diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index ac99ead5f6..c51102865c 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -1,20 +1,20 @@ -ansible==2.9.2 +ansible==2.10.1 ansible-runner==1.4.6 apipkg==1.5 aspy.yaml==1.3.0 atomicwrites==1.4.0 attackcti==0.3.3 attrs==19.3.0 -bcrypt==3.1.7 -boto3==1.15.17 -botocore==1.18.17 +bcrypt==3.2.0 +boto3==1.16.0 +botocore==1.19.0 certifi==2019.11.28 -cffi==1.13.2 +cffi==1.14.3 cfgv==2.0.1 chardet==3.0.4 configparser==4.0.2 contextlib2==0.6.0.post1 -cryptography==2.8 +cryptography==3.1.1 Deprecated==1.2.10 dnspython==2.0.0 docutils==0.16 @@ -25,32 +25,32 @@ identify==1.4.10 idna==2.8 importlib-metadata==1.3.0 Jinja2==2.10.3 -jmespath==0.9.4 +jmespath==0.10.0 lockfile==0.12.2 MarkupSafe==1.1.1 -mock==3.0.5 +mock==4.0.2 more-itertools==8.0.2 -mysql-connector-python==8.0.19 +mysql-connector-python==8.0.22 nodeenv==1.3.4 -ntlm-auth==1.4.0 -packaging==19.2 +ntlm-auth==1.5.0 +packaging==20.4 packer.py==0.3.0 paramiko==2.7.2 -path==13.1.0 +path==15.0.0 path.py==12.5.0 -pexpect==4.7.0 +pexpect==4.8.0 pluggy==0.13.1 pre-commit==1.21.0 -protobuf==3.6.1 +protobuf==3.13.0 psutil==5.7.2 ptyprocess==0.6.0 -py==1.8.1 -pycparser==2.19 -PyGithub==1.51 +py==1.9.0 +pycparser==2.20 +PyGithub==1.53 PyJWT==1.7.1 PyNaCl==1.4.0 pyparsing==2.4.6 -pytest==5.3.2 +pytest==6.1.1 python-daemon==2.2.4 python-dateutil==2.8.1 python-terraform==0.10.1 @@ -61,12 +61,12 @@ requests-ntlm==1.1.0 s3transfer==0.3.3 six==1.13.0 smmap==3.0.4 -splunk-sdk==1.6.12 -tabulate==0.8.6 +splunk-sdk==1.6.14 +tabulate==0.8.7 termcolor==1.1.0 toml==0.10.0 -urllib3==1.25.7 -virtualenv==16.7.9 +urllib3==1.25.11 +virtualenv==20.0.35 wcwidth==0.2.5 wget==3.2 wrapt==1.12.1 diff --git a/detections/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml new file mode 100644 index 0000000000..2bf308813d --- /dev/null +++ b/detections/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml @@ -0,0 +1,23 @@ +author: "Rod Soto, Splunk" +date: "2020-10-09" +description: "This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges at different projects depending on organization schema." +how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" +id: 27af8c15-38b0-4408-b339-920170724adb +known_false_positives: "Accounts with high risk roles should be reduced to the minimum number needed, however specific tasks and setups may be simply expected behavior within organization" +name: GCP Detect accounts with high risk roles by project +references: + - https://github.com/dxa4481/gcploit + - https://www.youtube.com/watch?v=Ml09R38jpok + - https://cloud.google.com/iam/docs/understanding-roles +search: "`google_gcp_pubsub_message` data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project_filter`" +tags: + analytics_story: + - GCP Cross Account Activity + asset_type: "GCP Account" + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1078 + security_domain: threat +type: ESCU +version: 1 diff --git a/detections/cloud/gcp_detect_gcploit_framework.yml b/detections/cloud/gcp_detect_gcploit_framework.yml new file mode 100644 index 0000000000..d247bb8014 --- /dev/null +++ b/detections/cloud/gcp_detect_gcploit_framework.yml @@ -0,0 +1,22 @@ +author: "Rod Soto, Splunk" +date: "2020-10-08" +description: "This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts." +how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" +id: a1c5a85e-a162-410c-a5d9-99ff639e5a52 +known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects" +name: GCP Detect gcploit framework +references: + - https://github.com/dxa4481/gcploit + - https://www.youtube.com/watch?v=Ml09R38jpok +search: "`google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework_filter`" +tags: + analytics_story: + - GCP Cross Account Activity + asset_type: "GCP Account" + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1078 + security_domain: threat +type: ESCU +version: 1 diff --git a/detections/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml new file mode 100644 index 0000000000..8495c184eb --- /dev/null +++ b/detections/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml @@ -0,0 +1,23 @@ +author: "Rod Soto, Splunk" +date: "2020-10-09" +description: "This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts to move laterally and escalate privileges." +how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" +id: 2e70ef35-2187-431f-aedc-4503dc9b06ba +known_false_positives: "High risk permissions are part of any GCP environment, however it is important to track resource and accounts usage, this search may produce false positives." +name: GCP Detect high risk permissions by resource and account +references: + - https://github.com/dxa4481/gcploit + - https://www.youtube.com/watch?v=Ml09R38jpok + - https://cloud.google.com/iam/docs/permissions-reference +search: "`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account_filter`" +tags: + analytics_story: + - GCP Cross Account Activity + asset_type: "GCP Account" + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1078 + security_domain: threat +type: ESCU +version: 1 diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml index 98c7489a31..5debe42be2 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml @@ -17,12 +17,15 @@ search: ' dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) | where process_name="cmd.exe" OR process_name="reg.exe" -| where cmd_line LIKE "%save%" AND - (match_regex(cmd_line, /(?i)HKLM\\System/)=true OR - match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true - OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true - OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true - OR match_regex(cmd_line, /(?i)HKLM\\Security/)=true) +| where cmd_line != null AND + match_regex(cmd_line, /(?i)save\s+/)=true AND + ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR + match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR + match_regex(cmd_line, /(?i)HKLM\\System/)=true OR + match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR + match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR + match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true + ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), diff --git a/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml b/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml index bf7333ff06..2b4b9452f3 100644 --- a/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml +++ b/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml @@ -16,7 +16,7 @@ process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) | where process_name LIKE "%rundll32.exe%" -AND match_regex(process, /(?i)comsvcs.dll MiniDump/)=true +AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine), diff --git a/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml b/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml index 333d0e0938..a95eff594f 100644 --- a/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml +++ b/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml @@ -19,10 +19,11 @@ dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) | where parent_process!=null +| select parent_process, process_name, timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process" target="process_name" | rename output as input -| adaptive_threshold algorithm="quantile" entity="parent_process" value="input" window=604800000L -| where output AND quantile<0.1 AND (process_name="powershell.exe" OR +| adaptive_threshold algorithm="quantile" entity="parent_process" window=604800000L +| where label AND quantile<0.1 AND (process_name="powershell.exe" OR process_name="regsvcs.exe" OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR @@ -103,8 +104,9 @@ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" | into write_ssa_detected_events();' -known_false_positives: Some custom tools used by admins could be used rarely to launch remotely applications. -This might trigger false positives at the beginning when it hasn't collected yet enough data to construct the baseline. +known_false_positives: > + Some custom tools used by admins could be used rarely to launch remotely applications. + This might trigger false positives at the beginning when it hasn't collected yet enough data to construct the baseline. tags: mitre_technique_id: - T1203 diff --git a/detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml b/detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml index 02580c7112..e35871fde1 100644 --- a/detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml +++ b/detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml @@ -90,8 +90,9 @@ timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 -| adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000 -| where output AND quantile>0.5 +| rename window_end as timestamp +| adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000L +| where label AND quantile>0.99 | eval start_time = timestamp, end_time = timestamp, entities = mvappend(device), diff --git a/detections/endpoint/unusually_long_command_line___ssa.yml b/detections/endpoint/unusually_long_command_line___ssa.yml index 64c020e0af..c7d9aa8c46 100644 --- a/detections/endpoint/unusually_long_command_line___ssa.yml +++ b/detections/endpoint/unusually_long_command_line___ssa.yml @@ -20,9 +20,9 @@ process_name=ucast(map_get(input_event, "process_name"), "string", null) | eval cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), -input=parse_double(len(coalesce(cmd_line_norm, ""))), +input=parse_double(len(coalesce(cmd_line_norm, ""))) | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 -| where output="True" AND quantile>0.99 +| where label AND quantile>0.99 | first_time_event cache_partitions=1 input_columns="dest_device_id,cmd_line" | where first_time_dest_device_id_cmd_line | eval start_time = timestamp, diff --git a/notebooks/phishing_detection_unit_test.ipynb b/notebooks/phishing_detection_unit_test.ipynb index d4688dd83b..6f41cee946 100644 --- a/notebooks/phishing_detection_unit_test.ipynb +++ b/notebooks/phishing_detection_unit_test.ipynb @@ -12,11 +12,11 @@ "execution_count": 1, "metadata": { "execution": { - "iopub.execute_input": "2020-10-15T07:17:42.569781Z", - "iopub.status.busy": "2020-10-15T07:17:42.569484Z", - "iopub.status.idle": "2020-10-15T07:17:43.335803Z", - "shell.execute_reply": "2020-10-15T07:17:43.335057Z", - "shell.execute_reply.started": "2020-10-15T07:17:42.569756Z" + "iopub.execute_input": "2020-10-16T22:23:22.484428Z", + "iopub.status.busy": "2020-10-16T22:23:22.484097Z", + "iopub.status.idle": "2020-10-16T22:23:23.007578Z", + "shell.execute_reply": "2020-10-16T22:23:23.006978Z", + "shell.execute_reply.started": "2020-10-16T22:23:22.484401Z" } }, "outputs": [], @@ -31,7 +31,7 @@ "cell_type": "markdown", "metadata": {}, "source": [ - "## Extract first 5 records from the test dataset as unit test data" + "## Extract first 10 records from the test dataset as unit test data" ] }, { @@ -39,11 +39,11 @@ "execution_count": 2, "metadata": { "execution": { - "iopub.execute_input": "2020-10-15T07:17:43.337196Z", - "iopub.status.busy": "2020-10-15T07:17:43.336970Z", - "iopub.status.idle": "2020-10-15T07:17:44.064803Z", - "shell.execute_reply": "2020-10-15T07:17:44.063792Z", - "shell.execute_reply.started": "2020-10-15T07:17:43.337174Z" + "iopub.execute_input": "2020-10-16T22:23:35.177805Z", + "iopub.status.busy": "2020-10-16T22:23:35.177535Z", + "iopub.status.idle": "2020-10-16T22:23:35.800940Z", + "shell.execute_reply": "2020-10-16T22:23:35.800336Z", + "shell.execute_reply.started": "2020-10-16T22:23:35.177783Z" } }, "outputs": [ @@ -61,8 +61,10 @@ } ], "source": [ - "df = pd.read_json('s3://smle-experiments/datasets/phishing_email/splunk_test.json', lines=True)[0:5]\n", - "df.to_json('./unit_test.json', orient='records', lines=True)" + "df = pd.read_json('s3://smle-experiments/datasets/phishing_email/splunk_test.json', lines=True)[0:10]\n", + "t = [i for i in range(10)]\n", + "df['_time'] = t\n", + "df.to_json('./detect_phishing_content.json', orient='records', lines=True)" ] }, { @@ -77,18 +79,18 @@ "execution_count": 3, "metadata": { "execution": { - "iopub.execute_input": "2020-10-15T07:17:44.066646Z", - "iopub.status.busy": "2020-10-15T07:17:44.066415Z", - "iopub.status.idle": "2020-10-15T07:17:46.305894Z", - "shell.execute_reply": "2020-10-15T07:17:46.305280Z", - "shell.execute_reply.started": "2020-10-15T07:17:44.066619Z" + "iopub.execute_input": "2020-10-16T22:26:41.231248Z", + "iopub.status.busy": "2020-10-16T22:26:41.230973Z", + "iopub.status.idle": "2020-10-16T22:26:56.882252Z", + "shell.execute_reply": "2020-10-16T22:26:56.881749Z", + "shell.execute_reply.started": "2020-10-16T22:26:41.231226Z" } }, "outputs": [ { "data": { "application/vnd.jupyter.widget-view+json": { - "model_id": "bf31331e58194b6898384ea23b7271ae", + "model_id": "39a07cbd58e74860aa67307b52b6df3c", "version_major": 2, "version_minor": 0 }, @@ -141,12 +143,12 @@ " \n", " \n", " 0\n", - " 2002-03-14 14:34:48-08:00\n", + " 4\n", " True\n", " TBD\n", " Dear friend.I know that this letter may come t...\n", " 0.999971\n", - " 2002-03-14 14:34:48-08:00\n", + " 4\n", " henry kabore <henry_kabore_10@hotmail.fr>\n", " TBD\n", " This is from Mr Henry Kabore\n", @@ -156,14 +158,14 @@ "" ], "text/plain": [ - " start_time isPhishing entities \\\n", - "0 2002-03-14 14:34:48-08:00 True TBD \n", + " start_time isPhishing entities \\\n", + "0 4 True TBD \n", "\n", - " Content probability \\\n", - "0 Dear friend.I know that this letter may come t... 0.999971 \n", + " Content probability end_time \\\n", + "0 Dear friend.I know that this letter may come t... 0.999971 4 \n", "\n", - " end_time From body \\\n", - "0 2002-03-14 14:34:48-08:00 henry kabore TBD \n", + " From body \\\n", + "0 henry kabore TBD \n", "\n", " Subject \n", "0 This is from Mr Henry Kabore " @@ -182,7 +184,7 @@ { "data": { "text/plain": [ - "" + "" ] }, "execution_count": 3, @@ -192,7 +194,7 @@ ], "source": [ "%%spl2\n", - "| from read_json(\"s3://smle-experiments/datasets/phishing_email/unit_test.json\")\n", + "| from read_json(\"s3://smle-experiments/datasets/phishing_email/detect_phishing_content.json\")\n", "| eval eventLine=concat(From, \" \", Subject, \" \", Content, \" \", \" \")\n", "| eval mapC = {\" \":32,\"!\":33,\"\\\"\":34,\"#\":35,\"$$\":36,\"%\":37,\"&\":38,\"'\":39,\"(\":40,\")\":41,\"*\":42,\"+\":43,\",\":44,\"-\":45,\".\":46,\"/\":47,\"0\":48,\"1\":49,\"2\":50,\"3\":51,\"4\":52,\"5\":53,\"6\":54,\"7\":55,\"8\":56,\"9\":57,\":\":58,\";\":59,\"<\":60,\"=\":61,\">\":62,\"?\":63,\"@\":64,\"A\":65,\"B\":66,\"C\":67,\"D\":68,\"E\":69,\"F\":70,\"G\":71,\"H\":72,\"I\":73,\"J\":74,\"K\":75,\"L\":76,\"M\":77,\"N\":78,\"O\":79,\"P\":80,\"Q\":81,\"R\":82,\"S\":83,\"T\":84,\"U\":85,\"V\":86,\"W\":87,\"X\":88,\"Y\":89,\"Z\":90,\"[\":91,\"\\\\\":92,\"]\":93,\"^\":94,\"_\":95,\"`\":96,\"a\":97,\"b\":98,\"c\":99,\"d\":100,\"e\":101,\"f\":102,\"g\":103,\"h\":104,\"i\":105,\"j\":106,\"k\":107,\"l\":108,\"m\":109,\"n\":110,\"o\":111,\"p\":112,\"q\":113,\"r\":114,\"s\":115,\"t\":116,\"u\":117,\"v\":118,\"w\":119,\"x\":120,\"y\":121,\"z\":122,\"{\":123,\"|\":124,\"}\":125,\"~\":126}\n", "| eval 'embedding_input:0' = for_each(\n", @@ -201,7 +203,7 @@ "| apply_model connection_id=\"\" path=\"s3://smle-experiments/models/xlin/phishing_email\" name=\"phishing_email_v7\" \n", "| eval probability = mvindex('dense/Sigmoid:0', 0) \n", "| where probability > 0.5\n", - "| eval start_time = Date, end_time = Date, entities = \"TBD\", body = \"TBD\"\n", + "| eval start_time = _time, end_time = _time, entities = \"TBD\", body = \"TBD\"\n", "| select start_time, end_time, From, entities, body, Subject, Content, isPhishing, probability\n", ";" ] diff --git a/notebooks/rare_parent_process_relationship_lolbas.ipynb b/notebooks/rare_parent_process_relationship_lolbas.ipynb new file mode 100644 index 0000000000..57d099f502 --- /dev/null +++ b/notebooks/rare_parent_process_relationship_lolbas.ipynb @@ -0,0 +1,330 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# Rare Parent/Child Process Relationship\n", + "\n", + "An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries\n", + "\n", + "https://github.com/splunk/security-content/blob/unit_test_prohibited_apps_spawning_cmdprompt/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml" + ] + }, + { + "cell_type": "code", + "execution_count": 22, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T21:50:56.862479Z", + "iopub.status.busy": "2020-10-15T21:50:56.862220Z", + "iopub.status.idle": "2020-10-15T21:51:06.101230Z", + "shell.execute_reply": "2020-10-15T21:51:06.100748Z", + "shell.execute_reply.started": "2020-10-15T21:50:56.862456Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "38a2bbfe856f4bf797b49f98bb92e6be", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
inputstart_timedest_device_identitiesprocess_namequantileend_timelabelparent_processbodytimestampdest_user_id
07.6666672020-09-24 17:00:135gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]powershell.exe0.0000002020-09-24 17:00:13Truec:\\windows\\system32\\cmd.exeTBD2020-09-24 17:00:13NaN
11.1647252020-09-24 17:15:125gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.0829192020-09-24 17:15:12Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBD2020-09-24 17:15:12NaN
21.1642282020-09-24 17:17:125gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.0810372020-09-24 17:17:12Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBD2020-09-24 17:17:12NaN
31.1617422020-09-24 17:18:04IaNYgFTNQvyVmJNuPr58dQ==[IaNYgFTNQvyVmJNuPr58dQ==]cmd.exe0.0837212020-09-24 17:18:04Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBD2020-09-24 17:18:04NaN
41.1582952020-09-24 17:18:125gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.0576632020-09-24 17:18:12Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBD2020-09-24 17:18:12NaN
.......................................
17996.9184862020-09-25 19:46:23ZTQ/ltGlScpA4WGbfRJ0Xg==[ZTQ/ltGlScpA4WGbfRJ0Xg==]sc.exe0.0008432020-09-25 19:46:23Truec:\\windows\\system32\\svchost.exeTBD2020-09-25 19:46:23NaN
18008.5672702020-09-25 16:49:46lQ+9FBHxYQK/q8qXcrTE9A==[lQ+9FBHxYQK/q8qXcrTE9A==]sc.exe0.0008412020-09-25 16:49:46Truec:\\windows\\system32\\svchost.exeTBD2020-09-25 16:49:46NaN
18019.9914792020-09-25 16:50:30IaNYgFTNQvyVmJNuPr58dQ==[IaNYgFTNQvyVmJNuPr58dQ==]sc.exe0.0033612020-09-25 16:50:30Truec:\\windows\\system32\\svchost.exeTBD2020-09-25 16:50:30NaN
18025.4039342020-09-26 05:00:40OWUYaWKrJeuOY71+TXoqiw==[OWUYaWKrJeuOY71+TXoqiw==]cmd.exe0.0000002020-09-26 05:00:40Truec:\\program files\\splunkuniversalforwarder\\bin\\...TBD2020-09-26 05:00:40NaN
18030.0356482020-09-26 05:06:18OWUYaWKrJeuOY71+TXoqiw==[OWUYaWKrJeuOY71+TXoqiw==, rXYtTmzIXq56PqQ+iNO...cmd.exe0.0000002020-09-26 05:06:18Truec:\\windows\\system32\\cmd.exeTBD2020-09-26 05:06:18rXYtTmzIXq56PqQ+iNO/xw==
\n", + "

1804 rows × 12 columns

\n", + "
" + ], + "text/plain": [ + " input ... dest_user_id\n", + "0 7.666667 ... NaN\n", + "1 1.164725 ... NaN\n", + "2 1.164228 ... NaN\n", + "3 1.161742 ... NaN\n", + "4 1.158295 ... NaN\n", + "... ... ... ...\n", + "1799 6.918486 ... NaN\n", + "1800 8.567270 ... NaN\n", + "1801 9.991479 ... NaN\n", + "1802 5.403934 ... NaN\n", + "1803 0.035648 ... rXYtTmzIXq56PqQ+iNO/xw==\n", + "\n", + "[1804 rows x 12 columns]" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 22, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", + "| select from_json_object(value) as input_event\n", + "| eval timestamp=ucast(map_get(input_event, \"_time\"), \"long\", null)\n", + "| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), \n", + "process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), \n", + "dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", + "dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n", + "| where parent_process!=null \n", + "| select parent_process, process_name, timestamp, dest_device_id, dest_user_id \n", + "| conditional_anomaly conditional=\"parent_process\" target=\"process_name\" \n", + "| rename output as input \n", + "| adaptive_threshold algorithm=\"quantile\" entity=\"parent_process\" value=\"input\" window=604800000L \n", + "| where label AND quantile<0.1 AND (process_name=\"powershell.exe\" OR process_name=\"regsvcs.exe\" OR process_name=\"ftp.exe\" OR process_name=\"dfsvc.exe\" OR process_name=\"rasautou.exe\" OR process_name=\"schtasks.exe\" OR process_name=\"xwizard.exe\" OR process_name=\"findstr.exe\" OR process_name=\"esentutl.exe\" OR process_name=\"cscript.exe\" OR process_name=\"reg.exe\" OR process_name=\"csc.exe\" OR process_name=\"atbroker.exe\" OR process_name=\"print.exe\" OR process_name=\"pcwrun.exe\" OR process_name=\"vbc.exe\" OR process_name=\"rpcping.exe\" OR process_name=\"wsreset.exe\" OR process_name=\"ilasm.exe\" OR process_name=\"certutil.exe\" OR process_name=\"replace.exe\" OR process_name=\"mshta.exe\" OR process_name=\"bitsadmin.exe\" OR process_name=\"wscript.exe\" OR process_name=\"ieexec.exe\" OR process_name=\"cmd.exe\" OR process_name=\"microsoft.workflow.compiler.exe\" OR process_name=\"runscripthelper.exe\" OR process_name=\"makecab.exe\" OR process_name=\"forfiles.exe\" OR process_name=\"desktopimgdownldr.exe\" OR process_name=\"control.exe\" OR process_name=\"msbuild.exe\" OR process_name=\"register-cimprovider.exe\" OR process_name=\"tttracer.exe\" OR process_name=\"ie4uinit.exe\" OR process_name=\"sc.exe\" OR process_name=\"bash.exe\" OR process_name=\"hh.exe\" OR process_name=\"cmstp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"jsc.exe\" OR process_name=\"scriptrunner.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"extexport.exe\" OR process_name=\"msdt.exe\" OR process_name=\"diskshadow.exe\" OR process_name=\"extrac32.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"mavinject.exe\" OR process_name=\"regasm.exe\" OR process_name=\"gpscript.exe\" OR process_name=\"rundll32.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"regedit.exe\" OR process_name=\"msiexec.exe\" OR process_name=\"gfxdownloadwrapper.exe\" OR process_name=\"presentationhost.exe\" OR process_name=\"regini.exe\" OR process_name=\"wmic.exe\" OR process_name=\"runonce.exe\" OR process_name=\"syncappvpublishingserver.exe\" OR process_name=\"verclsid.exe\" OR process_name=\"psr.exe\" OR process_name=\"infdefaultinstall.exe\" OR process_name=\"explorer.exe\" OR process_name=\"expand.exe\" OR process_name=\"installutil.exe\" OR process_name=\"netsh.exe\" OR process_name=\"wab.exe\" OR process_name=\"dnscmd.exe\" OR process_name=\"at.exe\" OR process_name=\"pcalua.exe\" OR process_name=\"cmdkey.exe\" OR process_name=\"msconfig.exe\")\n", + "| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = \"TBD\";" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "SPL2", + "language": "SPL", + "name": "spl2" + }, + "language_info": { + "mimetype": "text/spl", + "name": "SPL" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +} diff --git a/notebooks/unusual_lolbas_in_short_period_of_time.ipynb b/notebooks/unusual_lolbas_in_short_period_of_time.ipynb new file mode 100644 index 0000000000..d277a654e0 --- /dev/null +++ b/notebooks/unusual_lolbas_in_short_period_of_time.ipynb @@ -0,0 +1,268 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# More than usual number of LOLBAS applications in short time period\n", + "\n", + "Attacker activity may compromise executing several LOLBAS applications in conjunction to accomplish their objectives. We are looking for more than usual LOLBAS applications over a window of time, by building profiles per machine.\n" + ] + }, + { + "cell_type": "code", + "execution_count": 3, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T21:42:08.429572Z", + "iopub.status.busy": "2020-10-15T21:42:08.429312Z", + "iopub.status.idle": "2020-10-15T21:42:15.742444Z", + "shell.execute_reply": "2020-10-15T21:42:15.741830Z", + "shell.execute_reply.started": "2020-10-15T21:42:08.429549Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "c27fe9ebed854de3b9d45c5f643cbbdb", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
start_timewindow_triggerentitiesquantileend_timewindow_startlabelbodydevicelolbas_countertimestamp
02020-09-24 17:10:001600967399999[5gUXDbXvVfgC/FEpZOFUaA==]12020-09-24 17:10:001600967100000TrueTBD5gUXDbXvVfgC/FEpZOFUaA==72020-09-24 17:10:00
12020-09-24 17:45:001600969499999[5gUXDbXvVfgC/FEpZOFUaA==]12020-09-24 17:45:001600969200000TrueTBD5gUXDbXvVfgC/FEpZOFUaA==92020-09-24 17:45:00
22020-09-24 17:55:001600970099999[IaNYgFTNQvyVmJNuPr58dQ==]12020-09-24 17:55:001600969800000TrueTBDIaNYgFTNQvyVmJNuPr58dQ==92020-09-24 17:55:00
32020-09-24 18:00:001600970399999[lQ+9FBHxYQK/q8qXcrTE9A==]12020-09-24 18:00:001600970100000TrueTBDlQ+9FBHxYQK/q8qXcrTE9A==92020-09-24 18:00:00
42020-09-24 22:20:001600985999999[zMnUW93edd+Q+ovwebxbRw==]12020-09-24 22:20:001600985700000TrueTBDzMnUW93edd+Q+ovwebxbRw==52020-09-24 22:20:00
52020-09-24 23:30:001600990199999[ZTQ/ltGlScpA4WGbfRJ0Xg==]12020-09-24 23:30:001600989900000TrueTBDZTQ/ltGlScpA4WGbfRJ0Xg==52020-09-24 23:30:00
62020-09-25 14:25:001601043899999[lQ+9FBHxYQK/q8qXcrTE9A==]12020-09-25 14:25:001601043600000TrueTBDlQ+9FBHxYQK/q8qXcrTE9A==122020-09-25 14:25:00
72020-09-26 05:05:001601096699999[OWUYaWKrJeuOY71+TXoqiw==]12020-09-26 05:05:001601096400000TrueTBDOWUYaWKrJeuOY71+TXoqiw==382020-09-26 05:05:00
\n", + "
" + ], + "text/plain": [ + " start_time window_trigger ... lolbas_counter timestamp\n", + "0 2020-09-24 17:10:00 1600967399999 ... 7 2020-09-24 17:10:00\n", + "1 2020-09-24 17:45:00 1600969499999 ... 9 2020-09-24 17:45:00\n", + "2 2020-09-24 17:55:00 1600970099999 ... 9 2020-09-24 17:55:00\n", + "3 2020-09-24 18:00:00 1600970399999 ... 9 2020-09-24 18:00:00\n", + "4 2020-09-24 22:20:00 1600985999999 ... 5 2020-09-24 22:20:00\n", + "5 2020-09-24 23:30:00 1600990199999 ... 5 2020-09-24 23:30:00\n", + "6 2020-09-25 14:25:00 1601043899999 ... 12 2020-09-25 14:25:00\n", + "7 2020-09-26 05:05:00 1601096699999 ... 38 2020-09-26 05:05:00\n", + "\n", + "[8 rows x 11 columns]" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 3, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", + "| select from_json_object(value) as input_event\n", + "| eval timestamp=ucast(map_get(input_event, \"_time\"), \"long\", null)\n", + " | eval device=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null),\n", + " process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null))\n", + " | where process_name==\"regsvcs.exe\" OR process_name==\"ftp.exe\" OR process_name==\"dfsvc.exe\" OR process_name==\"rasautou.exe\" OR process_name==\"schtasks.exe\" OR process_name==\"xwizard.exe\" OR process_name==\"findstr.exe\" OR process_name==\"esentutl.exe\" OR process_name==\"cscript.exe\" OR process_name==\"reg.exe\" OR process_name==\"csc.exe\" OR process_name==\"atbroker.exe\" OR process_name==\"print.exe\" OR process_name==\"pcwrun.exe\" OR process_name==\"vbc.exe\" OR process_name==\"rpcping.exe\" OR process_name==\"wsreset.exe\" OR process_name==\"ilasm.exe\" OR process_name==\"certutil.exe\" OR process_name==\"replace.exe\" OR process_name==\"mshta.exe\" OR process_name==\"bitsadmin.exe\" OR process_name==\"wscript.exe\" OR process_name==\"ieexec.exe\" OR process_name==\"cmd.exe\" OR process_name==\"microsoft.workflow.compiler.exe\" OR process_name==\"runscripthelper.exe\" OR process_name==\"makecab.exe\" OR process_name==\"forfiles.exe\" OR process_name==\"desktopimgdownldr.exe\" OR process_name==\"control.exe\" OR process_name==\"msbuild.exe\" OR process_name==\"register-cimprovider.exe\" OR process_name==\"tttracer.exe\" OR process_name==\"ie4uinit.exe\" OR process_name==\"sc.exe\" OR process_name==\"bash.exe\" OR process_name==\"hh.exe\" OR process_name==\"cmstp.exe\" OR process_name==\"mmc.exe\" OR process_name==\"jsc.exe\" OR process_name==\"scriptrunner.exe\" OR process_name==\"odbcconf.exe\" OR process_name==\"extexport.exe\" OR process_name==\"msdt.exe\" OR process_name==\"diskshadow.exe\" OR process_name==\"extrac32.exe\" OR process_name==\"eventvwr.exe\" OR process_name==\"mavinject.exe\" OR process_name==\"regasm.exe\" OR process_name==\"gpscript.exe\" OR process_name==\"rundll32.exe\" OR process_name==\"regsvr32.exe\" OR process_name==\"regedit.exe\" OR process_name==\"msiexec.exe\" OR process_name==\"gfxdownloadwrapper.exe\" OR process_name==\"presentationhost.exe\" OR process_name==\"regini.exe\" OR process_name==\"wmic.exe\" OR process_name==\"runonce.exe\" OR process_name==\"syncappvpublishingserver.exe\" OR process_name==\"verclsid.exe\" OR process_name==\"psr.exe\" OR process_name==\"infdefaultinstall.exe\" OR process_name==\"explorer.exe\" OR process_name==\"expand.exe\" OR process_name==\"installutil.exe\" OR process_name==\"netsh.exe\" OR process_name==\"wab.exe\" OR process_name==\"dnscmd.exe\" OR process_name==\"at.exe\" OR process_name==\"pcalua.exe\" OR process_name==\"cmdkey.exe\" OR process_name==\"msconfig.exe\" \n", + " | stats count(process_name) as lolbas_counter by device,span(timestamp, 300s) \n", + " | eval lolbas_counter=lolbas_counter*1.0\n", + " | rename window_end as timestamp\n", + " | adaptive_threshold algorithm=\"quantile\" value=\"lolbas_counter\" entity=\"device\" window=2419200000L\n", + " | where label AND quantile>0.99 \n", + " | eval start_time = timestamp, end_time = timestamp, entities = mvappend(device), body = \"TBD\";" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "SPL2", + "language": "SPL", + "name": "spl2" + }, + "language_info": { + "mimetype": "text/spl", + "name": "SPL" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +} diff --git a/requirements.txt b/requirements.txt index 9851e7f402..1e9791ee3b 100644 --- a/requirements.txt +++ b/requirements.txt @@ -37,6 +37,6 @@ stix2-patterns==1.3.1 taxii2-client==2.2.2 toml==0.10.1 typing==3.7.4.3 -urllib3==1.25.10 -virtualenv==20.0.33 +urllib3==1.25.11 +virtualenv==20.0.35 zipp==3.3.1 diff --git a/tests/application/.gitkeep b/tests/application/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/tests/application/detect_phishing_content___ssa.test.yml b/tests/application/detect_phishing_content___ssa.test.yml new file mode 100644 index 0000000000..511fa8a8b1 --- /dev/null +++ b/tests/application/detect_phishing_content___ssa.test.yml @@ -0,0 +1,10 @@ +name: Phishing Email Detection by Machine Learning Method - SSA Unit Test +detections: + - name: Phishing Email Detection by Machine Learning Method + file: application/detect_phishing_content___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test phishing emails using NLP +attack_data: + - file_name: detect_phishing_content.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/detect_phishing_content.json + diff --git a/tests/cloud/.gitkeep b/tests/cloud/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/tests/endpoint/.gitkeep b/tests/endpoint/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml b/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml new file mode 100644 index 0000000000..fce0718baf --- /dev/null +++ b/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml @@ -0,0 +1,10 @@ +name: Attempted Credential Dump From Registry via Reg exe - SSA Unit test +detections: + - name: Attempted Credential Dump From Registry via Reg exe + file: endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test credential dumping detections +attack_data: + - file_name: windows-security_ssa.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.002/windows-security_ssa.log + diff --git a/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml b/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml new file mode 100644 index 0000000000..95ddd4384f --- /dev/null +++ b/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml @@ -0,0 +1,10 @@ +name: Detect Dump LSASS Memory using comsvcs - SSA Unit Test +detections: + - name: Detect Dump LSASS Memory using comsvcs + file: endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test credential dumping detections +attack_data: + - file_name: windows-security-events_ssa.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-security-events_ssa.log + diff --git a/tests/unit_detect_prohibited_applications_spawning_cmd_exe.yml b/tests/endpoint/detect_prohibited_applications_spawning_cmd_exe.test.yml similarity index 100% rename from tests/unit_detect_prohibited_applications_spawning_cmd_exe.yml rename to tests/endpoint/detect_prohibited_applications_spawning_cmd_exe.test.yml diff --git a/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml b/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml new file mode 100644 index 0000000000..a190d5ae34 --- /dev/null +++ b/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml @@ -0,0 +1,9 @@ +name: First time seen command line argument - SSA Unit Test +detections: + - name: First time seen command line argument + file: endpoint/first_time_seen_cmd_line___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test detection of first time seen command +attack_data: + - file_name: first_time_seen_commandline.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/first_time_seen_commandline.json diff --git a/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml b/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml new file mode 100644 index 0000000000..42ef49eb05 --- /dev/null +++ b/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml @@ -0,0 +1,9 @@ +name: Detect Prohibited Applications Spawning cmd exe - SSA +detections: + - name: Detect Prohibited Applications Spawning cmd exe + file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test prohibited apps spawning cmd.exe +attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json diff --git a/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml b/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml new file mode 100644 index 0000000000..88fe455fc8 --- /dev/null +++ b/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml @@ -0,0 +1,10 @@ +name: Rare Parent/Child Process Relationship - SSA Unit Test +detections: + - name: Access LSASS Memory for Dump Creation + file: endpoint/rare_parent_process_relationship_lolbas___ssa.yaml + pass_condition: '| stats count | where count > 0' +description: Test detection looking for LOLBAS processes spawned by other processes that are rarely seen together +attack_data: + - file_name: T1059.all.labeled.lolbas-test.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json + diff --git a/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml b/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml new file mode 100644 index 0000000000..821ae821d0 --- /dev/null +++ b/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml @@ -0,0 +1,7 @@ +name: System Process Running from Unexpected Location - SSA Unit Test +detections: + - name: System Process Running from Unexpected Location - SSA + file: endpoint/system_process_running_unexpected_location___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test process running from other locations +attack_data: diff --git a/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml b/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml new file mode 100644 index 0000000000..941debefa8 --- /dev/null +++ b/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml @@ -0,0 +1,9 @@ +name: More than usual number of LOLBAS applications in short time period - SSA Unit Test +detections: + - name: More than usual number of LOLBAS applications in short time period + file: endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test more than usual lolbas being executed in a short period of time +attack_data: + - file_name: T1059.all.labeled.lolbas-test.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json diff --git a/tests/endpoint/unusually_long_command_line___ssa.test.yml b/tests/endpoint/unusually_long_command_line___ssa.test.yml new file mode 100644 index 0000000000..015617b043 --- /dev/null +++ b/tests/endpoint/unusually_long_command_line___ssa.test.yml @@ -0,0 +1,10 @@ +name: Unusually Long Command Line - SSA Unit Test +detections: + - name: Unusually Long Command Line + file: endpoint/unusually_long_command_line___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test unusually long command lines +attack_data: + - file_name: unusual_commandline.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_commandline.json + diff --git a/tests/network/.gitkeep b/tests/network/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/tests/web/.gitkeep b/tests/web/.gitkeep new file mode 100644 index 0000000000..e69de29bb2