admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

bringing the branch upto date with develop

Browse Source
This commit is contained in:
bpatel
2019-05-17 11:50:36 -07:00
parent 824ed3f678 7483590c54
commit cb2c30de86
43 changed files with 1844 additions and 4446 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/auto_assign.yml
+11 -8
View File
@@ -6,24 +6,27 @@ addAssignees: true
# A list of reviewers to be added to pull requests (GitHub user name)
reviewers:
- d1vious
- rvaldez617
- patel-bhavin
- russnolen
- briannablacet
# A number of reviewers added to the pull request
# Set 0 to add all the reviewers (default: 0)
numberOfReviewers: 1
# A list of assignees, overrides reviewers if set
# assignees:
# - assigneeA
assignees:
- d1vious
- rvaldez617
- patel-bhavin
- russnolen
- rsfl
- jcbrewer5D6400
- philroyer-phantom
# A number of assignees to add to the pull request
# Set to 0 to add all of the assignees.
# Uses numberOfReviewers if unset.
# numberOfAssignees: 2
numberOfAssignees: 1
# A list of keywords to be skipped the process that add reviewers if pull requests include it
# skipKeywords:
# - wip
#
.github/config.yml
+15
View File
@@ -0,0 +1,15 @@
# Configuration for request-info - https://github.com/behaviorbot/request-info
# *Required* Comment to reply with
requestInfoReplyComment: >
We would appreciate it if you could provide us with more info about this issue/pr!
# *OPTIONAL* default titles to check against for lack of descriptiveness
# MUST BE ALL LOWERCASE
requestInfoDefaultTitles:
- update readme.md
- updates
# *OPTIONAL* Label to be added to Issues and Pull Requests with insufficient information given
requestInfoLabelToAdd: needs-more-info
.github/stale.yml
+17
View File
@@ -0,0 +1,17 @@
# Number of days of inactivity before an issue becomes stale
daysUntilStale: 60
# Number of days of inactivity before a stale issue is closed
daysUntilClose: 7
# Issues with these labels will never be considered stale
exemptLabels:
- pinned
- security
# Label to use when marking an issue as stale
staleLabel: wontfix
# Comment to post when marking an issue as stale. Set to `false` to disable
markComment: >
This issue has been automatically marked as stale because it has not had
recent activity. It will be closed if no further activity occurs. Thank you
for your contributions.
# Comment to post when closing a stale issue. Set to `false` to disable
closeComment: false
baselines/train_dns_query_length.json
+44
View File
@@ -0,0 +1,44 @@
{
"channel": "ESCU",
"creation_date": "2019-05-08",
"data_metadata": {
"data_models": [
"Network_Resolution"
],
"data_source": [
"DNS"
],
"providing_technologies": [
"Splunk Stream",
"Bro"
]
},
"eli5": "Create a machine-learning (ML) model to characterize the length of DNS requests seen in your environment to help identify unusually long ones that may be indicative of attacker infrastrucutre or the use of DNS as a command-and-control channel in your environment.",
"how_to_implement": "To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.",
"maintainers": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"modification_date": "2019-05-08",
"original_authors": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"scheduling": {
"earliest_time": "-31d@d",
"latest_time": "-1d@d"
},
"search": "| tstats `summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | `drop_dm_object_name(\"DNS\")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel",
"search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query.",
"search_id": "c914844c-0ff5-4efc-8d44-c063443129ba",
"search_name": "Baseline of DNS Query Length - MLTK",
"search_type": "support",
"spec_version": 1,
"version": "1.0"
}
baselines/train_smb_traffic_spike.json
+44
View File
@@ -0,0 +1,44 @@
{
"channel": "ESCU",
"creation_date": "2019-05-08",
"data_metadata": {
"data_models": [
"Network_Traffic"
],
"data_source": [
"Network Communications"
],
"providing_technologies": [
"Splunk Stream",
"Bro"
]
},
"eli5": "Create a machine-learning (ML) model to characterize the number of SMB connections observed in your environment. This may help identify spikes in SMB traffic that may be indicative of attackers scanning or attempting to propagate to other systems in your environment. By default, this model is built over 30 days of data and profiles the number of SMB connections in your environment by the hour of day/day of week that the connections occur.",
"how_to_implement": "You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding \"src\" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.",
"maintainers": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"modification_date": "2019-05-08",
"original_authors": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"scheduling": {
"earliest_time": "-31d@d",
"latest_time": "-1d@d"
},
"search": "| tstats `summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, \"%H\") | eval DayOfWeek=strftime(_time, \"%A\") | `drop_dm_object_name(\"All_Traffic\")` | fit DensityFunction count by \"HourOfDay,DayOfWeek\" into smb_pdfmodel",
"search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week.",
"search_id": "df98763b-0b08-4281-8ef9-08db7ac572a9",
"search_name": "Baseline of SMB Traffic - MLTK",
"search_type": "support",
"spec_version": 1,
"version": "1.0"
}
baselines/train_unusually_long_commandlines.json
+47
View File
@@ -0,0 +1,47 @@
{
"channel": "ESCU",
"creation_date": "2019-05-08",
"data_metadata": {
"data_models": [
"Endpoint"
],
"data_source": [
"Endpoint Intel"
],
"providing_technologies": [
"Carbon Black Response",
"CrowdStrike Falcon",
"Sysmon",
"Tanium",
"Ziften"
]
},
"eli5": "Create a machine-learning (ML) model to characterize the length of the command lines used in your environment. This can help you identify unusually long ones that may indicate that attackers are executing commands on yout systems.",
"how_to_implement": "You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.",
"maintainers": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"modification_date": "2019-05-08",
"original_authors": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"scheduling": {
"earliest_time": "-31d@d",
"latest_time": "-1d@d"
},
"search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `ctime(firstTime)`| `ctime(lastTime)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel",
"search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line.",
"search_id": "d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459",
"search_name": "Baseline of Command Line Length - MLTK",
"search_type": "support",
"spec_version": 1,
"version": "1.0"
}
bin/generate.py
+89 -26
View File
@@ -318,7 +318,6 @@ def generate_detections(REPO_PATH, stories):
complete_detections = dict()
for detection in detections:
# lets process v1 detections
if detection['spec_version'] == 1:
if verbose:
@@ -454,7 +453,6 @@ def generate_detections(REPO_PATH, stories):
for d in story['detections']:
if d['name'] == name:
complete_detections[name]['stories'].append(story['story_name'])
# print "DETECTIONS: {0} == BASELINES {1} == STORY{2}".format(name, baselines, story['story_name'])
# sort uniq the results
complete_detections[name]['stories'] = sorted(set(complete_detections[name]['stories']))
@@ -557,7 +555,7 @@ def write_analytics_story_confv2(stories, detections, OUTPUT_DIR):
# Finish the story
for story_name, story in sorted(stories.iteritems()):
output_file.write("[%s]\n" % story_name)
output_file.write("category = {0}\n".format(json.dumps(story['category'])))
output_file.write("category = {0}\n".format(json.dumps(story['category']).strip('"')))
output_file.write("creation_date = %s\n" % story['creation_date'])
output_file.write("modification_date = %s\n" % story['modification_date'])
output_file.write("id = %s\n" % story['id'])
@@ -614,7 +612,7 @@ def write_analytics_story_confv1(stories, detections, investigations, baselines,
# Finish the story
for story_name, story in sorted(stories.iteritems()):
output_file.write("[%s]\n" % story_name)
output_file.write("category = {0}\n".format(json.dumps(story['category'][0])))
output_file.write("category = {0}\n".format(json.dumps(story['category'][0]).strip('"')))
output_file.write("creation_date = %s\n" % story['creation_date'])
output_file.write("modification_date = %s\n" % story['modification_date'])
output_file.write("id = %s\n" % story['id'])
@@ -625,14 +623,37 @@ def write_analytics_story_confv1(stories, detections, investigations, baselines,
if 'detections' in story:
detection_searches = []
for d in story['detections']:
# we do not have any phantom or UBA detections for now we restrict this to Splunk
if d['type'] == 'splunk':
detection_searches.append("ESCU - " + d['name'] + " - Rule")
output_file.write("detection_searches = %s\n" % json.dumps(detection_searches))
# grab mappings
mappings = dict()
# grab provising technologies
providing_technologies = []
# grab datamodels
data_models = []
# process the above for detections
for detection_name, detection in sorted(detections.iteritems()):
for s in detection['stories']:
# check if the detection is part of this story
if s == story_name:
# grab providing technologies
if 'providing_technologies' in detection:
for pt in detection['providing_technologies']:
providing_technologies.append(pt)
# grab data models
if 'data_models' in detection:
for dm in detection['data_models']:
data_models.append(dm)
# we do not have any phantom or UBA detections for now we restrict this to Splunk
if s == story_name and detection['type'] == 'splunk':
for key in detection['mappings'].keys():
mappings[key] = list(detection['mappings'][key])
@@ -642,6 +663,21 @@ def write_analytics_story_confv1(stories, detections, investigations, baselines,
total_investigations = []
for investigation_name, investigation in sorted(investigations.iteritems()):
for s in investigation['stories']:
# check if the investigation is part of this story
if s == story_name:
# grab providing technologies
if 'providing_technologies' in investigation:
for pt in investigation['providing_technologies']:
providing_technologies.append(pt)
# grab data models
if 'data_models' in investigation:
for dm in investigation['data_models']:
data_models.append(dm)
# we do not write out searches for phantom in v1 spec, see write_analytics_story_confv2 for more details
# for now we restrict it to splunk
if s == story_name and investigation['type'] == 'splunk':
total_investigations.append("ESCU - " + investigation_name)
output_file.write("investigative_searches = %s\n" % json.dumps(total_investigations))
@@ -650,19 +686,31 @@ def write_analytics_story_confv1(stories, detections, investigations, baselines,
total_baselines = []
for baseline_name, baseline in sorted(baselines.iteritems()):
for s in baseline['stories']:
# check if the baseline is part of this story
if s == story_name:
# grab providing technologies
if 'providing_technologies' in baseline:
for pt in baseline['providing_technologies']:
providing_technologies.append(pt)
# grab data models
if 'data_models' in baseline:
for dm in baseline['data_models']:
data_models.append(dm)
# we do not write out baselines for phantom and uba in v1 spec, see write_analytics_story_confv2
# for now we restrict it to splunk
if s == story_name and baseline['type'] == 'splunk':
total_baselines.append("ESCU - " + baseline_name)
output_file.write("support_searches = %s\n" % json.dumps(total_baselines))
# generate datamodels
data_models = []
for d in story['detections']:
if 'data_models' in detections[d['name']]:
for dm in detections[d['name']]['data_models']:
data_models.append(dm)
# write out data models
output_file.write("data_models = %s\n" % (json.dumps(sorted(set(data_models)))))
# write out providing technologies models
output_file.write("providing_technologies = %s\n" % (json.dumps(sorted(set(providing_technologies)))))
# REMOVE THIS FUNCTION MAKE SURE ALL DESCRIPTIONs ARE NATIVELY IN MARKDOWN
description = markdown(story['description'])
output_file.write("description = %s\n" % description)
@@ -695,10 +743,11 @@ def write_use_case_lib_conf(stories, detections, investigations, baselines, OUTP
# process the stories
for story_name, story in sorted(stories.iteritems()):
output_file.write("[analytic_story://%s]\n" % story_name)
output_file.write("category = {0}\n".format(json.dumps(story['category'][0])))
output_file.write("category = {0}\n".format(json.dumps(story['category'][0]).strip('"')))
# output_file.write("created = %s\n" % story['creation_date'])
output_file.write("last_updated = %s\n" % story['modification_date'])
output_file.write("version = %s\n" % story['version'])
output_file.write("reference = %s\n" % json.dumps(story['references']))
output_file.write("references = %s\n" % json.dumps(story['references']))
output_file.write("maintainers = %s\n" % json.dumps(story['maintainers']))
output_file.write("spec_version = %s\n" % json.dumps(story['spec_version']))
@@ -739,10 +788,13 @@ def write_use_case_lib_conf(stories, detections, investigations, baselines, OUTP
output_file.write("type = detection\n")
output_file.write("asset_type = {0}\n".format(detection['asset_type']))
output_file.write("confidence = {0}\n".format(detection['confidence']))
output_file.write("explanation = {0}\n".format(detection['eli5']))
output_file.write("how_to_implement = {0}\n".format(detection['how_to_implement']))
eli5 = markdown(detection['eli5'])
output_file.write("explanation = {0}\n".format(eli5))
how_to_implement = markdown(detection['how_to_implement'])
output_file.write("how_to_implement = {0}\n".format(how_to_implement))
output_file.write("annotations = {0}\n".format(json.dumps(detection['mappings'])))
output_file.write("known_false_positives = {0}\n".format(detection['known_false_positives']))
known_false_positives = markdown(detection['known_false_positives'])
output_file.write("known_false_positives = {0}\n".format(known_false_positives))
output_file.write("providing_technologies = {0}\n".format(json.dumps(detection['providing_technologies'])))
output_file.write("\n")
output_file.write("### END DETECTIONS ###\n\n")
@@ -751,9 +803,11 @@ def write_use_case_lib_conf(stories, detections, investigations, baselines, OUTP
for investigation_name, investigation in sorted(investigations.iteritems()):
output_file.write("[savedsearch://ESCU - {0}]\n".format(investigation_name))
output_file.write("type = investigation\n")
output_file.write("explanation = none")
output_file.write("how_to_implement = {0}\n".format(investigation['how_to_implement']))
output_file.write("known_false_positives = {0}\n".format(investigation['known_false_positives']))
output_file.write("explanation = none\n")
how_to_implement = markdown(investigation['how_to_implement'])
output_file.write("how_to_implement = {0}\n".format(how_to_implement))
known_false_positives = markdown(investigation['known_false_positives'])
output_file.write("known_false_positives = {0}\n".format(known_false_positives))
output_file.write("earliest_time_offset = {0}\n".format(investigation['earliest_time']))
output_file.write("latest_time_offset = {0}\n".format(investigation['latest_time']))
output_file.write("\n")
@@ -763,9 +817,12 @@ def write_use_case_lib_conf(stories, detections, investigations, baselines, OUTP
for baseline_name, baseline in sorted(baselines.iteritems()):
output_file.write("[savedsearch://ESCU - {0}]\n".format(baseline_name))
output_file.write("type = support\n")
output_file.write("explanation = {0}\n".format(baseline['eli5']))
output_file.write("how_to_implement = {0}\n".format(baseline['how_to_implement']))
output_file.write("known_false_positives = {0}\n".format(baseline['known_false_positives']))
eli5 = markdown(baseline['eli5'])
output_file.write("explanation = {0}\n".format(eli5))
how_to_implement = markdown(baseline['how_to_implement'])
output_file.write("how_to_implement = {0}\n".format(how_to_implement))
known_false_positives = markdown(baseline['known_false_positives'])
output_file.write("known_false_positives = {0}\n".format(known_false_positives))
output_file.write("providing_technologies = {0}\n".format(json.dumps(baseline['providing_technologies'])))
output_file.write("\n")
output_file.write("### END BASELINES ###")
@@ -795,7 +852,8 @@ def write_savedsearches_confv1(stories, detections, investigations, baselines, O
output_file.write("[ESCU - {0} - Rule]\n".format(detection_name))
output_file.write("action.escu = 0\n")
output_file.write("action.escu.enabled = 1\n")
output_file.write("description = {0}\n".format(detection['description']))
description = markdown(detection['description'])
output_file.write("description = {0}\n".format(description))
output_file.write("action.escu.mappings = {0}\n".format(json.dumps(detection['mappings'])))
if 'data_models' in detection:
output_file.write("action.escu.data_models = {0}\n".format(json.dumps(detection['data_models'])))
@@ -913,7 +971,6 @@ def write_savedsearches_confv1(stories, detections, investigations, baselines, O
output_file.write("alert.suppress.period = {0}\n"
.format(detection['correlation_rule']['suppress']['suppress_period']))
output_file.write("is_visible = false\n")
output_file.write("action.escu.earliest_time_offset = 3600\n")
output_file.write("action.escu.latest_time_offset = 86400\n")
output_file.write("disabled=true\n")
@@ -943,12 +1000,15 @@ def write_savedsearches_confv1(stories, detections, investigations, baselines, O
output_file.write("action.escu.enabled = 1\n")
output_file.write("action.escu.search_type = investigative\n")
output_file.write("action.escu.full_search_name = ESCU - {0}\n".format(investigation_name))
output_file.write("description = {0}\n".format(investigation['description']))
description = markdown(investigation['description'])
output_file.write("description = {0}\n".format(description))
output_file.write("action.escu.creation_date = {0}\n".format(investigation['creation_date']))
output_file.write("action.escu.modification_date = {0}\n".format(investigation['modification_date']))
output_file.write("action.escu.analytic_story = {0}\n".format(json.dumps(investigation['stories'])))
output_file.write("action.escu.earliest_time_offset = 3600\n")
output_file.write("action.escu.latest_time_offset = 86400\n")
if 'data_models' in investigation:
output_file.write("action.escu.data_models = {0}\n".format(json.dumps(investigation['data_models'])))
if 'providing_technologies' in detection:
output_file.write("action.escu.providing_technologies = {0}\n".format(
json.dumps(investigation['providing_technologies'])))
@@ -987,10 +1047,13 @@ def write_savedsearches_confv1(stories, detections, investigations, baselines, O
output_file.write("action.escu.enabled = 1\n")
output_file.write("action.escu.search_type = support\n")
output_file.write("action.escu.full_search_name = ESCU - {0}\n".format(baseline_name))
output_file.write("action.escu.description = {0}\n".format(baseline['description']))
description = markdown(baseline['description'])
output_file.write("description = {0}\n".format(description))
output_file.write("action.escu.creation_date = {0}\n".format(baseline['creation_date']))
output_file.write("action.escu.modification_date = {0}\n".format(baseline['modification_date']))
output_file.write("action.escu.analytic_story = {0}\n".format(json.dumps(baseline['stories'])))
if 'data_models' in baseline:
output_file.write("action.escu.data_models = {0}\n".format(json.dumps(baseline['data_models'])))
if 'earliest_time' in baseline:
output_file.write("dispatch.earliest_time = {0}\n".format(baseline['earliest_time']))
if 'latest_time' in baseline:
detections/dns_evilginx_subdomains.json
+4 -3
View File
@@ -1,10 +1,11 @@
{
"asset_type": "Endpoint",
"confidence": "high",
"creation_date": "2019-04-04",
"creation_date": "2019-04-29",
"data_metadata": {
"data_models": [
"Network_Resolution"
"Network_Resolution",
"Web"
],
"data_source": [
"DNS"
@@ -90,7 +91,7 @@
"DE.CM"
]
},
"modification_date": "2019-04-04",
"modification_date": "2019-04-29",
"name": "Detect DNS requests to Phishing Sites leveraging EvilGinx2",
"original_authors": [
{
detections/dns_query_length_mltk.json
+86
View File
@@ -0,0 +1,86 @@
{
"asset_type": "Endpoint",
"channel": "ESCU",
"confidence": "medium",
"correlation_rule": {
"notable": {
"nes_fields": "src",
"rule_description": "Identify DNS traffic with unusual query lengths",
"rule_title": "DNS query length outliers"
},
"risk": {
"risk_object": "src",
"risk_object_type": [
"system"
],
"risk_score": 40
},
"suppress": {
"suppress_fields": "query",
"suppress_period": "43200s"
}
},
"creation_date": "2019-05-08",
"data_metadata": {
"data_models": [
"Network_Resolution"
],
"data_source": [
"DNS"
],
"providing_technologies": [
"Splunk Stream",
"Bro"
]
},
"eli5": "Attackers often use random, long domain names for components of their attack infrastructure. This search leverages the probability distribution function algorithm provided by the Machine Learning Toolkit (MLTK) to identify outliers in the length of the DNS query for each record type observed. The companion search \"Baseline of DNS Query Length - MLTK\" creates a machine-learning (ML) model built over the historical data used by this search. The determination of what is considered an outlier may be adjusted via the threshold parameter in the search. More information on the algorithm used can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.",
"how_to_implement": "To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search \"Baseline of DNS Query Length - MLTK\" must be executed before this detection search, as it builds a machine-learning (ML) model over the historical data used by this search. You should periodically re-run the support search to rebuild the model with the latest data available in your environment.",
"known_false_positives": "If you are seeing more results than desired, you may consider reducing the value for threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data.",
"maintainers": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"mappings": {
"cis20": [
"CIS 8",
"CIS 12"
],
"kill_chain_phases": [
"Command and Control"
],
"mitre_attack": [
"Command and Control",
"Exfiltration",
"Commonly Used Port"
],
"nist": [
"PR.PT",
"DE.AE",
"DE.CM"
]
},
"modification_date": "2019-05-08",
"original_authors": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` count min(_time) as start_time max(_time) as end_time values(DNS.src) as src values(DNS.dest) as dest from datamodel=Network_Resolution by DNS.query DNS.record_type | `drop_dm_object_name(DNS)` | `ctime(firstTime)` | `ctime(lastTime)` | eval query_length = len(query) | apply dns_query_pdfmodel threshold=0.01 | rename \"IsOutlier(query_length)\" as isOutlier | search isOutlier > 0 | sort -query_length | table start_time end_time query record_type count src dest query_length isOutlier",
"search_description": "This search allows you to identify DNS requests that are unusually large for the record type being requested in your environment.",
"search_id": "85fbcfe8-9718-4911-adf6-7000d077a3a9",
"search_name": "DNS Query Length Outliers - MLTK",
"search_type": "detection",
"security_domain": "network",
"spec_version": 1,
"version": "1.0"
}
detections/dns_query_length_with_high_standard_deviation.json
+2 -2
View File
@@ -4,12 +4,12 @@
"confidence": "medium",
"correlation_rule": {
"notable": {
"nes_fields": "dest",
"nes_fields": "src",
"rule_description": "Filter DNS requests and compute the standard deviation then filter on 2 times the standard deviation",
"rule_title": "DNS query length with high standard deviation"
},
"risk": {
"risk_object": "dest",
"risk_object": "src",
"risk_object_type": [
"system"
],
detections/dns_record_changed.json
+2 -2
View File
@@ -55,7 +55,7 @@
"src",
"dest"
],
"how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\". <br></br> <b>Splunk>Phantom Playbook Integration</b><br></br>If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk <code>https://splunkbase.splunk.com/app/3411/</code>, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. <br/>(Playbook Link:<code>https://my.phantom.us/4.1/playbook/dns-hijack-investigation/</code>).<br></br>",
"how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\". <br></br> <b>Splunk>Phantom Playbook Integration</b><br></br>If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Enrichment\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk <code>https://splunkbase.splunk.com/app/3411/</code>, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. <br/>(Playbook Link:<code>https://my.phantom.us/4.2/playbook/dns-hijack-enrichment/</code>).<br></br>",
"id": "44d3a43e-dcd5-49f7-8356-5209bb369065",
"investigations": [
{
@@ -65,7 +65,7 @@
},
{
"id": "c096f721-8842-42ce-bfc7-74bd9a72c712",
"name": "DNS Hijack enrichment",
"name": "DNS Hijack Enrichment",
"product_type": "phantom"
}
],
detections/lnk_executing_a_process.json
+4 -4
View File
@@ -2,7 +2,7 @@
"asset_type": "Endpoint",
"baselines": [],
"confidence": "high",
"creation_date": "2019-04-11",
"creation_date": "2019-04-29",
"data_metadata": {
"data_models": [
"Endpoint"
@@ -18,7 +18,7 @@
"Ziften"
]
},
"description": "This search looks for a *.lnk file under C:\\User* or *\\Local\\Temp\\* executing a process. This is common behavior used by various spear phishing tools.",
"description": "This search looks for a ``*.lnk` file under `C:\\User*` or `*\\Local\\Temp\\*` executing a process. This is common behavior used by various spear phishing tools.",
"detect": {
"splunk": {
"correlation_rule": {
@@ -47,7 +47,7 @@
}
}
},
"eli5": "In this search, we are essentially trying to detect if a LNK file created under the C:\\User* or *\\Local\\Temp\\* directory structures is launching a process with in 1 hour of its creation. LNK files or also known as Windows shortcut files are commonly associated with phishing and are a preferred method used for exploitation see: https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html.",
"eli5": "In this search, we are essentially trying to detect if a LNK file created under the C:\\User* or *\\Local\\Temp\\* directory structures is launching a process with in 1 hour of its creation. LNK files or also known as Windows shortcut files are commonly associated with phishing and are a [preferred method used for exploitation](https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html).",
"entities": [
"dest"
],
@@ -79,7 +79,7 @@
"PR.DS"
]
},
"modification_date": "2019-04-08",
"modification_date": "2019-04-29",
"name": "Suspicious LNK file launching a process",
"original_authors": [
{
detections/outlook_writing_zip.json
+10 -4
View File
@@ -2,7 +2,7 @@
"asset_type": "Endpoint",
"baselines": [],
"confidence": "high",
"creation_date": "2019-04-08",
"creation_date": "2019-04-29",
"data_metadata": {
"data_models": [
"Endpoint"
@@ -47,13 +47,19 @@
}
}
},
"eli5": "In this search, we are essentially trying to detect if outlook.exe is writing a `.zip` file to the disk. The way this search would run is, it will execute the the subsearch first which looks for all .zip files being written to the disk and outputs a crucial field \"process_id\", that we use the main search to check if that process_id belongs to a process_name of outlook.exe. The search uses a join command to essentially give you an end result of the first and last time that zip file was written by outlook.exe, the dest and user logged on the system, the hash value and the complete path to the zip file on disk",
"eli5": "In this search, we are essentially trying to detect if outlook.exe is writing a `.zip` file to the disk. The way this search would run is, it will execute the the subsearch first which looks for all .zip files being written to the disk and outputs a crucial field \"process\\_id\", that we use the main search to check if that process\\_id belongs to a process\\_name of outlook.exe. The search uses a join command to essentially give you an end result of the first and last time that zip file was written by outlook.exe, the dest and user logged on the system, the hash value and the complete path to the zip file on disk",
"entities": [
"dest"
],
"how_to_implement": "You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon.",
"id": "a51bfe1a-94f0-4822-b1e4-16ae10145893",
"investigations": [],
"investigations": [
{
"id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
"name": "Get Parent Process Info",
"product_type": "splunk"
}
],
"known_false_positives": "It is not uncommon for outlook to write legitimate zip files to the disk.",
"maintainers": [
{
@@ -79,7 +85,7 @@
"PR.DS"
]
},
"modification_date": "2019-04-08",
"modification_date": "2019-04-29",
"name": "Detect Oulook.exe writing a .zip file",
"original_authors": [
{
detections/short_lived_accounts.json
+2 -2
View File
@@ -23,7 +23,7 @@
"creation_date": "2018-01-05",
"data_metadata": {
"data_models": [
"Change_Analysis"
"Change"
],
"data_source": [
"Windows Event Logs"
@@ -66,7 +66,7 @@
"earliest_time": "-245m@m",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Change_Analysis where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by All_Changes.result_id All_Changes.user All_Changes.dest | `ctime(lastTime)` | `ctime(firstTime)` | `drop_dm_object_name(\"All_Changes\")` | transaction user maxspan=240m | search result_id=4720 result_id=4726",
"search": "| tstats `summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h All_Changes.user All_Changes.dest | `ctime(lastTime)` | `ctime(firstTime)` | `drop_dm_object_name(\"All_Changes\")` | search result_id = 4720 result_id=4726 | transaction user maxspan=240m | table firstTime lastTime count user dest result_id",
"search_description": "This search detects accounts that were created and deleted in a short time period.",
"search_id": "b25f6f62-0782-43c1-b403-083231ffd97d",
"search_name": "Short Lived Windows Accounts",
detections/smb_traffic_spike_mltk.json
+81
View File
@@ -0,0 +1,81 @@
{
"asset_type": "Endpoint",
"channel": "ESCU",
"confidence": "medium",
"correlation_rule": {
"notable": {
"nes_fields": "src",
"rule_description": "There was a spike in SMB traffic from $src$",
"rule_title": "SMB Traffic Spike from $src$"
},
"risk": {
"risk_object": "src",
"risk_object_type": [
"system"
],
"risk_score": 50
},
"suppress": {
"suppress_fields": "src",
"suppress_period": "28800s"
}
},
"creation_date": "2019-05-08",
"data_metadata": {
"data_models": [
"Network_Traffic"
],
"data_source": [
"Network Communications"
],
"providing_technologies": [
"Bro",
"Splunk Stream"
]
},
"eli5": "Attackers often leverage Server Message Block (SMB) traffic, a protocol used for Windows file-sharing activity. A high-profile example of SMB abuse was the WannaCry ransomware, which leveraged a vulnerability in the SMB protocol to propagate to other systems. Attackers have also used SMB for lateral movement with a target environment and to test credentials against target systems. While SMB is highly prevalent in Windows environments, a spike in SMB traffic may still be indicative of this type of malicious activity. This search leverages Splunk's Machine Learning Toolkit (MLTK) to identify spikes in SMB traffic that are unusual for a given hour of day/day of week combination. If such a spike is detected, you may want to investigate the source and analyze the cause of the abnormal traffic. The determination of what is considered an outlier may be adjusted via the threshold parameter in the search. More information on the algorithm used can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.",
"how_to_implement": "This search requires you to be ingesting your network traffic logs and populating the Network_Traffic data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search \"Baseline of SMB Traffic - MLTK\" must be executed before this detection search, as it builds a machine-learning (ML) model over the historical data used by this search. You should periodically re-run the support search to rebuild the model with the latest data available in your environment.",
"known_false_positives": "If you are seeing more results than desired, you may consider reducing the value of the threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data.",
"maintainers": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"mappings": {
"cis20": [
"CIS 8"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"mitre_attack": [
"Commonly Used Port"
],
"nist": [
"DE.CM"
]
},
"modification_date": "2019-05-08",
"original_authors": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` count values(All_Traffic.dest_ip) as dest values(All_Traffic.dest_port) as port from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=1h, All_Traffic.src | eval HourOfDay=strftime(_time, \"%H\") | eval DayOfWeek=strftime(_time, \"%A\") | `drop_dm_object_name(All_Traffic)` | apply smb_pdfmodel threshold=0.001 | rename \"IsOutlier(count)\" as isOutlier | search isOutlier > 0 | sort -count | table _time src dest port count isOutlier",
"search_description": "This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the number of Server Message Block (SMB) connections.",
"search_id": "d25773ba-9ad8-48d1-858e-07ad0bbeb828",
"search_name": "SMB Traffic Spike - MLTK",
"search_type": "detection",
"security_domain": "network",
"spec_version": 1,
"version": "1.0"
}
detections/suspicious_file_writes.json
+3 -3
View File
@@ -62,7 +62,7 @@
"DE.CM"
]
},
"modification_date": "2018-11-14",
"modification_date": "2019-04-25",
"original_authors": [
{
"company": "Splunk",
@@ -75,12 +75,12 @@
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` count values(Filesystem.action) as action values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest | `ctime(lastTime)` | `ctime(firstTime)` | `drop_dm_object_name(Filesystem)`",
"search": "| tstats `summariesonly` count values(Filesystem.action) as action values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest | `ctime(lastTime)` | `ctime(firstTime)` | `drop_dm_object_name(Filesystem)` | `suspicious_writes`",
"search_description": "The search looks for files created with names that have been linked to malicious activity.",
"search_id": "57f76b8a-32f0-42ed-b358-d9fa3ca7bac8",
"search_name": "Suspicious File Write",
"search_type": "detection",
"security_domain": "endpoint",
"spec_version": 1,
"version": "2.0"
"version": "3.0"
}
detections/unusually_long_commandlines.json
+84 -84
View File
@@ -1,84 +1,84 @@
{
"channel": "ESCU",
"confidence": "medium",
"correlation_rule": {
"notable": {
"nes_fields": "dest, process, user",
"rule_description": "An unusually long command-line $cmdline$ was found on $dest$",
"rule_title": "Unusually Long Command-Line on $dest$"
},
"risk": {
"risk_object": "dest",
"risk_object_type": [
"system"
],
"risk_score": 50
},
"suppress": {
"suppress_fields": "dest,user,process",
"suppress_period": "28800s"
}
},
"creation_date": "2017-08-23",
"data_metadata": {
"data_models": [
"Endpoint"
],
"data_source": [
"Endpoint Intel"
],
"providing_technologies": [
"Carbon Black Response",
"CrowdStrike Falcon",
"Sysmon",
"Tanium",
"Ziften"
]
},
"eli5": "This search calculates the average and standard deviation for the length of the command-lines on each of your endpoints and alerts when a command-line is found with a length over 10 times the standard deviation larger than the average command-line.",
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model. Please consider changing the value of threshold in the search for reducing false positives.",
"known_false_positives": "Some legitimate applications start with long command-lines.",
"maintainers": [
{
"company": "Splunk",
"email": "bpatel@splunk.com",
"name": "Bhavin Patel"
}
],
"mappings": {
"cis20": [
"CIS 8"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"mitre_attack": [
"Execution"
],
"nist": [
"PR.PT",
"DE.CM"
]
},
"modification_date": "2019-02-28",
"original_authors": [
{
"company": "Splunk",
"email": "davidd@splunk.com",
"name": "David Dorsey"
}
],
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-1d@d",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`| `ctime(lastTime)`| eval processlen=len(process) | eventstats stdev(processlen) as stdev, avg(processlen) as avg by dest | stats max(processlen) as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process| eval threshold = 10 | where maxlen > ((threshold*stdevperhost) + avgperhost)",
"search_description": "Command-lines that are extremely long can be indicative of malicious activity on your hosts.",
"search_id": "c77162d3-f93c-45cc-80c8-22f6a4264e7f",
"search_name": "Unusually Long Command Line",
"search_type": "detection",
"security_domain": "endpoint",
"spec_version": 1,
"version": "3.0"
}
{
"channel": "ESCU",
"confidence": "medium",
"correlation_rule": {
"notable": {
"nes_fields": "dest, process, user",
"rule_description": "An unusually long command line $cmdline$ was found on $dest$",
"rule_title": "Unusually Long Command Line on $dest$"
},
"risk": {
"risk_object": "dest",
"risk_object_type": [
"system"
],
"risk_score": 50
},
"suppress": {
"suppress_fields": "dest,user,process",
"suppress_period": "28800s"
}
},
"creation_date": "2017-08-23",
"data_metadata": {
"data_models": [
"Endpoint"
],
"data_source": [
"Endpoint Intel"
],
"providing_technologies": [
"Carbon Black Response",
"CrowdStrike Falcon",
"Sysmon",
"Tanium",
"Ziften"
]
},
"eli5": "This search calculates the average and standard deviation for the length of the command lines on each of your endpoints and alerts when it detects a command line with a length over 10 times the standard deviation larger than the average command line.",
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships, from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
"known_false_positives": "Some legitimate applications start with long command lines.",
"maintainers": [
{
"company": "Splunk",
"email": "bpatel@splunk.com",
"name": "Bhavin Patel"
}
],
"mappings": {
"cis20": [
"CIS 8"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"mitre_attack": [
"Execution"
],
"nist": [
"PR.PT",
"DE.CM"
]
},
"modification_date": "2019-02-28",
"original_authors": [
{
"company": "Splunk",
"email": "davidd@splunk.com",
"name": "David Dorsey"
}
],
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-1d@d",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`| `ctime(lastTime)`| eval processlen=len(process) | eventstats stdev(processlen) as stdev, avg(processlen) as avg by dest | stats max(processlen) as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process| eval threshold = 10 | where maxlen > ((threshold*stdevperhost) + avgperhost)",
"search_description": "Command lines that are extremely long may be indicative of malicious activity on your hosts.",
"search_id": "c77162d3-f93c-45cc-80c8-22f6a4264e7f",
"search_name": "Unusually Long Command Line",
"search_type": "detection",
"security_domain": "endpoint",
"spec_version": 1,
"version": "3.0"
}
detections/unusually_long_commandlines_mltk.json
+84
View File
@@ -0,0 +1,84 @@
{
"channel": "ESCU",
"confidence": "medium",
"correlation_rule": {
"notable": {
"nes_fields": "dest, process, user",
"rule_description": "An unusually long command line $cmdline$ was found on $dest$",
"rule_title": "Unusually Long Command Line on $dest$"
},
"risk": {
"risk_object": "dest",
"risk_object_type": [
"system"
],
"risk_score": 50
},
"suppress": {
"suppress_fields": "dest,user,process",
"suppress_period": "28800s"
}
},
"creation_date": "2019-05-08",
"data_metadata": {
"data_models": [
"Endpoint"
],
"data_source": [
"Endpoint Intel"
],
"providing_technologies": [
"Carbon Black Response",
"CrowdStrike Falcon",
"Sysmon",
"Tanium",
"Ziften"
]
},
"eli5": "This search leverages the Machine Learning Toolkit (MLTK) to identify outliers in the length of the command lines observed to be used by a specific user. The companion search, \"Baseline of Command Line Length - MLTK,\" creates a machine-learning (ML) model built over the historical data used by this search. The determination of what is considered an outlier may be adjusted via the threshold parameter in the search. More information on the algorithm used can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.",
"how_to_implement": "You must be ingesting endpoint data that monitors command lines and populates the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model. In addition, MLTK version >= 4.2 must be installed on your search heads, along with any required dependencies. Finally, the support search \"Baseline of Command Line Length - MLTK\" must be executed before this detection search, as it builds an ML model over the historical data used by this search. You should periodically re-run the support search to rebuild the model with the latest data available in your environment.",
"known_false_positives": "Some legitimate applications use long command lines for installs or updates. You should review identified command lines for legitimacy. You may modify the first part of the search to omit legitimate command lines from consideration. If you are seeing more results than desired, you may consider changing the value of threshold in the search to a smaller value. You should also periodically re-run the support search to re-build the ML model on the latest data. You may get unexpected results if the user identified in the results is not present in the data used to build the associated model.",
"maintainers": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"mappings": {
"cis20": [
"CIS 8"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"mitre_attack": [
"Execution"
],
"nist": [
"PR.PT",
"DE.CM"
]
},
"modification_date": "2019-05-08",
"original_authors": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` count min(_time) as start_time max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | `ctime(firstTime)`| `ctime(lastTime)`| eval processlen=len(process) | search user!=unknown | apply cmdline_pdfmodel threshold=0.01 | rename \"IsOutlier(processlen)\" as isOutlier | search isOutlier > 0 | table start_time end_time user dest process_name process processlen count isOutlier",
"search_description": "Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Machine Learning Toolkit (MLTK) to help identify command lines with lengths that are unusual for a given user.",
"search_id": "57edaefa-a73b-45e5-bbae-f39c1473f941",
"search_name": "Unusually Long Command Line - MLTK",
"search_type": "detection",
"security_domain": "endpoint",
"spec_version": 1,
"version": "1.0"
}
investigations/dns_hijack_enrichment.json
+2 -2
View File
@@ -12,7 +12,7 @@
]
},
"description": "This Playbook is part of the Splunk Analytic Story called DNS Hijacking. It is made to be run when the Detection Search within that story called \"DNS Record Changed\" is used to identify DNS record changes for cloud and corporate domains used in your environment. The detection search is dependent on a support searched called \"Discover DNS Records\" which finds the common DNS responses for the last 30 days of monitored corporate domains and cloud providers (located in lookups: cim_corporate_email_domains.csv, cim_corporate_web_domains.csv, and cloud_domains.csv from Splunk CIM App). These responses are stored under the lookup called discovered_dns_records.csv. The playbook starts with the changed DNS records and uses MaxMind, whois, Censys, Malware Domain List, and PassiveTotal to gather attributes of the DNS records for comparison against expected values. The resulting enrichment is displayed in Mission Control and posted back to the Notable Event in Splunk ES.",
"how_to_implement": "If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk <code>https://splunkbase.splunk.com/app/3411/</code>, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. <br/>(Playbook Link:<code>https://my.phantom.us/4.1/playbook/dns-hijack-investigation/</code>).<br></br>",
"how_to_implement": "If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Enrichment\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk <code>https://splunkbase.splunk.com/app/3411/</code>, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. <br/>(Playbook Link:<code>https://my.phantom.us/4.2/playbook/dns-hijack-enrichment/</code>).<br></br>",
"id": "c096f721-8842-42ce-bfc7-74bd9a72c712",
"investigate": {
"phantom": {
@@ -36,7 +36,7 @@
}
],
"modification_date": "2019-02-14",
"name": "DNS Hijack enrichment",
"name": "DNS Hijack Enrichment",
"original_authors": [
{
"company": "Splunk",
investigations/domain_cert_investigation.json
+2 -2
View File
@@ -1,5 +1,5 @@
{
"creation_date": "2019-04-16",
"creation_date": "2019-04-29",
"data_metadata": {
"data_source": [
"Censys"
@@ -37,7 +37,7 @@
"name": "Philip Royer"
}
],
"modification_date": "2019-16-04",
"modification_date": "2019-04-29",
"name": "Domain Certificate Investigation",
"original_authors": [
{
investigations/get_certificate_for_domain.json
+2 -2
View File
@@ -1,6 +1,6 @@
{
"channel": "ESCU",
"creation_date": "2019-04-08",
"creation_date": "2019-04-29",
"data_metadata": {
"data_models": [
"Certificates"
@@ -36,7 +36,7 @@
"name": "Bhavin Patel"
}
],
"modification_date": "2019-04-08",
"modification_date": "2019-04-29",
"name": "Get Certificate logs for a domain",
"original_authors": [
{
investigations/get_process_creating_dns_traffic.json
+1 -1
View File
@@ -38,7 +38,7 @@
"search": "| tstats `summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.dest = {dest} by Processes.parent_process Processes.process_name Processes.user Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `ctime(firstTime)`|`ctime(lastTime)` | search [| tstats `summariesonly` count from datamodel=Endpoint.Ports where Ports.dest_port=53 by Ports.process_id Ports.src | `drop_dm_object_name(Ports)` | rename src as dest]",
"search_description": "While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible for creating the DNS traffic.",
"search_id": "910e6512-edc9-4f93-ba24-5b786f47a672",
"search_name": "Get Process responsible for the DNS traffic",
"search_name": "Get Process Responsible For The DNS Traffic",
"search_type": "investigative",
"search_window": {
"earliest_time_offset": 3600,
src/default/analytic_stories.conf
+227 -156
View File
File diff suppressed because it is too large Load Diff
src/default/analyticstories.conf
-3556
View File
File diff suppressed because it is too large Load Diff
src/default/commands.conf
+1 -2
View File
@@ -5,5 +5,4 @@ chunked = true
[runstory]
filename = runstory.py
chunked = true
is_risky = true
local = true
is_risky = true
src/default/content-version.conf
+1 -1
View File
@@ -1,2 +1,2 @@
[content-version]
version = 1.0.37
version = 1.0.38
src/default/savedsearches.conf
+344 -250
View File
File diff suppressed because it is too large Load Diff
src/default/use_case_library.conf
+571 -300
View File
File diff suppressed because it is too large Load Diff
stories/brand_monitoring.json
+1 -1
View File
@@ -45,7 +45,7 @@
"Get Emails From Specific Sender",
"Investigate Web Activity From Host",
"Get DNS Server History for a host",
"Get Process responsible for the DNS traffic"
"Get Process Responsible For The DNS Traffic"
],
"support_searches": [
"DNSTwist Domain Names"
stories/command_and_control.json
+5 -3
View File
@@ -47,18 +47,20 @@
"Excessive DNS Failures",
"Detect Long DNS TXT Record Response",
"DNS Query Requests Resolved by Unauthorized DNS Servers",
"Detect Spike in blocked Outbound Traffic from your AWS"
"Detect Spike in blocked Outbound Traffic from your AWS",
"DNS Query Length Outliers - MLTK"
],
"investigative_searches": [
"Get Process Info",
"Get Process responsible for the DNS traffic",
"Get Process Responsible For The DNS Traffic",
"Get DNS Server History for a host",
"Get DNS traffic ratio",
"Get All AWS Activity From IP Address",
"Get Process Information For Port Activity"
],
"support_searches": [
"Baseline of blocked outbound traffic from AWS"
"Baseline of blocked outbound traffic from AWS",
"Baseline of DNS Query Length - MLTK"
]
},
"spec_version": 1,
stories/common_phishing_frameworks.json
+7 -8
View File
@@ -1,11 +1,10 @@
{
"category": [
"Adversary Tactics",
"Other"
"Adversary Tactics"
],
"channel": "ESCU",
"creation_date": "2019-03-12",
"description": "This Analytic Story will help you detect DNS and Web requests to phishing websites that used EvilGinx2 toolkit to mimic the fake website.",
"creation_date": "2019-04-29",
"description": "Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. ",
"detections": [
{
"detection_id": "24dd17b1-e2fb-4c31-878c-d4f226595bfa",
@@ -21,14 +20,14 @@
"name": "Splunk Research Team"
}
],
"modification_date": "2019-04-04",
"modification_date": "2019-04-29",
"name": "Common Phishing Frameworks",
"narrative": "Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as 91% of all successful attacks are initiated via a phishing email.<br/>As most people know, these emails use fraudulent domains, email scraping, familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a nefarious payload, or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely \"automate\" it out of your environment.<br/>However, you can use ES and ESCU to detect man-in-the-middle (MiTM) attacks. This Analytic Story focuses on detecting signs of MiTM attacks enabled by EvilGinx2, one of the most advanced phishing tools available in 2019. EvilGinx2 sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect.<br/>Once the detection searches in this Analytic Story identify signs of MiTM attacks enabled by EvilGinx2, you can use the corresponding Splunk Phantom playbook to help you investigate malicious domain names and URLs.",
"narrative": "As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.<br></br>This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2.",
"original_authors": [
{
"company": "Splunk",
"email": "bpatel@splunk.com",
"name": "Bhavin Patel"
"email": "research@splunk.com",
"name": "Splunk Research Team"
}
],
"references": [
stories/data_protection.json
+1 -1
View File
@@ -42,7 +42,7 @@
],
"investigative_searches": [
"Get DNS Server History for a host",
"Get Process responsible for the DNS traffic"
"Get Process Responsible For The DNS Traffic"
],
"support_searches": []
},
stories/dhs_report_TA18-074A.json
+4 -1
View File
@@ -35,6 +35,7 @@
],
"detection_searches": [
"SMB Traffic Spike",
"SMB Traffic Spike - MLTK",
"Processes launching netsh",
"Suspicious Reg.exe Process",
"Sc.exe Manipulating Windows Services",
@@ -50,10 +51,12 @@
],
"investigative_searches": [
"Get Process Info",
"Get Process Information For Port Activity",
"Get Parent Process Info"
],
"support_searches": [
"Previously seen command line arguments"
"Previously seen command line arguments",
"Baseline of SMB Traffic - MLTK"
]
},
"spec_version": 1,
stories/dynamic_dns.json
+1 -1
View File
@@ -43,7 +43,7 @@
"investigative_searches": [
"Get DNS Server History for a host",
"Get DNS traffic ratio",
"Get Process responsible for the DNS traffic",
"Get Process Responsible For The DNS Traffic",
"Investigate Web Activity From src_ip"
],
"support_searches": []
stories/emotet.json
+5 -1
View File
@@ -41,16 +41,20 @@
"Detect Use of cmd.exe to Launch Script Interpreters",
"Prohibited Software On Endpoint",
"SMB Traffic Spike",
"SMB Traffic Spike - MLTK",
"Suspicious Email Attachment Extensions",
"Email Attachments With Lots Of Spaces",
"Detection of tools built by NirSoft"
],
"investigative_searches": [
"Get Process Info",
"Get Process Information For Port Activity",
"Get Parent Process Info",
"Investigate Web Activity From Host"
],
"support_searches": []
"support_searches": [
"Baseline of SMB Traffic - MLTK"
]
},
"spec_version": 1,
"version": "1.0"
stories/hidden_cobra_malware.json
+7 -2
View File
@@ -36,21 +36,26 @@
],
"detection_searches": [
"SMB Traffic Spike",
"SMB Traffic Spike - MLTK",
"First time seen command line argument",
"Detect Outbound SMB Traffic",
"Remote Desktop Network Traffic",
"Remote Desktop Process Running On System",
"DNS Query Length With High Standard Deviation",
"Create or delete hidden shares using net.exe",
"Suspicious File Write"
"Suspicious File Write",
"DNS Query Length Outliers - MLTK"
],
"investigative_searches": [
"Get Process Info",
"Get Process Information For Port Activity",
"Get Parent Process Info",
"Get Outbound Emails to Hidden Cobra Threat Actors"
],
"support_searches": [
"Previously seen command line arguments"
"Previously seen command line arguments",
"Baseline of DNS Query Length - MLTK",
"Baseline of SMB Traffic - MLTK"
]
},
"spec_version": 1,
stories/host_redirection.json
+1 -1
View File
@@ -39,7 +39,7 @@
"investigative_searches": [
"Investigate Web Activity From Host",
"Get DNS Server History for a host",
"Get Process responsible for the DNS traffic"
"Get Process Responsible For The DNS Traffic"
],
"support_searches": []
},
stories/mudcarp.json
+4 -2
View File
@@ -39,14 +39,16 @@
"First time seen command line argument",
"Registry Keys Used For Persistence",
"Malicious PowerShell Process - Connect To Internet With Hidden Window",
"Unusually Long Command Line"
"Unusually Long Command Line",
"Unusually Long Command Line - MLTK"
],
"investigative_searches": [
"Get Process Info",
"Get Parent Process Info"
],
"support_searches": [
"Previously seen command line arguments"
"Previously seen command line arguments",
"Baseline of Command Line Length - MLTK"
]
},
"spec_version": 1,
stories/phishing_payloads.json
+10 -9
View File
@@ -1,11 +1,10 @@
{
"category": [
"Adversary Tactics",
"Other"
"Adversary Tactics"
],
"channel": "ESCU",
"creation_date": "2019-04-10",
"description": "This story contains analytics around detecting payloads from a phishing attack",
"creation_date": "2019-04-29",
"description": "Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack.",
"detections": [
{
"detection_id": "a51bfe1a-94f0-4822-b1e4-16ae10145893",
@@ -26,17 +25,19 @@
"name": "Splunk Research Team"
}
],
"modification_date": "2019-04-10",
"modification_date": "2019-04-29",
"name": "Phishing Payloads",
"narrative": "XXXX - Placeholder for Phishing narrative",
"narrative": "Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. <br></br>As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely \"automate\" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. <br></br>While any kind of file may contain a malicious payload, some are more likely to be perceived as benign (and thus more often escape notice) by the average victim&#151;especially when the attacker sends an email that seems to be from one of their contacts. An example is Microsoft Office files. Most corporate users are familiar with documents with the following suffixes: .doc/.docx (MS Word), .xls/.xlsx (MS Excel), and .ppt/.pptx (MS PowerPoint), so they may click without a second thought, slashing a hole in their organizations' security. <br></br>Following is a typical series of events, according to an [article by Trend Micro](https://blog.trendmicro.com/trendlabs-security-intelligence/rising-trend-attackers-using-lnk-files-download-malware/):<ol><li>Attacker sends a phishing email. Recipient downloads the attached file, which is typically a .docx or .zip file with an embedded .lnk file</li><li>The .lnk file executes a PowerShell script</li><li>Powershell executes a reverse shell, rendering the exploit successful </ol>As a side note, adversaries are likely to use a tool like Empire to craft and obfuscate payloads and their post-injection activities, such as [exfiltration, lateral movement, and persistence](https://github.com/EmpireProject/Empire).<br></br>This Analytic Story focuses on detecting signs that a malicious payload has been injected into your environment. For example, one search detects outlook.exe writing a .zip file. Another looks for suspicious .lnk files launching processes.",
"original_authors": [
{
"company": "Splunk",
"email": "bpatel@splunk.com",
"name": "Bhavin Patel"
"email": "research@splunk.com",
"name": "Splunk Research Team"
}
],
"references": [],
"references": [
"https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"
],
"spec_version": 2,
"usecase": "Advanced Threat Detection",
"version": "1.0"
stories/ransomware.json
+5 -1
View File
@@ -45,6 +45,7 @@
"Spike in File Writes",
"Prohibited Network Traffic Allowed",
"SMB Traffic Spike",
"SMB Traffic Spike - MLTK",
"Common Ransomware Extensions",
"Common Ransomware Notes",
"System Processes Run From Unexpected Locations",
@@ -52,6 +53,7 @@
"TOR Traffic",
"Registry Keys Used For Persistence",
"Unusually Long Command Line",
"Unusually Long Command Line - MLTK",
"Scheduled tasks used in BadRabbit ransomware",
"Schtasks used for forcing a reboot"
],
@@ -65,7 +67,9 @@
"Monitor Successful Backups",
"Monitor Unsuccessful Backups",
"Windows Updates Install Failures",
"Windows Updates Install Successes"
"Windows Updates Install Successes",
"Baseline of Command Line Length - MLTK",
"Baseline of SMB Traffic - MLTK"
]
},
"spec_version": 1,
stories/suspicious_cmd_line_executions.json
+3 -1
View File
@@ -36,6 +36,7 @@
"detection_searches": [
"First time seen command line argument",
"Unusually Long Command Line",
"Unusually Long Command Line - MLTK",
"Detect Prohibited Applications Spawning cmd.exe",
"Detect Use of cmd.exe to Launch Script Interpreters",
"System Processes Run From Unexpected Locations"
@@ -46,7 +47,8 @@
"Investigate Web Activity From Host"
],
"support_searches": [
"Previously seen command line arguments"
"Previously seen command line arguments",
"Baseline of Command Line Length - MLTK"
]
},
"spec_version": 1,
stories/suspicious_dns_traffic.json
+6 -3
View File
@@ -42,14 +42,17 @@
"DNS Query Requests Resolved by Unauthorized DNS Servers",
"Detect Long DNS TXT Record Response",
"Detection of DNS Tunnels",
"Detect hosts connecting to dynamic domain providers"
"Detect hosts connecting to dynamic domain providers",
"DNS Query Length Outliers - MLTK"
],
"investigative_searches": [
"Get DNS Server History for a host",
"Get DNS traffic ratio",
"Get Process responsible for the DNS traffic"
"Get Process Responsible For The DNS Traffic"
],
"support_searches": []
"support_searches": [
"Baseline of DNS Query Length - MLTK"
]
},
"spec_version": 1,
"version": "1.0"
stories/unusual_processes.json
+4 -1
View File
@@ -37,6 +37,7 @@
"detection_searches": [
"Uncommon Processes On Endpoint",
"Unusually Long Command Line",
"Unusually Long Command Line - MLTK",
"Detect Rare Executables",
"System Processes Run From Unexpected Locations",
"RunDLL Loading DLL By Ordinal",
@@ -46,7 +47,9 @@
"Get Process Info",
"Investigate Web Activity From Host"
],
"support_searches": []
"support_searches": [
"Baseline of Command Line Length - MLTK"
]
},
"spec_version": 1,
"version": "2.0"