From e6080d9022a5590367b93b490599e8da30e20744 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Thu, 8 Oct 2020 17:51:57 -0400 Subject: [PATCH 01/42] firstiterationgcploitdetect --- detections/gcp_detect_gcploit_framework.yml | 22 +++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 detections/gcp_detect_gcploit_framework.yml diff --git a/detections/gcp_detect_gcploit_framework.yml b/detections/gcp_detect_gcploit_framework.yml new file mode 100644 index 0000000000..3cd31a4317 --- /dev/null +++ b/detections/gcp_detect_gcploit_framework.yml @@ -0,0 +1,22 @@ +author: "Rod Soto, Splunk" +date: "2020-10-08" +description: "This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts." +how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" +id: a1c5a85e-a162-410c-a5d9-99ff639e5a52 +known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects" +name: "gcp detect gcploit framework" +references: + - https://github.com/dxa4481/gcploit + - https://www.youtube.com/watch?v=Ml09R38jpok +search: '`sourcetype=google:gcp:pubsub:message data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework`' +tags: + analytics_story: + - "GCP Cross Account Activity" + asset_type: "GCP Account" + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1078 + security_domain: threat +type: ESCU +version: 1 From e6a967a41201d4df0d5a8e922010cf999b12c480 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 9 Oct 2020 10:07:42 -0400 Subject: [PATCH 02/42] gcpdetectaccounthighriskrolesbyproject --- ...counts_with_high_risk_roles_by_project.yml | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml diff --git a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml new file mode 100644 index 0000000000..fbd6b8e278 --- /dev/null +++ b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml @@ -0,0 +1,23 @@ +author: "Rod Soto, Splunk" +date: "2020-10-09" +description: "This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts." +how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" +id: 27af8c15-38b0-4408-b339-920170724adb +known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects" +name: "gcp detect accounts with high risk roles by project" +references: + - https://github.com/dxa4481/gcploit + - https://www.youtube.com/watch?v=Ml09R38jpok + - https://cloud.google.com/iam/docs/understanding-roles +search: sourcetype=google:gcp:pubsub:message "data.protoPayload.request.policy.bindings{}.role"="roles/owner" OR "roles/editor" OR "roles/iam.serviceAccountUser" OR "roles/iam.serviceAccountAdmin" OR "roles/iam.serviceAccountTokenCreator" OR "roles/dataflow.developer" OR "roles/dataflow.admin" OR "roles/composer.admin" OR "roles/dataproc.admin" OR "roles/dataproc.editor" | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project`' +tags: + analytics_story: + - "GCP Cross Account Activity" + asset_type: "GCP Account" + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1078 + security_domain: threat +type: ESCU +version: 1 From 8115fbd312b8fcf604dc76d046d0a6d5722a61b6 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 9 Oct 2020 10:12:21 -0400 Subject: [PATCH 03/42] gcpdetectaccounthighriskrolesbyproject2 --- .../gcp_detect_accounts_with_high_risk_roles_by_project.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml index fbd6b8e278..f4e8934c6b 100644 --- a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml +++ b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml @@ -1,9 +1,9 @@ author: "Rod Soto, Splunk" date: "2020-10-09" -description: "This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts." +description: "This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges at different projects depending on organization schema." how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" id: 27af8c15-38b0-4408-b339-920170724adb -known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects" +known_false_positives: "Accounts with high risk roles should be reduced to the minimum number needed, however specific tasks and setups may be simply expected behavior within organization" name: "gcp detect accounts with high risk roles by project" references: - https://github.com/dxa4481/gcploit From cb93a1df16b4b4010b49c355405d2133ba46bdbb Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 9 Oct 2020 10:43:27 -0400 Subject: [PATCH 04/42] gcpdetecthighriskpermissionsv1 --- ...sk_permissions_by_resource_and_account.yml | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml diff --git a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml new file mode 100644 index 0000000000..23bf954a41 --- /dev/null +++ b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml @@ -0,0 +1,23 @@ +author: "Rod Soto, Splunk" +date: "2020-10-09" +description: "This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts to move laterally and escalate privileges." +how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" +id: 2e70ef35-2187-431f-aedc-4503dc9b06ba +known_false_positives: "High risk permissions are part of any GCP environment, however it is important to track resource and accounts usage, this search may produce false positives." +name: "gcp detect high risk permissions by resource and account" +references: + - https://github.com/dxa4481/gcploit + - https://www.youtube.com/watch?v=Ml09R38jpok + - https://cloud.google.com/iam/docs/permissions-reference +search: '`sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.setaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.policy.bindings{}.role data.resource.labels.project_id data.resource.labels.project_id data.resource.type | `gcp_detect_high_risk_permissions_by_resource_and_account`' +tags: + analytics_story: + - "GCP Cross Account Activity" + asset_type: "GCP Account" + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1078 + security_domain: threat +type: ESCU +version: 1 From 202da1aa8a92865897ac54dd62366533d348e1d1 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 9 Oct 2020 10:57:14 -0400 Subject: [PATCH 05/42] gcpdetectsearchesfixed2 --- .../gcp_detect_accounts_with_high_risk_roles_by_project.yml | 2 +- detections/gcp_detect_gcploit_framework.yml | 2 +- ...gcp_detect_high_risk_permissions_by_resource_and_account.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml index f4e8934c6b..82265286f9 100644 --- a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml +++ b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml @@ -9,7 +9,7 @@ references: - https://github.com/dxa4481/gcploit - https://www.youtube.com/watch?v=Ml09R38jpok - https://cloud.google.com/iam/docs/understanding-roles -search: sourcetype=google:gcp:pubsub:message "data.protoPayload.request.policy.bindings{}.role"="roles/owner" OR "roles/editor" OR "roles/iam.serviceAccountUser" OR "roles/iam.serviceAccountAdmin" OR "roles/iam.serviceAccountTokenCreator" OR "roles/dataflow.developer" OR "roles/dataflow.admin" OR "roles/composer.admin" OR "roles/dataproc.admin" OR "roles/dataproc.editor" | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project`' +search: sourcetype=google:gcp:pubsub:message data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project` tags: analytics_story: - "GCP Cross Account Activity" diff --git a/detections/gcp_detect_gcploit_framework.yml b/detections/gcp_detect_gcploit_framework.yml index 3cd31a4317..9c8ce1e719 100644 --- a/detections/gcp_detect_gcploit_framework.yml +++ b/detections/gcp_detect_gcploit_framework.yml @@ -8,7 +8,7 @@ name: "gcp detect gcploit framework" references: - https://github.com/dxa4481/gcploit - https://www.youtube.com/watch?v=Ml09R38jpok -search: '`sourcetype=google:gcp:pubsub:message data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework`' +search: sourcetype=google:gcp:pubsub:message data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework` tags: analytics_story: - "GCP Cross Account Activity" diff --git a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml index 23bf954a41..3f59b1da29 100644 --- a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml +++ b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml @@ -9,7 +9,7 @@ references: - https://github.com/dxa4481/gcploit - https://www.youtube.com/watch?v=Ml09R38jpok - https://cloud.google.com/iam/docs/permissions-reference -search: '`sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.setaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.policy.bindings{}.role data.resource.labels.project_id data.resource.labels.project_id data.resource.type | `gcp_detect_high_risk_permissions_by_resource_and_account`' +search: sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.setaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.policy.bindings{}.role data.resource.labels.project_id data.resource.labels.project_id data.resource.type | `gcp_detect_high_risk_permissions_by_resource_and_account` tags: analytics_story: - "GCP Cross Account Activity" From 07bae7a2b7ffd7b1f1c3340015aa009b06a3ad13 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 9 Oct 2020 11:37:48 -0400 Subject: [PATCH 06/42] ../detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml --- ...gcp_detect_high_risk_permissions_by_resource_and_account.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml index 3f59b1da29..d4eece9b83 100644 --- a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml +++ b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml @@ -9,7 +9,7 @@ references: - https://github.com/dxa4481/gcploit - https://www.youtube.com/watch?v=Ml09R38jpok - https://cloud.google.com/iam/docs/permissions-reference -search: sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.setaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.policy.bindings{}.role data.resource.labels.project_id data.resource.labels.project_id data.resource.type | `gcp_detect_high_risk_permissions_by_resource_and_account` +search: sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account` tags: analytics_story: - "GCP Cross Account Activity" From b64ca7010c24d58c8564ce4723158429c6dfa6fe Mon Sep 17 00:00:00 2001 From: bpatel Date: Fri, 9 Oct 2020 10:23:53 -0700 Subject: [PATCH 07/42] seearch bugs --- ...detect_accounts_with_high_risk_roles_by_project.yml | 10 +++++----- detections/gcp_detect_gcploit_framework.yml | 10 +++++----- ...t_high_risk_permissions_by_resource_and_account.yml | 10 +++++----- detections/gcp_detect_oauth_token_abuse.yml | 8 ++++---- 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml index 82265286f9..2bf308813d 100644 --- a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml +++ b/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml @@ -4,20 +4,20 @@ description: "This search provides detection of accounts with high risk roles by how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" id: 27af8c15-38b0-4408-b339-920170724adb known_false_positives: "Accounts with high risk roles should be reduced to the minimum number needed, however specific tasks and setups may be simply expected behavior within organization" -name: "gcp detect accounts with high risk roles by project" +name: GCP Detect accounts with high risk roles by project references: - https://github.com/dxa4481/gcploit - https://www.youtube.com/watch?v=Ml09R38jpok - https://cloud.google.com/iam/docs/understanding-roles -search: sourcetype=google:gcp:pubsub:message data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project` +search: "`google_gcp_pubsub_message` data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor | table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project_filter`" tags: analytics_story: - - "GCP Cross Account Activity" + - GCP Cross Account Activity asset_type: "GCP Account" kill_chain_phases: - - Lateral Movement + - Lateral Movement mitre_attack_id: - - T1078 + - T1078 security_domain: threat type: ESCU version: 1 diff --git a/detections/gcp_detect_gcploit_framework.yml b/detections/gcp_detect_gcploit_framework.yml index 9c8ce1e719..d247bb8014 100644 --- a/detections/gcp_detect_gcploit_framework.yml +++ b/detections/gcp_detect_gcploit_framework.yml @@ -4,19 +4,19 @@ description: "This search provides detection of GCPloit exploitation framework. how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" id: a1c5a85e-a162-410c-a5d9-99ff639e5a52 known_false_positives: "Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects" -name: "gcp detect gcploit framework" +name: GCP Detect gcploit framework references: - https://github.com/dxa4481/gcploit - https://www.youtube.com/watch?v=Ml09R38jpok -search: sourcetype=google:gcp:pubsub:message data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework` +search: "`google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework_filter`" tags: analytics_story: - - "GCP Cross Account Activity" + - GCP Cross Account Activity asset_type: "GCP Account" kill_chain_phases: - - Lateral Movement + - Lateral Movement mitre_attack_id: - - T1078 + - T1078 security_domain: threat type: ESCU version: 1 diff --git a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml index d4eece9b83..8495c184eb 100644 --- a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml +++ b/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml @@ -4,20 +4,20 @@ description: "This search provides detection of high risk permissions by resourc how_to_implement: "You must install splunk GCP add-on. This search works with gcp:pubsub:message logs" id: 2e70ef35-2187-431f-aedc-4503dc9b06ba known_false_positives: "High risk permissions are part of any GCP environment, however it is important to track resource and accounts usage, this search may produce false positives." -name: "gcp detect high risk permissions by resource and account" +name: GCP Detect high risk permissions by resource and account references: - https://github.com/dxa4481/gcploit - https://www.youtube.com/watch?v=Ml09R38jpok - https://cloud.google.com/iam/docs/permissions-reference -search: sourcetype=google:gcp:pubsub:message data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account` +search: "`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create |table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account_filter`" tags: analytics_story: - - "GCP Cross Account Activity" + - GCP Cross Account Activity asset_type: "GCP Account" kill_chain_phases: - - Lateral Movement + - Lateral Movement mitre_attack_id: - - T1078 + - T1078 security_domain: threat type: ESCU version: 1 diff --git a/detections/gcp_detect_oauth_token_abuse.yml b/detections/gcp_detect_oauth_token_abuse.yml index 3b6fa23ebd..fa55c444ec 100644 --- a/detections/gcp_detect_oauth_token_abuse.yml +++ b/detections/gcp_detect_oauth_token_abuse.yml @@ -8,15 +8,15 @@ name: "gcp detect oauth token abuse" references: - https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-1 - https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-2 -search: '`sourcetype=google:gcp:pubsub:message type.googleapis.com/google.cloud.audit.AuditLog |table protoPayload.@type protoPayload.status.details{}.@type protoPayload.status.details{}.violations{}.callerIp protoPayload.status.details{}.violations{}.type protoPayload.status.message | `gcp_detect_oauth_token_abuse`' +search: '`google_gcp_pubsub_message` type.googleapis.com/google.cloud.audit.AuditLog |table protoPayload.@type protoPayload.status.details{}.@type protoPayload.status.details{}.violations{}.callerIp protoPayload.status.details{}.violations{}.type protoPayload.status.message | `gcp_detect_oauth_token_abuse_filter`' tags: analytics_story: - - "GCP Cross Account Activity" + - GCP Cross Account Activity asset_type: "GCP Account" kill_chain_phases: - - Lateral Movement + - Lateral Movement mitre_attack_id: - - T1078 + - T1078 security_domain: threat type: ESCU version: 1 From 8b522411756792c2e7c927d2bee6bacabdc4e26a Mon Sep 17 00:00:00 2001 From: Ignacio Bermudez Corrales Date: Wed, 14 Oct 2020 09:53:15 -0700 Subject: [PATCH 08/42] fixed syntax --- detections/unusually_long_command_line___ssa.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/unusually_long_command_line___ssa.yml b/detections/unusually_long_command_line___ssa.yml index 64c020e0af..c7d9aa8c46 100644 --- a/detections/unusually_long_command_line___ssa.yml +++ b/detections/unusually_long_command_line___ssa.yml @@ -20,9 +20,9 @@ process_name=ucast(map_get(input_event, "process_name"), "string", null) | eval cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), -input=parse_double(len(coalesce(cmd_line_norm, ""))), +input=parse_double(len(coalesce(cmd_line_norm, ""))) | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 -| where output="True" AND quantile>0.99 +| where label AND quantile>0.99 | first_time_event cache_partitions=1 input_columns="dest_device_id,cmd_line" | where first_time_dest_device_id_cmd_line | eval start_time = timestamp, From c0e034ad04098e4d8bb1c064dfe5c2ec3fe4e25f Mon Sep 17 00:00:00 2001 From: Ignacio Bermudez Corrales Date: Thu, 15 Oct 2020 01:43:56 -0700 Subject: [PATCH 09/42] fixed yaml and changed output for label --- .../rare_parent_process_relationship_lolbas___ssa.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml b/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml index 333d0e0938..1a0f3c0bfb 100644 --- a/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml +++ b/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml @@ -19,10 +19,11 @@ dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) | where parent_process!=null +| select parent_process, process_name, timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process" target="process_name" | rename output as input | adaptive_threshold algorithm="quantile" entity="parent_process" value="input" window=604800000L -| where output AND quantile<0.1 AND (process_name="powershell.exe" OR +| where label AND quantile<0.1 AND (process_name="powershell.exe" OR process_name="regsvcs.exe" OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR @@ -103,8 +104,9 @@ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" | into write_ssa_detected_events();' -known_false_positives: Some custom tools used by admins could be used rarely to launch remotely applications. -This might trigger false positives at the beginning when it hasn't collected yet enough data to construct the baseline. +known_false_positives: > + Some custom tools used by admins could be used rarely to launch remotely applications. + This might trigger false positives at the beginning when it hasn't collected yet enough data to construct the baseline. tags: mitre_technique_id: - T1203 From 5da1fde8cf4e2b472b910fd99b7f4b5a89260c08 Mon Sep 17 00:00:00 2001 From: Ignacio Bermudez Corrales Date: Thu, 15 Oct 2020 13:15:17 -0700 Subject: [PATCH 10/42] Added notebook --- ...ent_process_relationship_lolbas___ssa.yaml | 2 +- ...e_parent_process_relationship_lolbas.ipynb | 664 ++++++++++++++++++ 2 files changed, 665 insertions(+), 1 deletion(-) create mode 100644 notebooks/rare_parent_process_relationship_lolbas.ipynb diff --git a/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml b/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml index 1a0f3c0bfb..a95eff594f 100644 --- a/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml +++ b/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml @@ -22,7 +22,7 @@ dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) | select parent_process, process_name, timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process" target="process_name" | rename output as input -| adaptive_threshold algorithm="quantile" entity="parent_process" value="input" window=604800000L +| adaptive_threshold algorithm="quantile" entity="parent_process" window=604800000L | where label AND quantile<0.1 AND (process_name="powershell.exe" OR process_name="regsvcs.exe" OR process_name="ftp.exe" OR diff --git a/notebooks/rare_parent_process_relationship_lolbas.ipynb b/notebooks/rare_parent_process_relationship_lolbas.ipynb new file mode 100644 index 0000000000..033f2f8f69 --- /dev/null +++ b/notebooks/rare_parent_process_relationship_lolbas.ipynb @@ -0,0 +1,664 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# Rare Parent/Child Process Relationship\n", + "\n", + "An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries\n", + "\n", + "https://github.com/splunk/security-content/blob/unit_test_prohibited_apps_spawning_cmdprompt/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml" + ] + }, + { + "cell_type": "code", + "execution_count": 21, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T20:08:27.093444Z", + "iopub.status.busy": "2020-10-15T20:08:27.093190Z", + "iopub.status.idle": "2020-10-15T20:08:36.211841Z", + "shell.execute_reply": "2020-10-15T20:08:36.211309Z", + "shell.execute_reply.started": "2020-10-15T20:08:27.093423Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "77a26780b74e4608b6aa7d13f168b61d", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
inputdest_device_identitiesprocess_namequantilelabelparent_processbodydest_user_id
07.6666675gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]powershell.exe0.000000Truec:\\windows\\system32\\cmd.exeTBDNaN
11.1647255gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.082919Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBDNaN
21.1642285gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.081037Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBDNaN
31.161742IaNYgFTNQvyVmJNuPr58dQ==[IaNYgFTNQvyVmJNuPr58dQ==]cmd.exe0.083721Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBDNaN
41.1582955gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.057663Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBDNaN
..............................
17846.918486ZTQ/ltGlScpA4WGbfRJ0Xg==[ZTQ/ltGlScpA4WGbfRJ0Xg==]sc.exe0.000879Truec:\\windows\\system32\\svchost.exeTBDNaN
17858.567270lQ+9FBHxYQK/q8qXcrTE9A==[lQ+9FBHxYQK/q8qXcrTE9A==]sc.exe0.001315Truec:\\windows\\system32\\svchost.exeTBDNaN
17869.991479IaNYgFTNQvyVmJNuPr58dQ==[IaNYgFTNQvyVmJNuPr58dQ==]sc.exe0.001752Truec:\\windows\\system32\\svchost.exeTBDNaN
17875.403934OWUYaWKrJeuOY71+TXoqiw==[OWUYaWKrJeuOY71+TXoqiw==]cmd.exe0.000000Truec:\\program files\\splunkuniversalforwarder\\bin\\...TBDNaN
17880.035648OWUYaWKrJeuOY71+TXoqiw==[OWUYaWKrJeuOY71+TXoqiw==, rXYtTmzIXq56PqQ+iNO...cmd.exe0.000000Truec:\\windows\\system32\\cmd.exeTBDrXYtTmzIXq56PqQ+iNO/xw==
\n", + "

1789 rows × 9 columns

\n", + "
" + ], + "text/plain": [ + " input dest_device_id ... body dest_user_id\n", + "0 7.666667 5gUXDbXvVfgC/FEpZOFUaA== ... TBD NaN\n", + "1 1.164725 5gUXDbXvVfgC/FEpZOFUaA== ... TBD NaN\n", + "2 1.164228 5gUXDbXvVfgC/FEpZOFUaA== ... TBD NaN\n", + "3 1.161742 IaNYgFTNQvyVmJNuPr58dQ== ... TBD NaN\n", + "4 1.158295 5gUXDbXvVfgC/FEpZOFUaA== ... TBD NaN\n", + "... ... ... ... ... ...\n", + "1784 6.918486 ZTQ/ltGlScpA4WGbfRJ0Xg== ... TBD NaN\n", + "1785 8.567270 lQ+9FBHxYQK/q8qXcrTE9A== ... TBD NaN\n", + "1786 9.991479 IaNYgFTNQvyVmJNuPr58dQ== ... TBD NaN\n", + "1787 5.403934 OWUYaWKrJeuOY71+TXoqiw== ... TBD NaN\n", + "1788 0.035648 OWUYaWKrJeuOY71+TXoqiw== ... TBD rXYtTmzIXq56PqQ+iNO/xw==\n", + "\n", + "[1789 rows x 9 columns]" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 21, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", + "| select from_json_object(value) as input_event\n", + "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)) \n", + "| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), \n", + "process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), \n", + "dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", + "dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n", + "| where parent_process!=null \n", + "| select parent_process, process_name, timestamp, dest_device_id, dest_user_id \n", + "| conditional_anomaly conditional=\"parent_process\" target=\"process_name\" \n", + "| rename output as input \n", + "| adaptive_threshold algorithm=\"quantile\" entity=\"parent_process\" value=\"input\" window=604800000L \n", + "| where label AND quantile<0.1 AND (process_name=\"powershell.exe\" OR process_name=\"regsvcs.exe\" OR process_name=\"ftp.exe\" OR process_name=\"dfsvc.exe\" OR process_name=\"rasautou.exe\" OR process_name=\"schtasks.exe\" OR process_name=\"xwizard.exe\" OR process_name=\"findstr.exe\" OR process_name=\"esentutl.exe\" OR process_name=\"cscript.exe\" OR process_name=\"reg.exe\" OR process_name=\"csc.exe\" OR process_name=\"atbroker.exe\" OR process_name=\"print.exe\" OR process_name=\"pcwrun.exe\" OR process_name=\"vbc.exe\" OR process_name=\"rpcping.exe\" OR process_name=\"wsreset.exe\" OR process_name=\"ilasm.exe\" OR process_name=\"certutil.exe\" OR process_name=\"replace.exe\" OR process_name=\"mshta.exe\" OR process_name=\"bitsadmin.exe\" OR process_name=\"wscript.exe\" OR process_name=\"ieexec.exe\" OR process_name=\"cmd.exe\" OR process_name=\"microsoft.workflow.compiler.exe\" OR process_name=\"runscripthelper.exe\" OR process_name=\"makecab.exe\" OR process_name=\"forfiles.exe\" OR process_name=\"desktopimgdownldr.exe\" OR process_name=\"control.exe\" OR process_name=\"msbuild.exe\" OR process_name=\"register-cimprovider.exe\" OR process_name=\"tttracer.exe\" OR process_name=\"ie4uinit.exe\" OR process_name=\"sc.exe\" OR process_name=\"bash.exe\" OR process_name=\"hh.exe\" OR process_name=\"cmstp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"jsc.exe\" OR process_name=\"scriptrunner.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"extexport.exe\" OR process_name=\"msdt.exe\" OR process_name=\"diskshadow.exe\" OR process_name=\"extrac32.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"mavinject.exe\" OR process_name=\"regasm.exe\" OR process_name=\"gpscript.exe\" OR process_name=\"rundll32.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"regedit.exe\" OR process_name=\"msiexec.exe\" OR process_name=\"gfxdownloadwrapper.exe\" OR process_name=\"presentationhost.exe\" OR process_name=\"regini.exe\" OR process_name=\"wmic.exe\" OR process_name=\"runonce.exe\" OR process_name=\"syncappvpublishingserver.exe\" OR process_name=\"verclsid.exe\" OR process_name=\"psr.exe\" OR process_name=\"infdefaultinstall.exe\" OR process_name=\"explorer.exe\" OR process_name=\"expand.exe\" OR process_name=\"installutil.exe\" OR process_name=\"netsh.exe\" OR process_name=\"wab.exe\" OR process_name=\"dnscmd.exe\" OR process_name=\"at.exe\" OR process_name=\"pcalua.exe\" OR process_name=\"cmdkey.exe\" OR process_name=\"msconfig.exe\")\n", + "| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = \"TBD\";" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + }, + { + "cell_type": "code", + "execution_count": 17, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T20:02:37.170279Z", + "iopub.status.busy": "2020-10-15T20:02:37.170022Z", + "iopub.status.idle": "2020-10-15T20:02:43.678071Z", + "shell.execute_reply": "2020-10-15T20:02:43.677426Z", + "shell.execute_reply.started": "2020-10-15T20:02:37.170257Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "4e0d8eab254f4b029c177b1fe1e534e2", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=4.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
\n", + "
" + ], + "text/plain": [ + "Empty DataFrame\n", + "Columns: []\n", + "Index: []" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 17, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", + "| select from_json_object(value) as input_event\n", + "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)) \n", + "| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n", + "| where parent_process!=null \n", + "| select parent_process, process_name, timestamp, dest_device_id, dest_user_id \n", + "| conditional_anomaly conditional=\"parent_process\" target=\"process_name\" \n", + "| rename output as input \n", + "| adaptive_threshold algorithm=\"quantile\" entity=\"parent_process\" window=604800000L \n", + "| where label AND quantile<0.1 \n", + "| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = \"TBD\";" + ] + }, + { + "cell_type": "code", + "execution_count": 20, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T20:08:09.210819Z", + "iopub.status.busy": "2020-10-15T20:08:09.210557Z", + "iopub.status.idle": "2020-10-15T20:08:14.938351Z", + "shell.execute_reply": "2020-10-15T20:08:14.937869Z", + "shell.execute_reply.started": "2020-10-15T20:08:09.210797Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "b65b4333a96b4def890df59aef61efd6", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
dest_device_idparent_processprocess_nameinput_eventdest_user_id
0IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-monitornohandle.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
1IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-powershell.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
2IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-admon.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
3IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-winprintmon.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
4IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-regmon.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
..................
69294OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
69295OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
69296OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
69297OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
69298OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
\n", + "

69299 rows × 5 columns

\n", + "
" + ], + "text/plain": [ + " dest_device_id ... dest_user_id\n", + "0 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", + "1 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", + "2 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", + "3 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", + "4 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", + "... ... ... ...\n", + "69294 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", + "69295 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", + "69296 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", + "69297 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", + "69298 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", + "\n", + "[69299 rows x 5 columns]" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 20, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", + "| select from_json_object(value) as input_event\n", + "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)) \n", + "| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null);" + ] + }, + { + "cell_type": "code", + "execution_count": 12, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T19:57:41.275353Z", + "iopub.status.busy": "2020-10-15T19:57:41.275091Z", + "iopub.status.idle": "2020-10-15T19:57:41.451939Z", + "shell.execute_reply": "2020-10-15T19:57:41.451420Z", + "shell.execute_reply.started": "2020-10-15T19:57:41.275329Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "a6d67552f5c94913ae1533cc38780ed3", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Getting search results... \n" + ] + }, + { + "name": "stderr", + "output_type": "stream", + "text": [ + "SPL2RuntimeError: Search failed with exception: Error type checking arguments to function [eval] with ID: [9b2c2616-255f-4b80-976d-3ead4c842e4a]: Unable to find function [map_get] for arguments [input: get(fieldName: input_event), key: _time] with resolvedId [map_get:map:string] - candidate functions: \n", + "\t0: Argument [input: string] cannot be assigned to argument [input: map] for function [function(input: map, key: string): T]. resolvedId=map_get:map:string\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 12, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", + "| select ucast(value, \"string\", null) as input_event\n", + "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null));" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "SPL2", + "language": "SPL", + "name": "spl2" + }, + "language_info": { + "mimetype": "text/spl", + "name": "SPL" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +} From e04592401b1452bb9661abbda7fb86739ce6d590 Mon Sep 17 00:00:00 2001 From: Ignacio Bermudez Corrales Date: Thu, 15 Oct 2020 14:53:59 -0700 Subject: [PATCH 11/42] unusual lolbas short time period --- ...l_lolbas_in_short_period_of_time___ssa.yml | 5 +- ...e_parent_process_relationship_lolbas.ipynb | 470 +++--------------- ...usual_lolbas_in_short_period_of_time.ipynb | 268 ++++++++++ 3 files changed, 339 insertions(+), 404 deletions(-) create mode 100644 notebooks/unusual_lolbas_in_short_period_of_time.ipynb diff --git a/detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml b/detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml index 02580c7112..e35871fde1 100644 --- a/detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml +++ b/detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml @@ -90,8 +90,9 @@ timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 -| adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000 -| where output AND quantile>0.5 +| rename window_end as timestamp +| adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000L +| where label AND quantile>0.99 | eval start_time = timestamp, end_time = timestamp, entities = mvappend(device), diff --git a/notebooks/rare_parent_process_relationship_lolbas.ipynb b/notebooks/rare_parent_process_relationship_lolbas.ipynb index 033f2f8f69..57d099f502 100644 --- a/notebooks/rare_parent_process_relationship_lolbas.ipynb +++ b/notebooks/rare_parent_process_relationship_lolbas.ipynb @@ -13,21 +13,21 @@ }, { "cell_type": "code", - "execution_count": 21, + "execution_count": 22, "metadata": { "execution": { - "iopub.execute_input": "2020-10-15T20:08:27.093444Z", - "iopub.status.busy": "2020-10-15T20:08:27.093190Z", - "iopub.status.idle": "2020-10-15T20:08:36.211841Z", - "shell.execute_reply": "2020-10-15T20:08:36.211309Z", - "shell.execute_reply.started": "2020-10-15T20:08:27.093423Z" + "iopub.execute_input": "2020-10-15T21:50:56.862479Z", + "iopub.status.busy": "2020-10-15T21:50:56.862220Z", + "iopub.status.idle": "2020-10-15T21:51:06.101230Z", + "shell.execute_reply": "2020-10-15T21:51:06.100748Z", + "shell.execute_reply.started": "2020-10-15T21:50:56.862456Z" } }, "outputs": [ { "data": { "application/vnd.jupyter.widget-view+json": { - "model_id": "77a26780b74e4608b6aa7d13f168b61d", + "model_id": "38a2bbfe856f4bf797b49f98bb92e6be", "version_major": 2, "version_minor": 0 }, @@ -67,13 +67,16 @@ " \n", " \n", " input\n", + " start_time\n", " dest_device_id\n", " entities\n", " process_name\n", " quantile\n", + " end_time\n", " label\n", " parent_process\n", " body\n", + " timestamp\n", " dest_user_id\n", " \n", " \n", @@ -81,61 +84,76 @@ " \n", " 0\n", " 7.666667\n", + " 2020-09-24 17:00:13\n", " 5gUXDbXvVfgC/FEpZOFUaA==\n", " [5gUXDbXvVfgC/FEpZOFUaA==]\n", " powershell.exe\n", " 0.000000\n", + " 2020-09-24 17:00:13\n", " True\n", " c:\\windows\\system32\\cmd.exe\n", " TBD\n", + " 2020-09-24 17:00:13\n", " NaN\n", " \n", " \n", " 1\n", " 1.164725\n", + " 2020-09-24 17:15:12\n", " 5gUXDbXvVfgC/FEpZOFUaA==\n", " [5gUXDbXvVfgC/FEpZOFUaA==]\n", " cmd.exe\n", " 0.082919\n", + " 2020-09-24 17:15:12\n", " True\n", " c:\\program files\\splunkforwarderforsplunkinc\\b...\n", " TBD\n", + " 2020-09-24 17:15:12\n", " NaN\n", " \n", " \n", " 2\n", " 1.164228\n", + " 2020-09-24 17:17:12\n", " 5gUXDbXvVfgC/FEpZOFUaA==\n", " [5gUXDbXvVfgC/FEpZOFUaA==]\n", " cmd.exe\n", " 0.081037\n", + " 2020-09-24 17:17:12\n", " True\n", " c:\\program files\\splunkforwarderforsplunkinc\\b...\n", " TBD\n", + " 2020-09-24 17:17:12\n", " NaN\n", " \n", " \n", " 3\n", " 1.161742\n", + " 2020-09-24 17:18:04\n", " IaNYgFTNQvyVmJNuPr58dQ==\n", " [IaNYgFTNQvyVmJNuPr58dQ==]\n", " cmd.exe\n", " 0.083721\n", + " 2020-09-24 17:18:04\n", " True\n", " c:\\program files\\splunkforwarderforsplunkinc\\b...\n", " TBD\n", + " 2020-09-24 17:18:04\n", " NaN\n", " \n", " \n", " 4\n", " 1.158295\n", + " 2020-09-24 17:18:12\n", " 5gUXDbXvVfgC/FEpZOFUaA==\n", " [5gUXDbXvVfgC/FEpZOFUaA==]\n", " cmd.exe\n", " 0.057663\n", + " 2020-09-24 17:18:12\n", " True\n", " c:\\program files\\splunkforwarderforsplunkinc\\b...\n", " TBD\n", + " 2020-09-24 17:18:12\n", " NaN\n", " \n", " \n", @@ -149,87 +167,105 @@ " ...\n", " ...\n", " ...\n", + " ...\n", + " ...\n", + " ...\n", " \n", " \n", - " 1784\n", + " 1799\n", " 6.918486\n", + " 2020-09-25 19:46:23\n", " ZTQ/ltGlScpA4WGbfRJ0Xg==\n", " [ZTQ/ltGlScpA4WGbfRJ0Xg==]\n", " sc.exe\n", - " 0.000879\n", + " 0.000843\n", + " 2020-09-25 19:46:23\n", " True\n", " c:\\windows\\system32\\svchost.exe\n", " TBD\n", + " 2020-09-25 19:46:23\n", " NaN\n", " \n", " \n", - " 1785\n", + " 1800\n", " 8.567270\n", + " 2020-09-25 16:49:46\n", " lQ+9FBHxYQK/q8qXcrTE9A==\n", " [lQ+9FBHxYQK/q8qXcrTE9A==]\n", " sc.exe\n", - " 0.001315\n", + " 0.000841\n", + " 2020-09-25 16:49:46\n", " True\n", " c:\\windows\\system32\\svchost.exe\n", " TBD\n", + " 2020-09-25 16:49:46\n", " NaN\n", " \n", " \n", - " 1786\n", + " 1801\n", " 9.991479\n", + " 2020-09-25 16:50:30\n", " IaNYgFTNQvyVmJNuPr58dQ==\n", " [IaNYgFTNQvyVmJNuPr58dQ==]\n", " sc.exe\n", - " 0.001752\n", + " 0.003361\n", + " 2020-09-25 16:50:30\n", " True\n", " c:\\windows\\system32\\svchost.exe\n", " TBD\n", + " 2020-09-25 16:50:30\n", " NaN\n", " \n", " \n", - " 1787\n", + " 1802\n", " 5.403934\n", + " 2020-09-26 05:00:40\n", " OWUYaWKrJeuOY71+TXoqiw==\n", " [OWUYaWKrJeuOY71+TXoqiw==]\n", " cmd.exe\n", " 0.000000\n", + " 2020-09-26 05:00:40\n", " True\n", " c:\\program files\\splunkuniversalforwarder\\bin\\...\n", " TBD\n", + " 2020-09-26 05:00:40\n", " NaN\n", " \n", " \n", - " 1788\n", + " 1803\n", " 0.035648\n", + " 2020-09-26 05:06:18\n", " OWUYaWKrJeuOY71+TXoqiw==\n", " [OWUYaWKrJeuOY71+TXoqiw==, rXYtTmzIXq56PqQ+iNO...\n", " cmd.exe\n", " 0.000000\n", + " 2020-09-26 05:06:18\n", " True\n", " c:\\windows\\system32\\cmd.exe\n", " TBD\n", + " 2020-09-26 05:06:18\n", " rXYtTmzIXq56PqQ+iNO/xw==\n", " \n", " \n", "\n", - "

1789 rows × 9 columns

\n", + "

1804 rows × 12 columns

\n", "" ], "text/plain": [ - " input dest_device_id ... body dest_user_id\n", - "0 7.666667 5gUXDbXvVfgC/FEpZOFUaA== ... TBD NaN\n", - "1 1.164725 5gUXDbXvVfgC/FEpZOFUaA== ... TBD NaN\n", - "2 1.164228 5gUXDbXvVfgC/FEpZOFUaA== ... TBD NaN\n", - "3 1.161742 IaNYgFTNQvyVmJNuPr58dQ== ... TBD NaN\n", - "4 1.158295 5gUXDbXvVfgC/FEpZOFUaA== ... TBD NaN\n", - "... ... ... ... ... ...\n", - "1784 6.918486 ZTQ/ltGlScpA4WGbfRJ0Xg== ... TBD NaN\n", - "1785 8.567270 lQ+9FBHxYQK/q8qXcrTE9A== ... TBD NaN\n", - "1786 9.991479 IaNYgFTNQvyVmJNuPr58dQ== ... TBD NaN\n", - "1787 5.403934 OWUYaWKrJeuOY71+TXoqiw== ... TBD NaN\n", - "1788 0.035648 OWUYaWKrJeuOY71+TXoqiw== ... TBD rXYtTmzIXq56PqQ+iNO/xw==\n", + " input ... dest_user_id\n", + "0 7.666667 ... NaN\n", + "1 1.164725 ... NaN\n", + "2 1.164228 ... NaN\n", + "3 1.161742 ... NaN\n", + "4 1.158295 ... NaN\n", + "... ... ... ...\n", + "1799 6.918486 ... NaN\n", + "1800 8.567270 ... NaN\n", + "1801 9.991479 ... NaN\n", + "1802 5.403934 ... NaN\n", + "1803 0.035648 ... rXYtTmzIXq56PqQ+iNO/xw==\n", "\n", - "[1789 rows x 9 columns]" + "[1804 rows x 12 columns]" ] }, "metadata": {}, @@ -245,10 +281,10 @@ { "data": { "text/plain": [ - "" + "" ] }, - "execution_count": 21, + "execution_count": 22, "metadata": {}, "output_type": "execute_result" } @@ -256,7 +292,7 @@ "source": [ "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)) \n", + "| eval timestamp=ucast(map_get(input_event, \"_time\"), \"long\", null)\n", "| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), \n", "process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), \n", "dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", @@ -270,376 +306,6 @@ "| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = \"TBD\";" ] }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - }, - { - "cell_type": "code", - "execution_count": 17, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-15T20:02:37.170279Z", - "iopub.status.busy": "2020-10-15T20:02:37.170022Z", - "iopub.status.idle": "2020-10-15T20:02:43.678071Z", - "shell.execute_reply": "2020-10-15T20:02:43.677426Z", - "shell.execute_reply.started": "2020-10-15T20:02:37.170257Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "4e0d8eab254f4b029c177b1fe1e534e2", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=4.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
\n", - "
" - ], - "text/plain": [ - "Empty DataFrame\n", - "Columns: []\n", - "Index: []" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 17, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)) \n", - "| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n", - "| where parent_process!=null \n", - "| select parent_process, process_name, timestamp, dest_device_id, dest_user_id \n", - "| conditional_anomaly conditional=\"parent_process\" target=\"process_name\" \n", - "| rename output as input \n", - "| adaptive_threshold algorithm=\"quantile\" entity=\"parent_process\" window=604800000L \n", - "| where label AND quantile<0.1 \n", - "| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = \"TBD\";" - ] - }, - { - "cell_type": "code", - "execution_count": 20, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-15T20:08:09.210819Z", - "iopub.status.busy": "2020-10-15T20:08:09.210557Z", - "iopub.status.idle": "2020-10-15T20:08:14.938351Z", - "shell.execute_reply": "2020-10-15T20:08:14.937869Z", - "shell.execute_reply.started": "2020-10-15T20:08:09.210797Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "b65b4333a96b4def890df59aef61efd6", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
dest_device_idparent_processprocess_nameinput_eventdest_user_id
0IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-monitornohandle.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
1IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-powershell.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
2IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-admon.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
3IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-winprintmon.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
4IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-regmon.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
..................
69294OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
69295OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
69296OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
69297OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
69298OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
\n", - "

69299 rows × 5 columns

\n", - "
" - ], - "text/plain": [ - " dest_device_id ... dest_user_id\n", - "0 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", - "1 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", - "2 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", - "3 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", - "4 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", - "... ... ... ...\n", - "69294 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", - "69295 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", - "69296 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", - "69297 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", - "69298 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", - "\n", - "[69299 rows x 5 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 20, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)) \n", - "| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null);" - ] - }, - { - "cell_type": "code", - "execution_count": 12, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-15T19:57:41.275353Z", - "iopub.status.busy": "2020-10-15T19:57:41.275091Z", - "iopub.status.idle": "2020-10-15T19:57:41.451939Z", - "shell.execute_reply": "2020-10-15T19:57:41.451420Z", - "shell.execute_reply.started": "2020-10-15T19:57:41.275329Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "a6d67552f5c94913ae1533cc38780ed3", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Getting search results... \n" - ] - }, - { - "name": "stderr", - "output_type": "stream", - "text": [ - "SPL2RuntimeError: Search failed with exception: Error type checking arguments to function [eval] with ID: [9b2c2616-255f-4b80-976d-3ead4c842e4a]: Unable to find function [map_get] for arguments [input: get(fieldName: input_event), key: _time] with resolvedId [map_get:map:string] - candidate functions: \n", - "\t0: Argument [input: string] cannot be assigned to argument [input: map] for function [function(input: map, key: string): T]. resolvedId=map_get:map:string\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 12, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", - "| select ucast(value, \"string\", null) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null));" - ] - }, { "cell_type": "code", "execution_count": null, diff --git a/notebooks/unusual_lolbas_in_short_period_of_time.ipynb b/notebooks/unusual_lolbas_in_short_period_of_time.ipynb new file mode 100644 index 0000000000..d277a654e0 --- /dev/null +++ b/notebooks/unusual_lolbas_in_short_period_of_time.ipynb @@ -0,0 +1,268 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# More than usual number of LOLBAS applications in short time period\n", + "\n", + "Attacker activity may compromise executing several LOLBAS applications in conjunction to accomplish their objectives. We are looking for more than usual LOLBAS applications over a window of time, by building profiles per machine.\n" + ] + }, + { + "cell_type": "code", + "execution_count": 3, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T21:42:08.429572Z", + "iopub.status.busy": "2020-10-15T21:42:08.429312Z", + "iopub.status.idle": "2020-10-15T21:42:15.742444Z", + "shell.execute_reply": "2020-10-15T21:42:15.741830Z", + "shell.execute_reply.started": "2020-10-15T21:42:08.429549Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "c27fe9ebed854de3b9d45c5f643cbbdb", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
start_timewindow_triggerentitiesquantileend_timewindow_startlabelbodydevicelolbas_countertimestamp
02020-09-24 17:10:001600967399999[5gUXDbXvVfgC/FEpZOFUaA==]12020-09-24 17:10:001600967100000TrueTBD5gUXDbXvVfgC/FEpZOFUaA==72020-09-24 17:10:00
12020-09-24 17:45:001600969499999[5gUXDbXvVfgC/FEpZOFUaA==]12020-09-24 17:45:001600969200000TrueTBD5gUXDbXvVfgC/FEpZOFUaA==92020-09-24 17:45:00
22020-09-24 17:55:001600970099999[IaNYgFTNQvyVmJNuPr58dQ==]12020-09-24 17:55:001600969800000TrueTBDIaNYgFTNQvyVmJNuPr58dQ==92020-09-24 17:55:00
32020-09-24 18:00:001600970399999[lQ+9FBHxYQK/q8qXcrTE9A==]12020-09-24 18:00:001600970100000TrueTBDlQ+9FBHxYQK/q8qXcrTE9A==92020-09-24 18:00:00
42020-09-24 22:20:001600985999999[zMnUW93edd+Q+ovwebxbRw==]12020-09-24 22:20:001600985700000TrueTBDzMnUW93edd+Q+ovwebxbRw==52020-09-24 22:20:00
52020-09-24 23:30:001600990199999[ZTQ/ltGlScpA4WGbfRJ0Xg==]12020-09-24 23:30:001600989900000TrueTBDZTQ/ltGlScpA4WGbfRJ0Xg==52020-09-24 23:30:00
62020-09-25 14:25:001601043899999[lQ+9FBHxYQK/q8qXcrTE9A==]12020-09-25 14:25:001601043600000TrueTBDlQ+9FBHxYQK/q8qXcrTE9A==122020-09-25 14:25:00
72020-09-26 05:05:001601096699999[OWUYaWKrJeuOY71+TXoqiw==]12020-09-26 05:05:001601096400000TrueTBDOWUYaWKrJeuOY71+TXoqiw==382020-09-26 05:05:00
\n", + "
" + ], + "text/plain": [ + " start_time window_trigger ... lolbas_counter timestamp\n", + "0 2020-09-24 17:10:00 1600967399999 ... 7 2020-09-24 17:10:00\n", + "1 2020-09-24 17:45:00 1600969499999 ... 9 2020-09-24 17:45:00\n", + "2 2020-09-24 17:55:00 1600970099999 ... 9 2020-09-24 17:55:00\n", + "3 2020-09-24 18:00:00 1600970399999 ... 9 2020-09-24 18:00:00\n", + "4 2020-09-24 22:20:00 1600985999999 ... 5 2020-09-24 22:20:00\n", + "5 2020-09-24 23:30:00 1600990199999 ... 5 2020-09-24 23:30:00\n", + "6 2020-09-25 14:25:00 1601043899999 ... 12 2020-09-25 14:25:00\n", + "7 2020-09-26 05:05:00 1601096699999 ... 38 2020-09-26 05:05:00\n", + "\n", + "[8 rows x 11 columns]" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 3, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", + "| select from_json_object(value) as input_event\n", + "| eval timestamp=ucast(map_get(input_event, \"_time\"), \"long\", null)\n", + " | eval device=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null),\n", + " process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null))\n", + " | where process_name==\"regsvcs.exe\" OR process_name==\"ftp.exe\" OR process_name==\"dfsvc.exe\" OR process_name==\"rasautou.exe\" OR process_name==\"schtasks.exe\" OR process_name==\"xwizard.exe\" OR process_name==\"findstr.exe\" OR process_name==\"esentutl.exe\" OR process_name==\"cscript.exe\" OR process_name==\"reg.exe\" OR process_name==\"csc.exe\" OR process_name==\"atbroker.exe\" OR process_name==\"print.exe\" OR process_name==\"pcwrun.exe\" OR process_name==\"vbc.exe\" OR process_name==\"rpcping.exe\" OR process_name==\"wsreset.exe\" OR process_name==\"ilasm.exe\" OR process_name==\"certutil.exe\" OR process_name==\"replace.exe\" OR process_name==\"mshta.exe\" OR process_name==\"bitsadmin.exe\" OR process_name==\"wscript.exe\" OR process_name==\"ieexec.exe\" OR process_name==\"cmd.exe\" OR process_name==\"microsoft.workflow.compiler.exe\" OR process_name==\"runscripthelper.exe\" OR process_name==\"makecab.exe\" OR process_name==\"forfiles.exe\" OR process_name==\"desktopimgdownldr.exe\" OR process_name==\"control.exe\" OR process_name==\"msbuild.exe\" OR process_name==\"register-cimprovider.exe\" OR process_name==\"tttracer.exe\" OR process_name==\"ie4uinit.exe\" OR process_name==\"sc.exe\" OR process_name==\"bash.exe\" OR process_name==\"hh.exe\" OR process_name==\"cmstp.exe\" OR process_name==\"mmc.exe\" OR process_name==\"jsc.exe\" OR process_name==\"scriptrunner.exe\" OR process_name==\"odbcconf.exe\" OR process_name==\"extexport.exe\" OR process_name==\"msdt.exe\" OR process_name==\"diskshadow.exe\" OR process_name==\"extrac32.exe\" OR process_name==\"eventvwr.exe\" OR process_name==\"mavinject.exe\" OR process_name==\"regasm.exe\" OR process_name==\"gpscript.exe\" OR process_name==\"rundll32.exe\" OR process_name==\"regsvr32.exe\" OR process_name==\"regedit.exe\" OR process_name==\"msiexec.exe\" OR process_name==\"gfxdownloadwrapper.exe\" OR process_name==\"presentationhost.exe\" OR process_name==\"regini.exe\" OR process_name==\"wmic.exe\" OR process_name==\"runonce.exe\" OR process_name==\"syncappvpublishingserver.exe\" OR process_name==\"verclsid.exe\" OR process_name==\"psr.exe\" OR process_name==\"infdefaultinstall.exe\" OR process_name==\"explorer.exe\" OR process_name==\"expand.exe\" OR process_name==\"installutil.exe\" OR process_name==\"netsh.exe\" OR process_name==\"wab.exe\" OR process_name==\"dnscmd.exe\" OR process_name==\"at.exe\" OR process_name==\"pcalua.exe\" OR process_name==\"cmdkey.exe\" OR process_name==\"msconfig.exe\" \n", + " | stats count(process_name) as lolbas_counter by device,span(timestamp, 300s) \n", + " | eval lolbas_counter=lolbas_counter*1.0\n", + " | rename window_end as timestamp\n", + " | adaptive_threshold algorithm=\"quantile\" value=\"lolbas_counter\" entity=\"device\" window=2419200000L\n", + " | where label AND quantile>0.99 \n", + " | eval start_time = timestamp, end_time = timestamp, entities = mvappend(device), body = \"TBD\";" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "SPL2", + "language": "SPL", + "name": "spl2" + }, + "language_info": { + "mimetype": "text/spl", + "name": "SPL" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +} From 8d0129e1fefde247b162035894d080f2f9e07d7e Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2020 14:13:37 +0000 Subject: [PATCH 12/42] Bump pycparser from 2.19 to 2.20 Bumps [pycparser](https://github.com/eliben/pycparser) from 2.19 to 2.20. - [Release notes](https://github.com/eliben/pycparser/releases) - [Changelog](https://github.com/eliben/pycparser/blob/master/CHANGES) - [Commits](https://github.com/eliben/pycparser/compare/release_v2.19...release_v2.20) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index ac99ead5f6..3d435ffa51 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -45,7 +45,7 @@ protobuf==3.6.1 psutil==5.7.2 ptyprocess==0.6.0 py==1.8.1 -pycparser==2.19 +pycparser==2.20 PyGithub==1.51 PyJWT==1.7.1 PyNaCl==1.4.0 From bfc0db070e55a3ea5c6351527a3bcecfa0577df4 Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2020 14:19:57 +0000 Subject: [PATCH 13/42] Bump protobuf from 3.6.1 to 3.13.0 Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 3.6.1 to 3.13.0. - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Changelog](https://github.com/protocolbuffers/protobuf/blob/master/generate_changelog.py) - [Commits](https://github.com/protocolbuffers/protobuf/compare/v3.6.1...v3.13.0) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 3d435ffa51..20def7fcc8 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -41,7 +41,7 @@ path.py==12.5.0 pexpect==4.7.0 pluggy==0.13.1 pre-commit==1.21.0 -protobuf==3.6.1 +protobuf==3.13.0 psutil==5.7.2 ptyprocess==0.6.0 py==1.8.1 From 753974645ee9eee3a62513938081ddbc9c69cdb2 Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2020 14:25:02 +0000 Subject: [PATCH 14/42] Bump pytest from 5.3.2 to 6.1.1 Bumps [pytest](https://github.com/pytest-dev/pytest) from 5.3.2 to 6.1.1. - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/master/CHANGELOG.rst) - [Commits](https://github.com/pytest-dev/pytest/compare/5.3.2...6.1.1) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 20def7fcc8..2bcaff38c5 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -50,7 +50,7 @@ PyGithub==1.51 PyJWT==1.7.1 PyNaCl==1.4.0 pyparsing==2.4.6 -pytest==5.3.2 +pytest==6.1.1 python-daemon==2.2.4 python-dateutil==2.8.1 python-terraform==0.10.1 From 240b50f7c64db05a209d2d0acb6520fc4a7f35cf Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2020 14:30:07 +0000 Subject: [PATCH 15/42] Bump pygithub from 1.51 to 1.53 Bumps [pygithub](https://github.com/PyGithub/PyGithub) from 1.51 to 1.53. - [Release notes](https://github.com/PyGithub/PyGithub/releases) - [Commits](https://github.com/PyGithub/PyGithub/compare/v1.51...v1.53) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 2bcaff38c5..b97639c080 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -46,7 +46,7 @@ psutil==5.7.2 ptyprocess==0.6.0 py==1.8.1 pycparser==2.20 -PyGithub==1.51 +PyGithub==1.53 PyJWT==1.7.1 PyNaCl==1.4.0 pyparsing==2.4.6 From 7a2476823c5fa13f810ee43cc758c2e96c62fdac Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2020 14:35:01 +0000 Subject: [PATCH 16/42] Bump py from 1.8.1 to 1.9.0 Bumps [py](https://github.com/pytest-dev/py) from 1.8.1 to 1.9.0. - [Release notes](https://github.com/pytest-dev/py/releases) - [Changelog](https://github.com/pytest-dev/py/blob/master/CHANGELOG.rst) - [Commits](https://github.com/pytest-dev/py/compare/1.8.1...1.9.0) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index b97639c080..05a10f3f2c 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -44,7 +44,7 @@ pre-commit==1.21.0 protobuf==3.13.0 psutil==5.7.2 ptyprocess==0.6.0 -py==1.8.1 +py==1.9.0 pycparser==2.20 PyGithub==1.53 PyJWT==1.7.1 From 3a1981a24c80eb74430b25ab04538964dd33059a Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2020 14:39:36 +0000 Subject: [PATCH 17/42] Bump bcrypt from 3.1.7 to 3.2.0 Bumps [bcrypt](https://github.com/pyca/bcrypt) from 3.1.7 to 3.2.0. - [Release notes](https://github.com/pyca/bcrypt/releases) - [Changelog](https://github.com/pyca/bcrypt/blob/master/release.py) - [Commits](https://github.com/pyca/bcrypt/compare/3.1.7...3.2.0) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 05a10f3f2c..81f6d6d863 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -5,7 +5,7 @@ aspy.yaml==1.3.0 atomicwrites==1.4.0 attackcti==0.3.3 attrs==19.3.0 -bcrypt==3.1.7 +bcrypt==3.2.0 boto3==1.15.17 botocore==1.18.17 certifi==2019.11.28 From bac818aa864f361c1d4e48722887685ac03385fd Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2020 14:44:45 +0000 Subject: [PATCH 18/42] Bump path from 13.1.0 to 15.0.0 Bumps [path](https://github.com/jaraco/path) from 13.1.0 to 15.0.0. - [Release notes](https://github.com/jaraco/path/releases) - [Changelog](https://github.com/jaraco/path/blob/master/CHANGES.rst) - [Commits](https://github.com/jaraco/path/compare/v13.1.0...v15.0.0) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 81f6d6d863..a2a0e821bb 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -36,7 +36,7 @@ ntlm-auth==1.4.0 packaging==19.2 packer.py==0.3.0 paramiko==2.7.2 -path==13.1.0 +path==15.0.0 path.py==12.5.0 pexpect==4.7.0 pluggy==0.13.1 From d9ab4d64645fa622053dd0371afccc6577266bdd Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2020 14:50:17 +0000 Subject: [PATCH 19/42] Bump ntlm-auth from 1.4.0 to 1.5.0 Bumps [ntlm-auth](https://github.com/jborean93/ntlm-auth) from 1.4.0 to 1.5.0. - [Release notes](https://github.com/jborean93/ntlm-auth/releases) - [Changelog](https://github.com/jborean93/ntlm-auth/blob/master/CHANGES.md) - [Commits](https://github.com/jborean93/ntlm-auth/compare/v1.4.0...v1.5.0) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index a2a0e821bb..eeeee80979 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -32,7 +32,7 @@ mock==3.0.5 more-itertools==8.0.2 mysql-connector-python==8.0.19 nodeenv==1.3.4 -ntlm-auth==1.4.0 +ntlm-auth==1.5.0 packaging==19.2 packer.py==0.3.0 paramiko==2.7.2 From 09cb8120bb085be8c8f602c8a37defbfd3e711de Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2020 14:55:07 +0000 Subject: [PATCH 20/42] Bump mysql-connector-python from 8.0.19 to 8.0.21 Bumps [mysql-connector-python](http://dev.mysql.com/doc/connector-python/en/index.html) from 8.0.19 to 8.0.21. Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index eeeee80979..abea43f1df 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -30,7 +30,7 @@ lockfile==0.12.2 MarkupSafe==1.1.1 mock==3.0.5 more-itertools==8.0.2 -mysql-connector-python==8.0.19 +mysql-connector-python==8.0.21 nodeenv==1.3.4 ntlm-auth==1.5.0 packaging==19.2 From 17efc12d0fea5e17b92236abfdba4feb0bc77a1f Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2020 15:00:21 +0000 Subject: [PATCH 21/42] Bump mock from 3.0.5 to 4.0.2 Bumps [mock](https://github.com/testing-cabal/mock) from 3.0.5 to 4.0.2. - [Release notes](https://github.com/testing-cabal/mock/releases) - [Changelog](https://github.com/testing-cabal/mock/blob/master/CHANGELOG.rst) - [Commits](https://github.com/testing-cabal/mock/compare/3.0.5...4.0.2) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index abea43f1df..471f0ff400 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -28,7 +28,7 @@ Jinja2==2.10.3 jmespath==0.9.4 lockfile==0.12.2 MarkupSafe==1.1.1 -mock==3.0.5 +mock==4.0.2 more-itertools==8.0.2 mysql-connector-python==8.0.21 nodeenv==1.3.4 From cf2294a9d0b3ae07e05e2154a7cf38b41b1e18da Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2020 19:31:54 +0000 Subject: [PATCH 22/42] Bump boto3 from 1.15.17 to 1.15.18 Bumps [boto3](https://github.com/boto/boto3) from 1.15.17 to 1.15.18. - [Release notes](https://github.com/boto/boto3/releases) - [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/boto3/compare/1.15.17...1.15.18) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 471f0ff400..a9d9b63383 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -6,7 +6,7 @@ atomicwrites==1.4.0 attackcti==0.3.3 attrs==19.3.0 bcrypt==3.2.0 -boto3==1.15.17 +boto3==1.15.18 botocore==1.18.17 certifi==2019.11.28 cffi==1.13.2 From b990631363599b9b5143d334ad5a21933d72609e Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2020 19:39:08 +0000 Subject: [PATCH 23/42] Bump botocore from 1.18.17 to 1.18.18 Bumps [botocore](https://github.com/boto/botocore) from 1.18.17 to 1.18.18. - [Release notes](https://github.com/boto/botocore/releases) - [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/botocore/compare/1.18.17...1.18.18) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index a9d9b63383..96b4b81c70 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -7,7 +7,7 @@ attackcti==0.3.3 attrs==19.3.0 bcrypt==3.2.0 boto3==1.15.18 -botocore==1.18.17 +botocore==1.18.18 certifi==2019.11.28 cffi==1.13.2 cfgv==2.0.1 From 3f8b95f6cd325529970058d3eaf431847b6a4afe Mon Sep 17 00:00:00 2001 From: Ignacio Bermudez Corrales Date: Fri, 16 Oct 2020 12:45:14 -0700 Subject: [PATCH 24/42] adding tests per detection --- tests/application/.gitkeep | 0 .../detect_phishing_content___ssa.test.yml} | 0 tests/cloud/.gitkeep | 0 tests/endpoint/.gitkeep | 0 ...ntial_dump_from_registry_via_reg_exe___ssa.test.yml | 10 ++++++++++ ...tect_dump_lsass_memory_using_comsvcs___ssa.test.yml | 10 ++++++++++ ...t_prohibited_applications_spawning_cmd_exe.test.yml | 10 ++++++++++ tests/endpoint/first_time_seen_cmd_line___ssa.test.yml | 10 ++++++++++ .../prohibited_apps_spawning_cmdprompt___ssa.test.yml | 10 ++++++++++ ..._parent_process_relationship_lolbas___ssa.test.yaml | 10 ++++++++++ ..._process_running_unexpected_location___ssa.test.yml | 10 ++++++++++ ...usual_lolbas_in_short_period_of_time___ssa.test.yml | 10 ++++++++++ .../unusually_long_command_line___ssa.test.yml | 10 ++++++++++ tests/network/.gitkeep | 0 tests/web/.gitkeep | 0 15 files changed, 90 insertions(+) create mode 100644 tests/application/.gitkeep rename tests/{unit_detect_prohibited_applications_spawning_cmd_exe.yml => application/detect_phishing_content___ssa.test.yml} (100%) create mode 100644 tests/cloud/.gitkeep create mode 100644 tests/endpoint/.gitkeep create mode 100644 tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml create mode 100644 tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml create mode 100644 tests/endpoint/detect_prohibited_applications_spawning_cmd_exe.test.yml create mode 100644 tests/endpoint/first_time_seen_cmd_line___ssa.test.yml create mode 100644 tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml create mode 100644 tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml create mode 100644 tests/endpoint/system_process_running_unexpected_location___ssa.test.yml create mode 100644 tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml create mode 100644 tests/endpoint/unusually_long_command_line___ssa.test.yml create mode 100644 tests/network/.gitkeep create mode 100644 tests/web/.gitkeep diff --git a/tests/application/.gitkeep b/tests/application/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/tests/unit_detect_prohibited_applications_spawning_cmd_exe.yml b/tests/application/detect_phishing_content___ssa.test.yml similarity index 100% rename from tests/unit_detect_prohibited_applications_spawning_cmd_exe.yml rename to tests/application/detect_phishing_content___ssa.test.yml diff --git a/tests/cloud/.gitkeep b/tests/cloud/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/tests/endpoint/.gitkeep b/tests/endpoint/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml b/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml new file mode 100644 index 0000000000..937c7fa094 --- /dev/null +++ b/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml @@ -0,0 +1,10 @@ +name: Detect Prohibited Applications Spawning cmd exe Unit Test +detections: + - name: Access LSASS Memory for Dump Creation + file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test credential dumping detections +attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + diff --git a/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml b/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml new file mode 100644 index 0000000000..937c7fa094 --- /dev/null +++ b/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml @@ -0,0 +1,10 @@ +name: Detect Prohibited Applications Spawning cmd exe Unit Test +detections: + - name: Access LSASS Memory for Dump Creation + file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test credential dumping detections +attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + diff --git a/tests/endpoint/detect_prohibited_applications_spawning_cmd_exe.test.yml b/tests/endpoint/detect_prohibited_applications_spawning_cmd_exe.test.yml new file mode 100644 index 0000000000..937c7fa094 --- /dev/null +++ b/tests/endpoint/detect_prohibited_applications_spawning_cmd_exe.test.yml @@ -0,0 +1,10 @@ +name: Detect Prohibited Applications Spawning cmd exe Unit Test +detections: + - name: Access LSASS Memory for Dump Creation + file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test credential dumping detections +attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + diff --git a/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml b/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml new file mode 100644 index 0000000000..937c7fa094 --- /dev/null +++ b/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml @@ -0,0 +1,10 @@ +name: Detect Prohibited Applications Spawning cmd exe Unit Test +detections: + - name: Access LSASS Memory for Dump Creation + file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test credential dumping detections +attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + diff --git a/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml b/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml new file mode 100644 index 0000000000..937c7fa094 --- /dev/null +++ b/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml @@ -0,0 +1,10 @@ +name: Detect Prohibited Applications Spawning cmd exe Unit Test +detections: + - name: Access LSASS Memory for Dump Creation + file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test credential dumping detections +attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + diff --git a/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml b/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml new file mode 100644 index 0000000000..937c7fa094 --- /dev/null +++ b/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml @@ -0,0 +1,10 @@ +name: Detect Prohibited Applications Spawning cmd exe Unit Test +detections: + - name: Access LSASS Memory for Dump Creation + file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test credential dumping detections +attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + diff --git a/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml b/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml new file mode 100644 index 0000000000..937c7fa094 --- /dev/null +++ b/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml @@ -0,0 +1,10 @@ +name: Detect Prohibited Applications Spawning cmd exe Unit Test +detections: + - name: Access LSASS Memory for Dump Creation + file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test credential dumping detections +attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + diff --git a/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml b/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml new file mode 100644 index 0000000000..937c7fa094 --- /dev/null +++ b/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml @@ -0,0 +1,10 @@ +name: Detect Prohibited Applications Spawning cmd exe Unit Test +detections: + - name: Access LSASS Memory for Dump Creation + file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test credential dumping detections +attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + diff --git a/tests/endpoint/unusually_long_command_line___ssa.test.yml b/tests/endpoint/unusually_long_command_line___ssa.test.yml new file mode 100644 index 0000000000..937c7fa094 --- /dev/null +++ b/tests/endpoint/unusually_long_command_line___ssa.test.yml @@ -0,0 +1,10 @@ +name: Detect Prohibited Applications Spawning cmd exe Unit Test +detections: + - name: Access LSASS Memory for Dump Creation + file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test credential dumping detections +attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + diff --git a/tests/network/.gitkeep b/tests/network/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/tests/web/.gitkeep b/tests/web/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 From ebb0554ceadb811f5b1628cbb36c1b7f9b0ad8a5 Mon Sep 17 00:00:00 2001 From: Ignacio Bermudez Corrales Date: Fri, 16 Oct 2020 14:08:23 -0700 Subject: [PATCH 25/42] test files for ssa detections --- .../detect_phishing_content___ssa.test.yml | 12 ++++++------ ...al_dump_from_registry_via_reg_exe___ssa.test.yml | 10 +++++----- ...t_dump_lsass_memory_using_comsvcs___ssa.test.yml | 10 +++++----- .../first_time_seen_cmd_line___ssa.test.yml | 13 ++++++------- ...rohibited_apps_spawning_cmdprompt___ssa.test.yml | 7 +++---- ...rent_process_relationship_lolbas___ssa.test.yaml | 10 +++++----- ...ocess_running_unexpected_location___ssa.test.yml | 11 ++++------- ...al_lolbas_in_short_period_of_time___ssa.test.yml | 13 ++++++------- .../unusually_long_command_line___ssa.test.yml | 12 ++++++------ 9 files changed, 46 insertions(+), 52 deletions(-) diff --git a/tests/application/detect_phishing_content___ssa.test.yml b/tests/application/detect_phishing_content___ssa.test.yml index 937c7fa094..511fa8a8b1 100644 --- a/tests/application/detect_phishing_content___ssa.test.yml +++ b/tests/application/detect_phishing_content___ssa.test.yml @@ -1,10 +1,10 @@ -name: Detect Prohibited Applications Spawning cmd exe Unit Test +name: Phishing Email Detection by Machine Learning Method - SSA Unit Test detections: - - name: Access LSASS Memory for Dump Creation - file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + - name: Phishing Email Detection by Machine Learning Method + file: application/detect_phishing_content___ssa.yml pass_condition: '| stats count | where count > 0' -description: Test credential dumping detections +description: Test phishing emails using NLP attack_data: - - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + - file_name: detect_phishing_content.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/detect_phishing_content.json diff --git a/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml b/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml index 937c7fa094..fce0718baf 100644 --- a/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml +++ b/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml @@ -1,10 +1,10 @@ -name: Detect Prohibited Applications Spawning cmd exe Unit Test +name: Attempted Credential Dump From Registry via Reg exe - SSA Unit test detections: - - name: Access LSASS Memory for Dump Creation - file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + - name: Attempted Credential Dump From Registry via Reg exe + file: endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml pass_condition: '| stats count | where count > 0' description: Test credential dumping detections attack_data: - - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + - file_name: windows-security_ssa.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.002/windows-security_ssa.log diff --git a/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml b/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml index 937c7fa094..95ddd4384f 100644 --- a/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml +++ b/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml @@ -1,10 +1,10 @@ -name: Detect Prohibited Applications Spawning cmd exe Unit Test +name: Detect Dump LSASS Memory using comsvcs - SSA Unit Test detections: - - name: Access LSASS Memory for Dump Creation - file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + - name: Detect Dump LSASS Memory using comsvcs + file: endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml pass_condition: '| stats count | where count > 0' description: Test credential dumping detections attack_data: - - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + - file_name: windows-security-events_ssa.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-security-events_ssa.log diff --git a/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml b/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml index 937c7fa094..a190d5ae34 100644 --- a/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml +++ b/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml @@ -1,10 +1,9 @@ -name: Detect Prohibited Applications Spawning cmd exe Unit Test +name: First time seen command line argument - SSA Unit Test detections: - - name: Access LSASS Memory for Dump Creation - file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + - name: First time seen command line argument + file: endpoint/first_time_seen_cmd_line___ssa.yml pass_condition: '| stats count | where count > 0' -description: Test credential dumping detections +description: Test detection of first time seen command attack_data: - - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json - + - file_name: first_time_seen_commandline.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/first_time_seen_commandline.json diff --git a/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml b/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml index 937c7fa094..42ef49eb05 100644 --- a/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml +++ b/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml @@ -1,10 +1,9 @@ -name: Detect Prohibited Applications Spawning cmd exe Unit Test +name: Detect Prohibited Applications Spawning cmd exe - SSA detections: - - name: Access LSASS Memory for Dump Creation + - name: Detect Prohibited Applications Spawning cmd exe file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml pass_condition: '| stats count | where count > 0' -description: Test credential dumping detections +description: Test prohibited apps spawning cmd.exe attack_data: - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json - diff --git a/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml b/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml index 937c7fa094..88fe455fc8 100644 --- a/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml +++ b/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml @@ -1,10 +1,10 @@ -name: Detect Prohibited Applications Spawning cmd exe Unit Test +name: Rare Parent/Child Process Relationship - SSA Unit Test detections: - name: Access LSASS Memory for Dump Creation - file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + file: endpoint/rare_parent_process_relationship_lolbas___ssa.yaml pass_condition: '| stats count | where count > 0' -description: Test credential dumping detections +description: Test detection looking for LOLBAS processes spawned by other processes that are rarely seen together attack_data: - - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + - file_name: T1059.all.labeled.lolbas-test.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json diff --git a/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml b/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml index 937c7fa094..821ae821d0 100644 --- a/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml +++ b/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml @@ -1,10 +1,7 @@ -name: Detect Prohibited Applications Spawning cmd exe Unit Test +name: System Process Running from Unexpected Location - SSA Unit Test detections: - - name: Access LSASS Memory for Dump Creation - file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + - name: System Process Running from Unexpected Location - SSA + file: endpoint/system_process_running_unexpected_location___ssa.yml pass_condition: '| stats count | where count > 0' -description: Test credential dumping detections +description: Test process running from other locations attack_data: - - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json - diff --git a/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml b/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml index 937c7fa094..941debefa8 100644 --- a/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml +++ b/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml @@ -1,10 +1,9 @@ -name: Detect Prohibited Applications Spawning cmd exe Unit Test +name: More than usual number of LOLBAS applications in short time period - SSA Unit Test detections: - - name: Access LSASS Memory for Dump Creation - file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + - name: More than usual number of LOLBAS applications in short time period + file: endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml pass_condition: '| stats count | where count > 0' -description: Test credential dumping detections +description: Test more than usual lolbas being executed in a short period of time attack_data: - - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json - + - file_name: T1059.all.labeled.lolbas-test.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json diff --git a/tests/endpoint/unusually_long_command_line___ssa.test.yml b/tests/endpoint/unusually_long_command_line___ssa.test.yml index 937c7fa094..015617b043 100644 --- a/tests/endpoint/unusually_long_command_line___ssa.test.yml +++ b/tests/endpoint/unusually_long_command_line___ssa.test.yml @@ -1,10 +1,10 @@ -name: Detect Prohibited Applications Spawning cmd exe Unit Test +name: Unusually Long Command Line - SSA Unit Test detections: - - name: Access LSASS Memory for Dump Creation - file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + - name: Unusually Long Command Line + file: endpoint/unusually_long_command_line___ssa.yml pass_condition: '| stats count | where count > 0' -description: Test credential dumping detections +description: Test unusually long command lines attack_data: - - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + - file_name: unusual_commandline.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_commandline.json From 7a9be3fa01e83e93a5aeced0b0e9cfda8a627065 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Fri, 16 Oct 2020 15:34:26 -0700 Subject: [PATCH 26/42] add --- notebooks/phishing_detection_unit_test.ipynb | 62 ++++++++++---------- 1 file changed, 32 insertions(+), 30 deletions(-) diff --git a/notebooks/phishing_detection_unit_test.ipynb b/notebooks/phishing_detection_unit_test.ipynb index d4688dd83b..6f41cee946 100644 --- a/notebooks/phishing_detection_unit_test.ipynb +++ b/notebooks/phishing_detection_unit_test.ipynb @@ -12,11 +12,11 @@ "execution_count": 1, "metadata": { "execution": { - "iopub.execute_input": "2020-10-15T07:17:42.569781Z", - "iopub.status.busy": "2020-10-15T07:17:42.569484Z", - "iopub.status.idle": "2020-10-15T07:17:43.335803Z", - "shell.execute_reply": "2020-10-15T07:17:43.335057Z", - "shell.execute_reply.started": "2020-10-15T07:17:42.569756Z" + "iopub.execute_input": "2020-10-16T22:23:22.484428Z", + "iopub.status.busy": "2020-10-16T22:23:22.484097Z", + "iopub.status.idle": "2020-10-16T22:23:23.007578Z", + "shell.execute_reply": "2020-10-16T22:23:23.006978Z", + "shell.execute_reply.started": "2020-10-16T22:23:22.484401Z" } }, "outputs": [], @@ -31,7 +31,7 @@ "cell_type": "markdown", "metadata": {}, "source": [ - "## Extract first 5 records from the test dataset as unit test data" + "## Extract first 10 records from the test dataset as unit test data" ] }, { @@ -39,11 +39,11 @@ "execution_count": 2, "metadata": { "execution": { - "iopub.execute_input": "2020-10-15T07:17:43.337196Z", - "iopub.status.busy": "2020-10-15T07:17:43.336970Z", - "iopub.status.idle": "2020-10-15T07:17:44.064803Z", - "shell.execute_reply": "2020-10-15T07:17:44.063792Z", - "shell.execute_reply.started": "2020-10-15T07:17:43.337174Z" + "iopub.execute_input": "2020-10-16T22:23:35.177805Z", + "iopub.status.busy": "2020-10-16T22:23:35.177535Z", + "iopub.status.idle": "2020-10-16T22:23:35.800940Z", + "shell.execute_reply": "2020-10-16T22:23:35.800336Z", + "shell.execute_reply.started": "2020-10-16T22:23:35.177783Z" } }, "outputs": [ @@ -61,8 +61,10 @@ } ], "source": [ - "df = pd.read_json('s3://smle-experiments/datasets/phishing_email/splunk_test.json', lines=True)[0:5]\n", - "df.to_json('./unit_test.json', orient='records', lines=True)" + "df = pd.read_json('s3://smle-experiments/datasets/phishing_email/splunk_test.json', lines=True)[0:10]\n", + "t = [i for i in range(10)]\n", + "df['_time'] = t\n", + "df.to_json('./detect_phishing_content.json', orient='records', lines=True)" ] }, { @@ -77,18 +79,18 @@ "execution_count": 3, "metadata": { "execution": { - "iopub.execute_input": "2020-10-15T07:17:44.066646Z", - "iopub.status.busy": "2020-10-15T07:17:44.066415Z", - "iopub.status.idle": "2020-10-15T07:17:46.305894Z", - "shell.execute_reply": "2020-10-15T07:17:46.305280Z", - "shell.execute_reply.started": "2020-10-15T07:17:44.066619Z" + "iopub.execute_input": "2020-10-16T22:26:41.231248Z", + "iopub.status.busy": "2020-10-16T22:26:41.230973Z", + "iopub.status.idle": "2020-10-16T22:26:56.882252Z", + "shell.execute_reply": "2020-10-16T22:26:56.881749Z", + "shell.execute_reply.started": "2020-10-16T22:26:41.231226Z" } }, "outputs": [ { "data": { "application/vnd.jupyter.widget-view+json": { - "model_id": "bf31331e58194b6898384ea23b7271ae", + "model_id": "39a07cbd58e74860aa67307b52b6df3c", "version_major": 2, "version_minor": 0 }, @@ -141,12 +143,12 @@ " \n", " \n", " 0\n", - " 2002-03-14 14:34:48-08:00\n", + " 4\n", " True\n", " TBD\n", " Dear friend.I know that this letter may come t...\n", " 0.999971\n", - " 2002-03-14 14:34:48-08:00\n", + " 4\n", " henry kabore <henry_kabore_10@hotmail.fr>\n", " TBD\n", " This is from Mr Henry Kabore\n", @@ -156,14 +158,14 @@ "" ], "text/plain": [ - " start_time isPhishing entities \\\n", - "0 2002-03-14 14:34:48-08:00 True TBD \n", + " start_time isPhishing entities \\\n", + "0 4 True TBD \n", "\n", - " Content probability \\\n", - "0 Dear friend.I know that this letter may come t... 0.999971 \n", + " Content probability end_time \\\n", + "0 Dear friend.I know that this letter may come t... 0.999971 4 \n", "\n", - " end_time From body \\\n", - "0 2002-03-14 14:34:48-08:00 henry kabore TBD \n", + " From body \\\n", + "0 henry kabore TBD \n", "\n", " Subject \n", "0 This is from Mr Henry Kabore " @@ -182,7 +184,7 @@ { "data": { "text/plain": [ - "" + "" ] }, "execution_count": 3, @@ -192,7 +194,7 @@ ], "source": [ "%%spl2\n", - "| from read_json(\"s3://smle-experiments/datasets/phishing_email/unit_test.json\")\n", + "| from read_json(\"s3://smle-experiments/datasets/phishing_email/detect_phishing_content.json\")\n", "| eval eventLine=concat(From, \" \", Subject, \" \", Content, \" \", \" \")\n", "| eval mapC = {\" \":32,\"!\":33,\"\\\"\":34,\"#\":35,\"$$\":36,\"%\":37,\"&\":38,\"'\":39,\"(\":40,\")\":41,\"*\":42,\"+\":43,\",\":44,\"-\":45,\".\":46,\"/\":47,\"0\":48,\"1\":49,\"2\":50,\"3\":51,\"4\":52,\"5\":53,\"6\":54,\"7\":55,\"8\":56,\"9\":57,\":\":58,\";\":59,\"<\":60,\"=\":61,\">\":62,\"?\":63,\"@\":64,\"A\":65,\"B\":66,\"C\":67,\"D\":68,\"E\":69,\"F\":70,\"G\":71,\"H\":72,\"I\":73,\"J\":74,\"K\":75,\"L\":76,\"M\":77,\"N\":78,\"O\":79,\"P\":80,\"Q\":81,\"R\":82,\"S\":83,\"T\":84,\"U\":85,\"V\":86,\"W\":87,\"X\":88,\"Y\":89,\"Z\":90,\"[\":91,\"\\\\\":92,\"]\":93,\"^\":94,\"_\":95,\"`\":96,\"a\":97,\"b\":98,\"c\":99,\"d\":100,\"e\":101,\"f\":102,\"g\":103,\"h\":104,\"i\":105,\"j\":106,\"k\":107,\"l\":108,\"m\":109,\"n\":110,\"o\":111,\"p\":112,\"q\":113,\"r\":114,\"s\":115,\"t\":116,\"u\":117,\"v\":118,\"w\":119,\"x\":120,\"y\":121,\"z\":122,\"{\":123,\"|\":124,\"}\":125,\"~\":126}\n", "| eval 'embedding_input:0' = for_each(\n", @@ -201,7 +203,7 @@ "| apply_model connection_id=\"\" path=\"s3://smle-experiments/models/xlin/phishing_email\" name=\"phishing_email_v7\" \n", "| eval probability = mvindex('dense/Sigmoid:0', 0) \n", "| where probability > 0.5\n", - "| eval start_time = Date, end_time = Date, entities = \"TBD\", body = \"TBD\"\n", + "| eval start_time = _time, end_time = _time, entities = \"TBD\", body = \"TBD\"\n", "| select start_time, end_time, From, entities, body, Subject, Content, isPhishing, probability\n", ";" ] From c457ba1ce256d9d30772ff7afa627b1d1e7d17b2 Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Sun, 18 Oct 2020 22:23:18 -0700 Subject: [PATCH 27/42] We need to do 2 fixes here: 1) comma sign is also possible between "comsvcs.dll" "MiniDump" in execution of this attack as described in https://risksense.com/blog/hidden-gems-in-windows-the-hunt-is-on/ and https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz and our notebook https://confluence.splunk.com/display/~smiskovic/Test+Events+for+SSA+Detections#TestEventsforSSADetections-DumpingLSASSprocessmemory, and 2) referenced pdf does not contain this detection (will fix this later when I make my notebook public, so we do not need to refer any external companies) --- .../endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml b/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml index bf7333ff06..2b4b9452f3 100644 --- a/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml +++ b/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml @@ -16,7 +16,7 @@ process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) | where process_name LIKE "%rundll32.exe%" -AND match_regex(process, /(?i)comsvcs.dll MiniDump/)=true +AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine), From 6d76a4d268b5d42f8e24926e68475c7071ef3e6a Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Sun, 18 Oct 2020 22:46:39 -0700 Subject: [PATCH 28/42] Fix: 1) Adding both long and short name registry section names for Security, SAM and System 2) Adding a condition that command line marameter is not null (faster exit in case customer is not logging command lines) --- ...ntial_dump_from_registry_via_reg_exe___ssa.yml | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml index 98c7489a31..5debe42be2 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml @@ -17,12 +17,15 @@ search: ' dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) | where process_name="cmd.exe" OR process_name="reg.exe" -| where cmd_line LIKE "%save%" AND - (match_regex(cmd_line, /(?i)HKLM\\System/)=true OR - match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true - OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true - OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true - OR match_regex(cmd_line, /(?i)HKLM\\Security/)=true) +| where cmd_line != null AND + match_regex(cmd_line, /(?i)save\s+/)=true AND + ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR + match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR + match_regex(cmd_line, /(?i)HKLM\\System/)=true OR + match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR + match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR + match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true + ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), From 1daaefe1a3b238c5ab3ae20713896c9dbb82fe5f Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 14:14:08 +0000 Subject: [PATCH 29/42] Bump cryptography from 2.8 to 3.1.1 Bumps [cryptography](https://github.com/pyca/cryptography) from 2.8 to 3.1.1. - [Release notes](https://github.com/pyca/cryptography/releases) - [Changelog](https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/2.8...3.1.1) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 96b4b81c70..b6661cc935 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -14,7 +14,7 @@ cfgv==2.0.1 chardet==3.0.4 configparser==4.0.2 contextlib2==0.6.0.post1 -cryptography==2.8 +cryptography==3.1.1 Deprecated==1.2.10 dnspython==2.0.0 docutils==0.16 From 246fefb4b86834fdc4639b3adf46ae18fff33f6f Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 14:18:54 +0000 Subject: [PATCH 30/42] Bump splunk-sdk from 1.6.12 to 1.6.14 Bumps [splunk-sdk](https://github.com/splunk/splunk-sdk-python) from 1.6.12 to 1.6.14. - [Release notes](https://github.com/splunk/splunk-sdk-python/releases) - [Changelog](https://github.com/splunk/splunk-sdk-python/blob/master/CHANGELOG.md) - [Commits](https://github.com/splunk/splunk-sdk-python/compare/1.6.12...1.6.14) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index b6661cc935..ccb617dcb8 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -61,7 +61,7 @@ requests-ntlm==1.1.0 s3transfer==0.3.3 six==1.13.0 smmap==3.0.4 -splunk-sdk==1.6.12 +splunk-sdk==1.6.14 tabulate==0.8.6 termcolor==1.1.0 toml==0.10.0 From 734a24a595e0b7a6289bdb7dc32e333ce2a6623c Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 14:23:57 +0000 Subject: [PATCH 31/42] Bump pexpect from 4.7.0 to 4.8.0 Bumps [pexpect](https://github.com/pexpect/pexpect) from 4.7.0 to 4.8.0. - [Release notes](https://github.com/pexpect/pexpect/releases) - [Commits](https://github.com/pexpect/pexpect/compare/4.7.0...4.8.0) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index ccb617dcb8..85df135ba8 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -38,7 +38,7 @@ packer.py==0.3.0 paramiko==2.7.2 path==15.0.0 path.py==12.5.0 -pexpect==4.7.0 +pexpect==4.8.0 pluggy==0.13.1 pre-commit==1.21.0 protobuf==3.13.0 From 3a4260142607b245b733f74f6bf8a749f71a8ec4 Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 14:29:22 +0000 Subject: [PATCH 32/42] Bump cffi from 1.13.2 to 1.14.3 Bumps [cffi](https://github.com/python-cffi/release-doc) from 1.13.2 to 1.14.3. - [Release notes](https://github.com/python-cffi/release-doc/releases) - [Commits](https://github.com/python-cffi/release-doc/commits) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 85df135ba8..af2d6b0ab6 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -9,7 +9,7 @@ bcrypt==3.2.0 boto3==1.15.18 botocore==1.18.18 certifi==2019.11.28 -cffi==1.13.2 +cffi==1.14.3 cfgv==2.0.1 chardet==3.0.4 configparser==4.0.2 From 815ef336888b05d1be3fa90b627c2605bdbdf0f8 Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 14:35:03 +0000 Subject: [PATCH 33/42] Bump mysql-connector-python from 8.0.21 to 8.0.22 Bumps [mysql-connector-python](http://dev.mysql.com/doc/connector-python/en/index.html) from 8.0.21 to 8.0.22. Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index af2d6b0ab6..abfe262396 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -30,7 +30,7 @@ lockfile==0.12.2 MarkupSafe==1.1.1 mock==4.0.2 more-itertools==8.0.2 -mysql-connector-python==8.0.21 +mysql-connector-python==8.0.22 nodeenv==1.3.4 ntlm-auth==1.5.0 packaging==19.2 From 1f83645b6b164a2468521ac8ef8a8f41b36be51f Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 14:40:37 +0000 Subject: [PATCH 34/42] Bump tabulate from 0.8.6 to 0.8.7 Bumps [tabulate](https://github.com/astanin/python-tabulate) from 0.8.6 to 0.8.7. - [Release notes](https://github.com/astanin/python-tabulate/releases) - [Changelog](https://github.com/astanin/python-tabulate/blob/master/CHANGELOG) - [Commits](https://github.com/astanin/python-tabulate/compare/v0.8.6...v0.8.7) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index abfe262396..c7b57b4a5f 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -62,7 +62,7 @@ s3transfer==0.3.3 six==1.13.0 smmap==3.0.4 splunk-sdk==1.6.14 -tabulate==0.8.6 +tabulate==0.8.7 termcolor==1.1.0 toml==0.10.0 urllib3==1.25.7 From f8151f705fa676320c8fe5461f3d21aad59a470d Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 14:46:21 +0000 Subject: [PATCH 35/42] Bump packaging from 19.2 to 20.4 Bumps [packaging](https://github.com/pypa/packaging) from 19.2 to 20.4. - [Release notes](https://github.com/pypa/packaging/releases) - [Changelog](https://github.com/pypa/packaging/blob/master/CHANGELOG.rst) - [Commits](https://github.com/pypa/packaging/compare/19.2...20.4) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index c7b57b4a5f..618a9ae39b 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -33,7 +33,7 @@ more-itertools==8.0.2 mysql-connector-python==8.0.22 nodeenv==1.3.4 ntlm-auth==1.5.0 -packaging==19.2 +packaging==20.4 packer.py==0.3.0 paramiko==2.7.2 path==15.0.0 From fa3f0c2b99a5cdd8eee9017ec56aa1d670516380 Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 14:51:52 +0000 Subject: [PATCH 36/42] Bump urllib3 from 1.25.10 to 1.25.11 Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.25.10 to 1.25.11. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/master/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/1.25.10...1.25.11) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 618a9ae39b..555d7a434b 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -65,7 +65,7 @@ splunk-sdk==1.6.14 tabulate==0.8.7 termcolor==1.1.0 toml==0.10.0 -urllib3==1.25.7 +urllib3==1.25.11 virtualenv==16.7.9 wcwidth==0.2.5 wget==3.2 diff --git a/requirements.txt b/requirements.txt index 9851e7f402..97f434a9a9 100644 --- a/requirements.txt +++ b/requirements.txt @@ -37,6 +37,6 @@ stix2-patterns==1.3.1 taxii2-client==2.2.2 toml==0.10.1 typing==3.7.4.3 -urllib3==1.25.10 +urllib3==1.25.11 virtualenv==20.0.33 zipp==3.3.1 From f74eac4531e607118ab124fa03d98b467ce3a781 Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 14:57:23 +0000 Subject: [PATCH 37/42] Bump jmespath from 0.9.4 to 0.10.0 Bumps [jmespath](https://github.com/jmespath/jmespath.py) from 0.9.4 to 0.10.0. - [Release notes](https://github.com/jmespath/jmespath.py/releases) - [Changelog](https://github.com/jmespath/jmespath.py/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/jmespath/jmespath.py/compare/0.9.4...0.10.0) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 555d7a434b..c1ef217de8 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -25,7 +25,7 @@ identify==1.4.10 idna==2.8 importlib-metadata==1.3.0 Jinja2==2.10.3 -jmespath==0.9.4 +jmespath==0.10.0 lockfile==0.12.2 MarkupSafe==1.1.1 mock==4.0.2 From 7eb89f7e8366bf6ee5e8c4e29bac9f3f0ff42a73 Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 15:03:39 +0000 Subject: [PATCH 38/42] Bump ansible from 2.9.2 to 2.10.1 Bumps [ansible](https://github.com/ansible/ansible) from 2.9.2 to 2.10.1. - [Release notes](https://github.com/ansible/ansible/releases) - [Commits](https://github.com/ansible/ansible/compare/v2.9.2...v2.10.1) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index c1ef217de8..bc3134dcc5 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -1,4 +1,4 @@ -ansible==2.9.2 +ansible==2.10.1 ansible-runner==1.4.6 apipkg==1.5 aspy.yaml==1.3.0 From 988d12370448c954106567cab8d00caae7bb216b Mon Sep 17 00:00:00 2001 From: bpatel Date: Mon, 19 Oct 2020 10:10:09 -0700 Subject: [PATCH 39/42] reorg dir --- .../gcp_detect_accounts_with_high_risk_roles_by_project.yml | 0 detections/{ => cloud}/gcp_detect_gcploit_framework.yml | 0 .../gcp_detect_high_risk_permissions_by_resource_and_account.yml | 0 3 files changed, 0 insertions(+), 0 deletions(-) rename detections/{ => cloud}/gcp_detect_accounts_with_high_risk_roles_by_project.yml (100%) rename detections/{ => cloud}/gcp_detect_gcploit_framework.yml (100%) rename detections/{ => cloud}/gcp_detect_high_risk_permissions_by_resource_and_account.yml (100%) diff --git a/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml similarity index 100% rename from detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml rename to detections/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml diff --git a/detections/gcp_detect_gcploit_framework.yml b/detections/cloud/gcp_detect_gcploit_framework.yml similarity index 100% rename from detections/gcp_detect_gcploit_framework.yml rename to detections/cloud/gcp_detect_gcploit_framework.yml diff --git a/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml similarity index 100% rename from detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml rename to detections/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml From 56b06d22469f92178119102234338c33b913aef2 Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 18:04:13 +0000 Subject: [PATCH 40/42] Bump virtualenv from 20.0.33 to 20.0.35 Bumps [virtualenv](https://github.com/pypa/virtualenv) from 20.0.33 to 20.0.35. - [Release notes](https://github.com/pypa/virtualenv/releases) - [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst) - [Commits](https://github.com/pypa/virtualenv/compare/20.0.33...20.0.35) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index bc3134dcc5..3d6817a716 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -66,7 +66,7 @@ tabulate==0.8.7 termcolor==1.1.0 toml==0.10.0 urllib3==1.25.11 -virtualenv==16.7.9 +virtualenv==20.0.35 wcwidth==0.2.5 wget==3.2 wrapt==1.12.1 diff --git a/requirements.txt b/requirements.txt index 97f434a9a9..1e9791ee3b 100644 --- a/requirements.txt +++ b/requirements.txt @@ -38,5 +38,5 @@ taxii2-client==2.2.2 toml==0.10.1 typing==3.7.4.3 urllib3==1.25.11 -virtualenv==20.0.33 +virtualenv==20.0.35 zipp==3.3.1 From 45f1b31891c65caa9909e25b247a60568356e254 Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 19:31:16 +0000 Subject: [PATCH 41/42] Bump botocore from 1.18.18 to 1.19.0 Bumps [botocore](https://github.com/boto/botocore) from 1.18.18 to 1.19.0. - [Release notes](https://github.com/boto/botocore/releases) - [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/botocore/compare/1.18.18...1.19.0) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 3d6817a716..039b6538b9 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -7,7 +7,7 @@ attackcti==0.3.3 attrs==19.3.0 bcrypt==3.2.0 boto3==1.15.18 -botocore==1.18.18 +botocore==1.19.0 certifi==2019.11.28 cffi==1.14.3 cfgv==2.0.1 From 2fd0c55f4c341ba6e1d66e506c982bb4d1b360ff Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2020 19:37:04 +0000 Subject: [PATCH 42/42] Bump boto3 from 1.15.18 to 1.16.0 Bumps [boto3](https://github.com/boto/boto3) from 1.15.18 to 1.16.0. - [Release notes](https://github.com/boto/boto3/releases) - [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/boto3/compare/1.15.18...1.16.0) Signed-off-by: dependabot-preview[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 039b6538b9..c51102865c 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -6,7 +6,7 @@ atomicwrites==1.4.0 attackcti==0.3.3 attrs==19.3.0 bcrypt==3.2.0 -boto3==1.15.18 +boto3==1.16.0 botocore==1.19.0 certifi==2019.11.28 cffi==1.14.3