020-10-15T07:17:44.066415Z",
"iopub.status.idle": "2020-10-15T07:17:46.305894Z",
"shell.execute_reply": "2020-10-15T07:17:46.305280Z",
"shell.execute_reply.started": "2020-10-15T07:17:44.066619Z"
"iopub.execute_input": "2020-10-16T22:26:41.231248Z",
"iopub.status.busy": "2020-10-16T22:26:41.230973Z",
"iopub.status.idle": "2020-10-16T22:26:56.882252Z",
"shell.execute_reply": "2020-10-16T22:26:56.881749Z",
"shell.execute_reply.started": "2020-10-16T22:26:41.231226Z"
}
},
"outputs": [
{
"data": {
"application/vnd.jupyter.widget-view+json": {
"model_id": "bf31331e58194b6898384ea23b7271ae",
"model_id": "39a07cbd58e74860aa67307b52b6df3c",
"version_major": 2,
"version_minor": 0
},
@@ -141,12 +143,12 @@
" <tbody>\n",
" <tr>\n",
" <th>0</th>\n",
" <td>2002-03-14 14:34:48-08:00</td>\n",
" <td>4</td>\n",
" <td>True</td>\n",
" <td>TBD</td>\n",
" <td>Dear friend.I know that this letter may come t...</td>\n",
" <td>0.999971</td>\n",
" <td>2002-03-14 14:34:48-08:00</td>\n",
" <td>4</td>\n",
" <td>henry kabore &lt;henry_kabore_10@hotmail.fr&gt;</td>\n",
" <td>TBD</td>\n",
" <td>This is from Mr Henry Kabore</td>\n",
@@ -156,14 +158,14 @@
"</div>"
],
"text/plain": [
" start_time isPhishing entities \\\n",
"0 2002-03-14 14:34:48-08:00 True TBD \n",
" start_time isPhishing entities \\\n",
"0 4 True TBD \n",
"\n",
" Content probability \\\n",
"0 Dear friend.I know that this letter may come t... 0.999971 \n",
" Content probability end_time \\\n",
"0 Dear friend.I know that this letter may come t... 0.999971 4 \n",
"\n",
" end_time From body \\\n",
"0 2002-03-14 14:34:48-08:00 henry kabore <henry_kabore_10@hotmail.fr> TBD \n",
" From body \\\n",
"0 henry kabore <henry_kabore_10@hotmail.fr> TBD \n",
"\n",
" Subject \n",
"0 This is from Mr Henry Kabore "
@@ -182,7 +184,7 @@
{
"data": {
"text/plain": [
"<spl2_kernel.spl2_runner.SPL2Job at 0x7f33f0a85890>"
"<spl2_kernel.spl2_runner.SPL2Job at 0x7fc4f7e7c4d0>"
]
},
"execution_count": 3,
@@ -192,7 +194,7 @@
],
"source": [
"%%spl2\n",
"| from read_json(\"s3://smle-experiments/datasets/phishing_email/unit_test.json\")\n",
"| from read_json(\"s3://smle-experiments/datasets/phishing_email/detect_phishing_content.json\")\n",
"| eval eventLine=concat(From, \" \", Subject, \" \", Content, \" \", \" \")\n",
"| eval mapC = {\" \":32,\"!\":33,\"\\\"\":34,\"#\":35,\"$$\":36,\"%\":37,\"&\":38,\"'\":39,\"(\":40,\")\":41,\"*\":42,\"+\":43,\",\":44,\"-\":45,\".\":46,\"/\":47,\"0\":48,\"1\":49,\"2\":50,\"3\":51,\"4\":52,\"5\":53,\"6\":54,\"7\":55,\"8\":56,\"9\":57,\":\":58,\";\":59,\"<\":60,\"=\":61,\">\":62,\"?\":63,\"@\":64,\"A\":65,\"B\":66,\"C\":67,\"D\":68,\"E\":69,\"F\":70,\"G\":71,\"H\":72,\"I\":73,\"J\":74,\"K\":75,\"L\":76,\"M\":77,\"N\":78,\"O\":79,\"P\":80,\"Q\":81,\"R\":82,\"S\":83,\"T\":84,\"U\":85,\"V\":86,\"W\":87,\"X\":88,\"Y\":89,\"Z\":90,\"[\":91,\"\\\\\":92,\"]\":93,\"^\":94,\"_\":95,\"`\":96,\"a\":97,\"b\":98,\"c\":99,\"d\":100,\"e\":101,\"f\":102,\"g\":103,\"h\":104,\"i\":105,\"j\":106,\"k\":107,\"l\":108,\"m\":109,\"n\":110,\"o\":111,\"p\":112,\"q\":113,\"r\":114,\"s\":115,\"t\":116,\"u\":117,\"v\":118,\"w\":119,\"x\":120,\"y\":121,\"z\":122,\"{\":123,\"|\":124,\"}\":125,\"~\":126}\n",
"| eval 'embedding_input:0' = for_each(\n",
@@ -201,7 +203,7 @@
"| apply_model connection_id=\"\" path=\"s3://smle-experiments/models/xlin/phishing_email\" name=\"phishing_email_v7\" \n",
"| eval probability = mvindex('dense/Sigmoid:0', 0) \n",
"| where probability > 0.5\n",
"| eval start_time = Date, end_time = Date, entities = \"TBD\", body = \"TBD\"\n",
"| eval start_time = _time, end_time = _time, entities = \"TBD\", body = \"TBD\"\n",
"| select start_time, end_time, From, entities, body, Subject, Content, isPhishing, probability\n",
";"
]
notebooks/rare_parent_process_relationship_lolbas.ipynb
+330
View File
@@ -0,0 +1,330 @@
{
"cells": [
{
"cell_type": "markdown",
"metadata": {},
"source": [
"# Rare Parent/Child Process Relationship\n",
"\n",
"An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries\n",
"\n",
"https://github.com/splunk/security-content/blob/unit_test_prohibited_apps_spawning_cmdprompt/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml"
]
},
{
"cell_type": "code",
"execution_count": 22,
"metadata": {
"execution": {
"iopub.execute_input": "2020-10-15T21:50:56.862479Z",
"iopub.status.busy": "2020-10-15T21:50:56.862220Z",
"iopub.status.idle": "2020-10-15T21:51:06.101230Z",
"shell.execute_reply": "2020-10-15T21:51:06.100748Z",
"shell.execute_reply.started": "2020-10-15T21:50:56.862456Z"
}
},
"outputs": [
{
"data": {
"application/vnd.jupyter.widget-view+json": {
"model_id": "38a2bbfe856f4bf797b49f98bb92e6be",
"version_major": 2,
"version_minor": 0
},
"text/plain": [
"HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
]
},
"metadata": {},
"output_type": "display_data"
},
{
"name": "stdout",
"output_type": "stream",
"text": [
" Finished. "
]
},
{
"data": {
"text/html": [
"<div>\n",
"<style scoped>\n",
" .dataframe tbody tr th:only-of-type {\n",
" vertical-align: middle;\n",
" }\n",
"\n",
" .dataframe tbody tr th {\n",
" vertical-align: top;\n",
" }\n",
"\n",
" .dataframe thead th {\n",
" text-align: right;\n",
" }\n",
"</style>\n",
"<table border=\"1\" class=\"dataframe\">\n",
" <thead>\n",
" <tr style=\"text-align: right;\">\n",
" <th></th>\n",
" <th>input</th>\n",
" <th>start_time</th>\n",
" <th>dest_device_id</th>\n",
" <th>entities</th>\n",
" <th>process_name</th>\n",
" <th>quantile</th>\n",
" <th>end_time</th>\n",
" <th>label</th>\n",
" <th>parent_process</th>\n",
" <th>body</th>\n",
" <th>timestamp</th>\n",
" <th>dest_user_id</th>\n",
" </tr>\n",
" </thead>\n",
" <tbody>\n",
" <tr>\n",
" <th>0</th>\n",
" <td>7.666667</td>\n",
" <td>2020-09-24 17:00:13</td>\n",
" <td>5gUXDbXvVfgC/FEpZOFUaA==</td>\n",
" <td>[5gUXDbXvVfgC/FEpZOFUaA==]</td>\n",
" <td>powershell.exe</td>\n",
" <td>0.000000</td>\n",
" <td>2020-09-24 17:00:13</td>\n",
" <td>True</td>\n",
" <td>c:\\windows\\system32\\cmd.exe</td>\n",
" <td>TBD</td>\n",
" <td>2020-09-24 17:00:13</td>\n",
" <td>NaN</td>\n",
" </tr>\n",
" <tr>\n",
" <th>1</th>\n",
" <td>1.164725</td>\n",
" <td>2020-09-24 17:15:12</td>\n",
" <td>5gUXDbXvVfgC/FEpZOFUaA==</td>\n",
" <td>[5gUXDbXvVfgC/FEpZOFUaA==]</td>\n",
" <td>cmd.exe</td>\n",
" <td>0.082919</td>\n",
" <td>2020-09-24 17:15:12</td>\n",
" <td>True</td>\n",
" <td>c:\\program files\\splunkforwarderforsplunkinc\\b...</td>\n",
" <td>TBD</td>\n",
" <td>2020-09-24 17:15:12</td>\n",
" <td>NaN</td>\n",
" </tr>\n",
" <tr>\n",
" <th>2</th>\n",
" <td>1.164228</td>\n",
" <td>2020-09-24 17:17:12</td>\n",
" <td>5gUXDbXvVfgC/FEpZOFUaA==</td>\n",
" <td>[5gUXDbXvVfgC/FEpZOFUaA==]</td>\n",
" <td>cmd.exe</td>\n",
" <td>0.081037</td>\n",
" <td>2020-09-24 17:17:12</td>\n",
" <td>True</td>\n",
" <td>c:\\program files\\splunkforwarderforsplunkinc\\b...</td>\n",
" <td>TBD</td>\n",
" <td>2020-09-24 17:17:12</td>\n",
" <td>NaN</td>\n",
" </tr>\n",
" <tr>\n",
" <th>3</th>\n",
" <td>1.161742</td>\n",
" <td>2020-09-24 17:18:04</td>\n",
" <td>IaNYgFTNQvyVmJNuPr58dQ==</td>\n",
" <td>[IaNYgFTNQvyVmJNuPr58dQ==]</td>\n",
" <td>cmd.exe</td>\n",
" <td>0.083721</td>\n",
" <td>2020-09-24 17:18:04</td>\n",
" <td>True</td>\n",
" <td>c:\\program files\\splunkforwarderforsplunkinc\\b...</td>\n",
" <td>TBD</td>\n",
" <td>2020-09-24 17:18:04</td>\n",
" <td>NaN</td>\n",
" </tr>\n",
" <tr>\n",
" <th>4</th>\n",
" <td>1.158295</td>\n",
" <td>2020-09-24 17:18:12</td>\n",
" <td>5gUXDbXvVfgC/FEpZOFUaA==</td>\n",
" <td>[5gUXDbXvVfgC/FEpZOFUaA==]</td>\n",
" <td>cmd.exe</td>\n",
" <td>0.057663</td>\n",
" <td>2020-09-24 17:18:12</td>\n",
" <td>True</td>\n",
" <td>c:\\program files\\splunkforwarderforsplunkinc\\b...</td>\n",
" <td>TBD</td>\n",
" <td>2020-09-24 17:18:12</td>\n",
" <td>NaN</td>\n",
" </tr>\n",
" <tr>\n",
" <th>...</th>\n",
" <td>...</td>\n",
" <td>...</td>\n",
" <td>...</td>\n",
" <td>...</td>\n",
" <td>...</td>\n",
" <td>...</td>\n",
" <td>...</td>\n",
" <td>...</td>\n",
" <td>...</td>\n",
" <td>...</td>\n",
" <td>...</td>\n",
" <td>...</td>\n",
" </tr>\n",
" <tr>\n",
" <th>1799</th>\n",
" <td>6.918486</td>\n",
" <td>2020-09-25 19:46:23</td>\n",
" <td>ZTQ/ltGlScpA4WGbfRJ0Xg==</td>\n",
" <td>[ZTQ/ltGlScpA4WGbfRJ0Xg==]</td>\n",
" <td>sc.exe</td>\n",
" <td>0.000843</td>\n",
" <td>2020-09-25 19:46:23</td>\n",
" <td>True</td>\n",
" <td>c:\\windows\\system32\\svchost.exe</td>\n",
" <td>TBD</td>\n",
" <td>2020-09-25 19:46:23</td>\n",
" <td>NaN</td>\n",
" </tr>\n",
" <tr>\n",
" <th>1800</th>\n",
" <td>8.567270</td>\n",
" <td>2020-09-25 16:49:46</td>\n",
" <td>lQ+9FBHxYQK/q8qXcrTE9A==</td>\n",
" <td>[lQ+9FBHxYQK/q8qXcrTE9A==]</td>\n",
" <td>sc.exe</td>\n",
" <td>0.000841</td>\n",
" <td>2020-09-25 16:49:46</td>\n",
" <td>True</td>\n",
" <td>c:\\windows\\system32\\svchost.exe</td>\n",
" <td>TBD</td>\n",
" <td>2020-09-25 16:49:46</td>\n",
" <td>NaN</td>\n",
" </tr>\n",
" <tr>\n",
" <th>1801</th>\n",
" <td>9.991479</td>\n",
" <td>2020-09-25 16:50:30</td>\n",
" <td>IaNYgFTNQvyVmJNuPr58dQ==</td>\n",
" <td>[IaNYgFTNQvyVmJNuPr58dQ==]</td>\n",
" <td>sc.exe</td>\n",
" <td>0.003361</td>\n",
" <td>2020-09-25 16:50:30</td>\n",
" <td>True</td>\n",
" <td>c:\\windows\\system32\\svchost.exe</td>\n",
" <td>TBD</td>\n",
" <td>2020-09-25 16:50:30</td>\n",
" <td>NaN</td>\n",
" </tr>\n",
" <tr>\n",
" <th>1802</th>\n",
" <td>5.403934</td>\n",
" <td>2020-09-26 05:00:40</td>\n",
" <td>OWUYaWKrJeuOY71+TXoqiw==</td>\n",
" <td>[OWUYaWKrJeuOY71+TXoqiw==]</td>\n",
" <td>cmd.exe</td>\n",
" <td>0.000000</td>\n",
" <td>2020-09-26 05:00:40</td>\n",
" <td>True</td>\n",
" <td>c:\\program files\\splunkuniversalforwarder\\bin\\...</td>\n",
" <td>TBD</td>\n",
" <td>2020-09-26 05:00:40</td>\n",
" <td>NaN</td>\n",
" </tr>\n",
" <tr>\n",
" <th>1803</th>\n",
" <td>0.035648</td>\n",
" <td>2020-09-26 05:06:18</td>\n",
" <td>OWUYaWKrJeuOY71+TXoqiw==</td>\n",
" <td>[OWUYaWKrJeuOY71+TXoqiw==, rXYtTmzIXq56PqQ+iNO...</td>\n",
" <td>cmd.exe</td>\n",
" <td>0.000000</td>\n",
" <td>2020-09-26 05:06:18</td>\n",
" <td>True</td>\n",
" <td>c:\\windows\\system32\\cmd.exe</td>\n",
" <td>TBD</td>\n",
" <td>2020-09-26 05:06:18</td>\n",
" <td>rXYtTmzIXq56PqQ+iNO/xw==</td>\n",
" </tr>\n",
" </tbody>\n",
"</table>\n",
"<p>1804 rows × 12 columns</p>\n",
"</div>"
],
"text/plain": [
" input ... dest_user_id\n",
"0 7.666667 ... NaN\n",
"1 1.164725 ... NaN\n",
"2 1.164228 ... NaN\n",
"3 1.161742 ... NaN\n",
"4 1.158295 ... NaN\n",
"... ... ... ...\n",
"1799 6.918486 ... NaN\n",
"1800 8.567270 ... NaN\n",
"1801 9.991479 ... NaN\n",
"1802 5.403934 ... NaN\n",
"1803 0.035648 ... rXYtTmzIXq56PqQ+iNO/xw==\n",
"\n",
"[1804 rows x 12 columns]"
]
},
"metadata": {},
"output_type": "display_data"
},
{
"name": "stdout",
"output_type": "stream",
"text": [
"\n"
]
},
{
"data": {
"text/plain": [
"<spl2_kernel.spl2_runner.SPL2Job at 0x7f787a8f4610>"
]
},
"execution_count": 22,
"metadata": {},
"output_type": "execute_result"
}
],
"source": [
"| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n",
"| select from_json_object(value) as input_event\n",
"| eval timestamp=ucast(map_get(input_event, \"_time\"), \"long\", null)\n",
"| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), \n",
"process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), \n",
"dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n",
"dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n",
"| where parent_process!=null \n",
"| select parent_process, process_name, timestamp, dest_device_id, dest_user_id \n",
"| conditional_anomaly conditional=\"parent_process\" target=\"process_name\" \n",
"| rename output as input \n",
"| adaptive_threshold algorithm=\"quantile\" entity=\"parent_process\" value=\"input\" window=604800000L \n",
"| where label AND quantile<0.1 AND (process_name=\"powershell.exe\" OR process_name=\"regsvcs.exe\" OR process_name=\"ftp.exe\" OR process_name=\"dfsvc.exe\" OR process_name=\"rasautou.exe\" OR process_name=\"schtasks.exe\" OR process_name=\"xwizard.exe\" OR process_name=\"findstr.exe\" OR process_name=\"esentutl.exe\" OR process_name=\"cscript.exe\" OR process_name=\"reg.exe\" OR process_name=\"csc.exe\" OR process_name=\"atbroker.exe\" OR process_name=\"print.exe\" OR process_name=\"pcwrun.exe\" OR process_name=\"vbc.exe\" OR process_name=\"rpcping.exe\" OR process_name=\"wsreset.exe\" OR process_name=\"ilasm.exe\" OR process_name=\"certutil.exe\" OR process_name=\"replace.exe\" OR process_name=\"mshta.exe\" OR process_name=\"bitsadmin.exe\" OR process_name=\"wscript.exe\" OR process_name=\"ieexec.exe\" OR process_name=\"cmd.exe\" OR process_name=\"microsoft.workflow.compiler.exe\" OR process_name=\"runscripthelper.exe\" OR process_name=\"makecab.exe\" OR process_name=\"forfiles.exe\" OR process_name=\"desktopimgdownldr.exe\" OR process_name=\"control.exe\" OR process_name=\"msbuild.exe\" OR process_name=\"register-cimprovider.exe\" OR process_name=\"tttracer.exe\" OR process_name=\"ie4uinit.exe\" OR process_name=\"sc.exe\" OR process_name=\"bash.exe\" OR process_name=\"hh.exe\" OR process_name=\"cmstp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"jsc.exe\" OR process_name=\"scriptrunner.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"extexport.exe\" OR process_name=\"msdt.exe\" OR process_name=\"diskshadow.exe\" OR process_name=\"extrac32.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"mavinject.exe\" OR process_name=\"regasm.exe\" OR process_name=\"gpscript.exe\" OR process_name=\"rundll32.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"regedit.exe\" OR process_name=\"msiexec.exe\" OR process_name=\"gfxdownloadwrapper.exe\" OR process_name=\"presentationhost.exe\" OR process_name=\"regini.exe\" OR process_name=\"wmic.exe\" OR process_name=\"runonce.exe\" OR process_name=\"syncappvpublishingserver.exe\" OR process_name=\"verclsid.exe\" OR process_name=\"psr.exe\" OR process_name=\"infdefaultinstall.exe\" OR process_name=\"explorer.exe\" OR process_name=\"expand.exe\" OR process_name=\"installutil.exe\" OR process_name=\"netsh.exe\" OR process_name=\"wab.exe\" OR process_name=\"dnscmd.exe\" OR process_name=\"at.exe\" OR process_name=\"pcalua.exe\" OR process_name=\"cmdkey.exe\" OR process_name=\"msconfig.exe\")\n",
"| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = \"TBD\";"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {},
"outputs": [],
"source": []
}
],
"metadata": {
"kernelspec": {
"display_name": "SPL2",
"language": "SPL",
"name": "spl2"
},
"language_info": {
"mimetype": "text/spl",
"name": "SPL"
}
},
"nbformat": 4,
"nbformat_minor": 4
}
notebooks/unusual_lolbas_in_short_period_of_time.ipynb
+268
View File
@@ -0,0 +1,268 @@
{
"cells": [
{
"cell_type": "markdown",
"metadata": {},
"source": [
"# More than usual number of LOLBAS applications in short time period\n",
"\n",
"Attacker activity may compromise executing several LOLBAS applications in conjunction to accomplish their objectives. We are looking for more than usual LOLBAS applications over a window of time, by building profiles per machine.\n"
]
},
{
"cell_type": "code",
"execution_count": 3,
"metadata": {
"execution": {
"iopub.execute_input": "2020-10-15T21:42:08.429572Z",
"iopub.status.busy": "2020-10-15T21:42:08.429312Z",
"iopub.status.idle": "2020-10-15T21:42:15.742444Z",
"shell.execute_reply": "2020-10-15T21:42:15.741830Z",
"shell.execute_reply.started": "2020-10-15T21:42:08.429549Z"
}
},
"outputs": [
{
"data": {
"application/vnd.jupyter.widget-view+json": {
"model_id": "c27fe9ebed854de3b9d45c5f643cbbdb",
"version_major": 2,
"version_minor": 0
},
"text/plain": [
"HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
]
},
"metadata": {},
"output_type": "display_data"
},
{
"name": "stdout",
"output_type": "stream",
"text": [
" Finished. "
]
},
{
"data": {
"text/html": [
"<div>\n",
"<style scoped>\n",
" .dataframe tbody tr th:only-of-type {\n",
" vertical-align: middle;\n",
" }\n",
"\n",
" .dataframe tbody tr th {\n",
" vertical-align: top;\n",
" }\n",
"\n",
" .dataframe thead th {\n",
" text-align: right;\n",
" }\n",
"</style>\n",
"<table border=\"1\" class=\"dataframe\">\n",
" <thead>\n",
" <tr style=\"text-align: right;\">\n",
" <th></th>\n",
" <th>start_time</th>\n",
" <th>window_trigger</th>\n",
" <th>entities</th>\n",
" <th>quantile</th>\n",
" <th>end_time</th>\n",
" <th>window_start</th>\n",
" <th>label</th>\n",
" <th>body</th>\n",
" <th>device</th>\n",
" <th>lolbas_counter</th>\n",
" <th>timestamp</th>\n",
" </tr>\n",
" </thead>\n",
" <tbody>\n",
" <tr>\n",
" <th>0</th>\n",
" <td>2020-09-24 17:10:00</td>\n",
" <td>1600967399999</td>\n",
" <td>[5gUXDbXvVfgC/FEpZOFUaA==]</td>\n",
" <td>1</td>\n",
" <td>2020-09-24 17:10:00</td>\n",
" <td>1600967100000</td>\n",
" <td>True</td>\n",
" <td>TBD</td>\n",
" <td>5gUXDbXvVfgC/FEpZOFUaA==</td>\n",
" <td>7</td>\n",
" <td>2020-09-24 17:10:00</td>\n",
" </tr>\n",
" <tr>\n",
" <th>1</th>\n",
" <td>2020-09-24 17:45:00</td>\n",
" <td>1600969499999</td>\n",
" <td>[5gUXDbXvVfgC/FEpZOFUaA==]</td>\n",
" <td>1</td>\n",
" <td>2020-09-24 17:45:00</td>\n",
" <td>1600969200000</td>\n",
" <td>True</td>\n",
" <td>TBD</td>\n",
" <td>5gUXDbXvVfgC/FEpZOFUaA==</td>\n",
" <td>9</td>\n",
" <td>2020-09-24 17:45:00</td>\n",
" </tr>\n",
" <tr>\n",
" <th>2</th>\n",
" <td>2020-09-24 17:55:00</td>\n",
" <td>1600970099999</td>\n",
" <td>[IaNYgFTNQvyVmJNuPr58dQ==]</td>\n",
" <td>1</td>\n",
" <td>2020-09-24 17:55:00</td>\n",
" <td>1600969800000</td>\n",
" <td>True</td>\n",
" <td>TBD</td>\n",
" <td>IaNYgFTNQvyVmJNuPr58dQ==</td>\n",
" <td>9</td>\n",
" <td>2020-09-24 17:55:00</td>\n",
" </tr>\n",
" <tr>\n",
" <th>3</th>\n",
" <td>2020-09-24 18:00:00</td>\n",
" <td>1600970399999</td>\n",
" <td>[lQ+9FBHxYQK/q8qXcrTE9A==]</td>\n",
" <td>1</td>\n",
" <td>2020-09-24 18:00:00</td>\n",
" <td>1600970100000</td>\n",
" <td>True</td>\n",
" <td>TBD</td>\n",
" <td>lQ+9FBHxYQK/q8qXcrTE9A==</td>\n",
" <td>9</td>\n",
" <td>2020-09-24 18:00:00</td>\n",
" </tr>\n",
" <tr>\n",
" <th>4</th>\n",
" <td>2020-09-24 22:20:00</td>\n",
" <td>1600985999999</td>\n",
" <td>[zMnUW93edd+Q+ovwebxbRw==]</td>\n",
" <td>1</td>\n",
" <td>2020-09-24 22:20:00</td>\n",
" <td>1600985700000</td>\n",
" <td>True</td>\n",
" <td>TBD</td>\n",
" <td>zMnUW93edd+Q+ovwebxbRw==</td>\n",
" <td>5</td>\n",
" <td>2020-09-24 22:20:00</td>\n",
" </tr>\n",
" <tr>\n",
" <th>5</th>\n",
" <td>2020-09-24 23:30:00</td>\n",
" <td>1600990199999</td>\n",
" <td>[ZTQ/ltGlScpA4WGbfRJ0Xg==]</td>\n",
" <td>1</td>\n",
" <td>2020-09-24 23:30:00</td>\n",
" <td>1600989900000</td>\n",
" <td>True</td>\n",
" <td>TBD</td>\n",
" <td>ZTQ/ltGlScpA4WGbfRJ0Xg==</td>\n",
" <td>5</td>\n",
" <td>2020-09-24 23:30:00</td>\n",
" </tr>\n",
" <tr>\n",
" <th>6</th>\n",
" <td>2020-09-25 14:25:00</td>\n",
" <td>1601043899999</td>\n",
" <td>[lQ+9FBHxYQK/q8qXcrTE9A==]</td>\n",
" <td>1</td>\n",
" <td>2020-09-25 14:25:00</td>\n",
" <td>1601043600000</td>\n",
" <td>True</td>\n",
" <td>TBD</td>\n",
" <td>lQ+9FBHxYQK/q8qXcrTE9A==</td>\n",
" <td>12</td>\n",
" <td>2020-09-25 14:25:00</td>\n",
" </tr>\n",
" <tr>\n",
" <th>7</th>\n",
" <td>2020-09-26 05:05:00</td>\n",
" <td>1601096699999</td>\n",
" <td>[OWUYaWKrJeuOY71+TXoqiw==]</td>\n",
" <td>1</td>\n",
" <td>2020-09-26 05:05:00</td>\n",
" <td>1601096400000</td>\n",
" <td>True</td>\n",
" <td>TBD</td>\n",
" <td>OWUYaWKrJeuOY71+TXoqiw==</td>\n",
" <td>38</td>\n",
" <td>2020-09-26 05:05:00</td>\n",
" </tr>\n",
" </tbody>\n",
"</table>\n",
"</div>"
],
"text/plain": [
" start_time window_trigger ... lolbas_counter timestamp\n",
"0 2020-09-24 17:10:00 1600967399999 ... 7 2020-09-24 17:10:00\n",
"1 2020-09-24 17:45:00 1600969499999 ... 9 2020-09-24 17:45:00\n",
"2 2020-09-24 17:55:00 1600970099999 ... 9 2020-09-24 17:55:00\n",
"3 2020-09-24 18:00:00 1600970399999 ... 9 2020-09-24 18:00:00\n",
"4 2020-09-24 22:20:00 1600985999999 ... 5 2020-09-24 22:20:00\n",
"5 2020-09-24 23:30:00 1600990199999 ... 5 2020-09-24 23:30:00\n",
"6 2020-09-25 14:25:00 1601043899999 ... 12 2020-09-25 14:25:00\n",
"7 2020-09-26 05:05:00 1601096699999 ... 38 2020-09-26 05:05:00\n",
"\n",
"[8 rows x 11 columns]"
]
},
"metadata": {},
"output_type": "display_data"
},
{
"name": "stdout",
"output_type": "stream",
"text": [
"\n"
]
},
{
"data": {
"text/plain": [
"<spl2_kernel.spl2_runner.SPL2Job at 0x7f82f515dc10>"
]
},
"execution_count": 3,
"metadata": {},
"output_type": "execute_result"
}
],
"source": [
"| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n",
"| select from_json_object(value) as input_event\n",
"| eval timestamp=ucast(map_get(input_event, \"_time\"), \"long\", null)\n",
" | eval device=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null),\n",
" process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null))\n",
" | where process_name==\"regsvcs.exe\" OR process_name==\"ftp.exe\" OR process_name==\"dfsvc.exe\" OR process_name==\"rasautou.exe\" OR process_name==\"schtasks.exe\" OR process_name==\"xwizard.exe\" OR process_name==\"findstr.exe\" OR process_name==\"esentutl.exe\" OR process_name==\"cscript.exe\" OR process_name==\"reg.exe\" OR process_name==\"csc.exe\" OR process_name==\"atbroker.exe\" OR process_name==\"print.exe\" OR process_name==\"pcwrun.exe\" OR process_name==\"vbc.exe\" OR process_name==\"rpcping.exe\" OR process_name==\"wsreset.exe\" OR process_name==\"ilasm.exe\" OR process_name==\"certutil.exe\" OR process_name==\"replace.exe\" OR process_name==\"mshta.exe\" OR process_name==\"bitsadmin.exe\" OR process_name==\"wscript.exe\" OR process_name==\"ieexec.exe\" OR process_name==\"cmd.exe\" OR process_name==\"microsoft.workflow.compiler.exe\" OR process_name==\"runscripthelper.exe\" OR process_name==\"makecab.exe\" OR process_name==\"forfiles.exe\" OR process_name==\"desktopimgdownldr.exe\" OR process_name==\"control.exe\" OR process_name==\"msbuild.exe\" OR process_name==\"register-cimprovider.exe\" OR process_name==\"tttracer.exe\" OR process_name==\"ie4uinit.exe\" OR process_name==\"sc.exe\" OR process_name==\"bash.exe\" OR process_name==\"hh.exe\" OR process_name==\"cmstp.exe\" OR process_name==\"mmc.exe\" OR process_name==\"jsc.exe\" OR process_name==\"scriptrunner.exe\" OR process_name==\"odbcconf.exe\" OR process_name==\"extexport.exe\" OR process_name==\"msdt.exe\" OR process_name==\"diskshadow.exe\" OR process_name==\"extrac32.exe\" OR process_name==\"eventvwr.exe\" OR process_name==\"mavinject.exe\" OR process_name==\"regasm.exe\" OR process_name==\"gpscript.exe\" OR process_name==\"rundll32.exe\" OR process_name==\"regsvr32.exe\" OR process_name==\"regedit.exe\" OR process_name==\"msiexec.exe\" OR process_name==\"gfxdownloadwrapper.exe\" OR process_name==\"presentationhost.exe\" OR process_name==\"regini.exe\" OR process_name==\"wmic.exe\" OR process_name==\"runonce.exe\" OR process_name==\"syncappvpublishingserver.exe\" OR process_name==\"verclsid.exe\" OR process_name==\"psr.exe\" OR process_name==\"infdefaultinstall.exe\" OR process_name==\"explorer.exe\" OR process_name==\"expand.exe\" OR process_name==\"installutil.exe\" OR process_name==\"netsh.exe\" OR process_name==\"wab.exe\" OR process_name==\"dnscmd.exe\" OR process_name==\"at.exe\" OR process_name==\"pcalua.exe\" OR process_name==\"cmdkey.exe\" OR process_name==\"msconfig.exe\" \n",
" | stats count(process_name) as lolbas_counter by device,span(timestamp, 300s) \n",
" | eval lolbas_counter=lolbas_counter*1.0\n",
" | rename window_end as timestamp\n",
" | adaptive_threshold algorithm=\"quantile\" value=\"lolbas_counter\" entity=\"device\" window=2419200000L\n",
" | where label AND quantile>0.99 \n",
" | eval start_time = timestamp, end_time = timestamp, entities = mvappend(device), body = \"TBD\";"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {},
"outputs": [],
"source": []
}
],
"metadata": {
"kernelspec": {
"display_name": "SPL2",
"language": "SPL",
"name": "spl2"
},
"language_info": {
"mimetype": "text/spl",
"name": "SPL"
}
},
"nbformat": 4,
"nbformat_minor": 4
}
requirements.txt
+2 -2
View File
@@ -37,6 +37,6 @@ stix2-patterns==1.3.1
taxii2-client==2.2.2
toml==0.10.1
typing==3.7.4.3
urllib3==1.25.10
virtualenv==20.0.33
urllib3==1.25.11
virtualenv==20.0.35
zipp==3.3.1
tests/application/.gitkeep
View File
tests/application/detect_phishing_content___ssa.test.yml
+10
View File
@@ -0,0 +1,10 @@
name: Phishing Email Detection by Machine Learning Method - SSA Unit Test
detections:
- name: Phishing Email Detection by Machine Learning Method
file: application/detect_phishing_content___ssa.yml
pass_condition: '| stats count | where count > 0'
description: Test phishing emails using NLP
attack_data:
- file_name: detect_phishing_content.json
data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/detect_phishing_content.json
tests/cloud/.gitkeep
View File
tests/endpoint/.gitkeep
View File
tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml
+10
View File
@@ -0,0 +1,10 @@
name: Attempted Credential Dump From Registry via Reg exe - SSA Unit test
detections:
- name: Attempted Credential Dump From Registry via Reg exe
file: endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml
pass_condition: '| stats count | where count > 0'
description: Test credential dumping detections
attack_data:
- file_name: windows-security_ssa.log
data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.002/windows-security_ssa.log
tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml
+10
View File
@@ -0,0 +1,10 @@
name: Detect Dump LSASS Memory using comsvcs - SSA Unit Test
detections:
- name: Detect Dump LSASS Memory using comsvcs
file: endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml
pass_condition: '| stats count | where count > 0'
description: Test credential dumping detections
attack_data:
- file_name: windows-security-events_ssa.log
data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-security-events_ssa.log
tests/unit_detect_prohibited_applications_spawning_cmd_exe.yml → tests/endpoint/detect_prohibited_applications_spawning_cmd_exe.test.yml
View File
tests/endpoint/first_time_seen_cmd_line___ssa.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: First time seen command line argument - SSA Unit Test
detections:
- name: First time seen command line argument
file: endpoint/first_time_seen_cmd_line___ssa.yml
pass_condition: '| stats count | where count > 0'
description: Test detection of first time seen command
attack_data:
- file_name: first_time_seen_commandline.json
data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/first_time_seen_commandline.json
tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Detect Prohibited Applications Spawning cmd exe - SSA
detections:
- name: Detect Prohibited Applications Spawning cmd exe
file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml
pass_condition: '| stats count | where count > 0'
description: Test prohibited apps spawning cmd.exe
attack_data:
- file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json
data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json
tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml
+10
View File
@@ -0,0 +1,10 @@
name: Rare Parent/Child Process Relationship - SSA Unit Test
detections:
- name: Access LSASS Memory for Dump Creation
file: endpoint/rare_parent_process_relationship_lolbas___ssa.yaml
pass_condition: '| stats count | where count > 0'
description: Test detection looking for LOLBAS processes spawned by other processes that are rarely seen together
attack_data:
- file_name: T1059.all.labeled.lolbas-test.json
data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json
tests/endpoint/system_process_running_unexpected_location___ssa.test.yml
+7
View File
@@ -0,0 +1,7 @@
name: System Process Running from Unexpected Location - SSA Unit Test
detections:
- name: System Process Running from Unexpected Location - SSA
file: endpoint/system_process_running_unexpected_location___ssa.yml
pass_condition: '| stats count | where count > 0'
description: Test process running from other locations
attack_data:
tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: More than usual number of LOLBAS applications in short time period - SSA Unit Test
detections:
- name: More than usual number of LOLBAS applications in short time period
file: endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml
pass_condition: '| stats count | where count > 0'
description: Test more than usual lolbas being executed in a short period of time
attack_data:
- file_name: T1059.all.labeled.lolbas-test.json
data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json
tests/endpoint/unusually_long_command_line___ssa.test.yml
+10
View File
@@ -0,0 +1,10 @@
name: Unusually Long Command Line - SSA Unit Test
detections:
- name: Unusually Long Command Line
file: endpoint/unusually_long_command_line___ssa.yml
pass_condition: '| stats count | where count > 0'
description: Test unusually long command lines
attack_data:
- file_name: unusual_commandline.json
data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_commandline.json
tests/network/.gitkeep
View File
tests/web/.gitkeep
View File